Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Weekly Cybersecurity Recap October 27

This week, many institutions were targeted for attacks, impacting thousands differently. In the northeast of the US, New York’s gambling scene suffered an attack, downing casinos across the state. In the South, hackers attacked Florida’s Akumin clinics, exposing patient data. In Pennsylvania, the City of Philadelphia suffered from leaking the information of city email owners.

University of Michigan Suffers Massive Data Breach Following Network Hack

The University of Michigan (UM) hosts more than 55,000 students, 35,000 staff members, and 640,000 alums. Unfortunately, following a recent cybersecurity breach, students, applicants, alums, employees, contractors, and donors may now have information at risk. The extent of the exposure is unknown, but the outcome could impact anyone. Those in association with UM must take steps to guard themselves before the assailants can misuse their information.

New Amazon-Themed Phishing Campaign Targets Microsoft Live Outlook Users

Several months ago, Netskope Threat Labs uncovered a surge in PDF phishing attachments infiltrating Microsoft Live Outlook. These attacks were part of a larger series of phishing campaigns aimed to trick unsuspecting users. Upon closer examination, it's now apparent that the majority of these campaigns centered around Amazon-themed scams, with occasional diversions into Apple and IRS-themed phishing attempts.

Job-to-be-Done: Quickly resolve exposures and vulnerabilities

It’s not unlikely that your team has a sufficient amount of vulnerability data that they must assess, prioritize, and remediate. Whether that’s a newly discovered vulnerability, an expired SSL certificate, or even a security policy breach – security teams need to get all this data into one place. For AppSec and ProdSec teams to be successful, they need to know which of their assets are exposed and vulnerable so they can take action to enable faster remediation.

CVE-2023-46747: Critical Unauthenticated RCE Vulnerability in F5 BIG-IP

On October 26, 2023, F5 released security hotfixes for a critical unauthenticated RCE vulnerability (CVE-2023-46747) in BIG-IP’s Traffic Management User Interface (TMUI). If successfully exploited a threat actor with network access to the vulnerable system could bypass the configuration utility authentication and execute arbitrary system commands. CVE-2023-46747 is exploitable if the Traffic Management User Interface is exposed to the Internet.

Keeping Perspective Amongst the Sometimes Tumultuous Cybersecurity Environment

A SOC analyst role is equal parts fulfilling and overwhelming. On one hand, the landscape is dynamic and the work is critical to protecting organizations. On the other, the weight of continual responsibility can lead to stress, anxiety, and cybersecurity burnout. Understanding the importance of your mental health is crucial to maintaining productivity and preventing cybersecurity burnout.

Ekran System Partners with Hideez to Introduce Enhanced Authentication Functionality

Ekran System is partnering with Hideez to enhance the authentication process and improve user experience. As an alternative to two-factor authentication, our customers can now use a straightforward passwordless authentication method developed by Hideez. Thanks to this integration, you can streamline and consolidate logins for local desktops, remote desktop connections, virtual environments, and cloud infrastructures, while boosting your team’s efficiency and satisfaction.

5 Ways to Protect Your Company's Valuable Life Sciences Data

Despite increasing cybersecurity awareness across the industry, Life Sciences firms continue to experience significant cyberattack volume. In fact, published reports indicate that average Life Sciences data breach now costs more than $5 million, while Life Sciences and Healthcare organizations perennially top the annual list of data breach costs by industry.