Tag Archive for: device

CISA Issues Binding Directive to Remove Certain Federal Device Interfaces from Public Internet; Jen Easterly Quoted

/in


The Cybersecurity and Infrastructure Security Agency is mandating government entities to remove dedicated device interfaces from public-facing Internet if such platforms are exclusive to authorized users but accessible through remote network protocols.

The agency on Tuesday issued a binding operational directive to fight cyberthreat campaigns that target improperly configured network devices to hack into sensitive federal data.

The directive applies to devices that reside in networks such as routers, proxy servers, switches, firewalls, VPN concentrators, load balancers and even out-of-band server management interfaces. The network protocols of concern include hypertext transfer protocol and hypertext transfer protocol secure, as well as file transfer protocol, trivial FTP, remote desktop protocol and simple network management protocol.

The mandate does not affect networked management interfaces used for cloud service provider platforms.

CISA is also requiring federal civilian executive branch agencies to implement zero trust architecture to control accessibility to the interfaces.

Federal offices are urged to take action within 14 days of discovering that their interface has been exposed.

“Too often, threat actors are able to use network devices to gain unrestricted access to organizational networks, in turn leading to full-scale compromise,” CISA Director Jen Easterly commented. “Requiring appropriate controls and mitigations outlined in this Directive is an important step in reducing risk to the federal civilian enterprise,” the Wash100 honoree added.

Billions of Android and iPhone owners urged to check signs a criminal is hiding in your device – don’t lose everything

/in


SECURITY experts have warned smartphone users about major signs that criminals are hoping to hack their device.

Androids and iPhones are pretty safe gadgets but no device is fully hackproof, according to cybersecurity experts at Trend Micro.

Hackers have several techniques when it comes to infiltrating smartphonesCredit: Getty

They wrote in a recent blog post: “Unfortunately, no device can ever be 100% hackproof, and the iPhone is no exception.”

The blog lists three potential ways that a hacker can infiltrate your phone.

They’re all pretty common and you may have some of the red flags on your device right now.

EVIL APPS

The first hacking route the experts pointed out was “malicious apps.”

It’s normal to download apps onto your smartphone, but cybercriminals rely on you not checking what you’re downloading.

You have to be wary of all apps you download onto your device and make sure you’ve double checked the permissions that they want to access.

Try reading the apps reviews and only downloading from the Google Play Store or Apple App Store.

DANGEROUS WI-FI

The Trend Micro experts also warned against using insecure Wi-Fi networks, especially public Wi-Fi.

Most read in Phones & Gadgets

Cybercriminals can take advantage of your need to be online and steal data from your device.

Even the FBI has warned to be wary of public Wi-Fi.

“Preventing internet-enabled crimes and cyber intrusions requires each of us to be aware and on guard,” the FBI wrote in a recent announcement.

“Be careful when connecting to a public Wi-Fi network and do not conduct any sensitive transactions, including purchases, when on a public network.”

PHISHING MESSAGES

The third threat on the list could be lurking in your email app or text message inbox.

Phishing emails and texts sit waiting on devices, often containing dangerous links, and attachments.

Delete any suspicious messages without clicking on links or revealing any private information.

Source…

HS releases mobile device security checklist, update on ransomware threat 

/in


The Department of Health and Human Services yesterday released a mobile device security checklist for the health care sector, and an update on the Black Basta ransomware group targeting the sector since last year.

“The Health Sector Cybersecurity Coordination Center checklist is a practical guide to mobile device security, and the unique risk exposure we face through the integration of these devices into clinical operations on site and via remote access,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “Mobile device security also raises the related issues of HIPAA security and privacy compliance. Mobile devices used to store or transmit patient data should be centrally managed by enterprise mobile device management applications. 

“The Black Basta Russian-speaking ransomware gang has been aggressively targeting the health care sector since 2022, gaining access through unsecured remote desktop protocol and using highly targeted spear phishing emails containing malicious attachments. Black Basta and other Russian-speaking ransomware gangs increasingly rely on the despicable tactic of data extortion — threatening to publicly expose sensitive patient health information to force ransom payment. I strongly recommend storing and transmitting all protected health information inside and outside the electronic health record in an encrypted manner.”

For more information on this or other cyber and risk issues, contact Riggi at [email protected]. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity. 
 

Source…