Vendor Blunder - Cisco “inadvertently” shipped in-house exploit code that was used in security tests of scripts as part of its TelePresence Video Communication Server and Expressway Series software.

The code was used internally by Cisco in validation scripts to be included in shipping software images – it was used to ensure that Cisco’s software is protected against known exploits. However, there was a failure in the final QA validation step of the software, and as a result someone from Cisco forgot to remove the code before release

https://threatpost.com/cisco-accidentally-released-dirty-cow-exploit-code-in-software/138888/

Another incident to remind us that our vendor/contractor's security practices are part of our security - One of American Express (India) subcontractor missed to encrypt 700,000 customer records , exposing names, email addresses, phone numbers and card type.

The bulk of the data – more than 2.3 million records – it housed was encrypted, requiring an encryption key but the nearly 700,000 customer records were in plaintext, exposing names, email addresses, phone numbers and card types.
the database was not managed by AmEx itself but instead by one their subcontractors who were responsible for SEO or lead generation.

Sensitive information is left publicly available in a data repository due to poor developer practices

https://www.scmagazine.com/home/security-news/leaky-mongodb-server-exposes-personal-info-on-700k-amex-india-customers/

Why you will be needing both technology and "awareness training" to prevent BEC and Phishing Attacks

Valimail research, which found that when it came to detecting fraudulent emails, there was virtually no difference between the scores of those who received anti-phishing training compared with those who didn't. Out of 11 emails, those who received the training identified 4.98 and those who didn't spotted 4.97.

"By taking on a more defense-in-depth approach, the burden on the humans is less, so there's a better chance that when emails do get through, the users will be able to detect them because they won't be overwhelmed.

"One of the big problems is that people tend to reuse passwords," Jacoby says.

https://www.darkreading.com/operations/identity-and-access-management/why-password-management-and-security-strategies-fall-short/d/d-id/1333221

Common sense says "Encryption" means that you will need a "KEY" to decrypt it - when the researchers tested self-encrypting SSDs from Samsung and Crucial — they found fundamental vulnerabilities in many models that make it possible for someone to bypass the encryption entirely

The flaws allow anyone with the requisite know-how and physical access to the drives to recover encrypted data without the need for any passwords or decryption keys.

One fundamental flaw  was a failure to properly bind the disk encryption key (DEK) to a password.

The full disk hardware encryption available on some widely used storage devices is so poorly implemented there may as well not be any encryption on them at all,


Another fundamental flaw the researchers discovered allows for a disk encryption key to be recovered from an SSD even after a user sets a new master password for it. In this case, the vulnerability is tied to a property of flash memory in SSDs called "wear leveling,"


https://www.darkreading.com/vulnerabilities---threats/critical-encryption-bypass-flaws-in-popular-ssds-compromise-data-security/d/d-id/1333207

Financial Fraud - I am talking about us (not corporations) More than 16 million Americans were victims of fraud last year, resulting in almost $17 billion of losses. So, what can we do?

Solution (other than MFA) - Simple, Be super skeptical of any email that arrives asking for any personal information,” he says. “Even if it’s claiming that your account has been hacked or your bank account is overdrawn.”

“As soon as they ask you for your pin or your password, that’s a bad guy,” he says.


http://time.com/money/5439185/bank-fraud-protection-tips

New PenTest Poster from SANS

Get it Here


https://blogs.sans.org/pen-testing/files/2018/10/PEN-PR-BGP_v1_1018_WEB_FINAL_11052018.pdf

Don't become a victim to Phishing or pretexting attack

Phishing and pretexting are among the top ten causes of all data breaches. The strange part is that they are not highly-technical attacks. They are so effective that even the most sophisticated attackers use them.
(Simple Solution = UAT - User Awareness Training)


What is pretexting?
A targeted, social engineering-based attack in which attackers use continuous dialogue to build a sense of trust with the victim. By creating a fabricated scenario and posing as a senior employee or a trusted vendor, attackers manipulate victims into willingly giving up sensitive information, granting access to systems, or even transferring money.

https://blog.knowbe4.com/successful-pretexting-attacks-have-nearly-tripled-since-2017?utm_content=79276052&utm_medium=social&utm_source=twitter