At a glance.
- US Federal government issues voluntary security guidelines.
- Possible privilege escalation within Google Cloud.
- APT compromises JumpCloud.
- LockBit adds a local government to its list of victims.
- FIN8 reworks its Sardonic backdoor and continues its shift to ransomware.
- Insider threats to data: lessons in risk management.
- Trends in threats to online payment systems.
- Russian cyber crime, without obvious political allegiance.
US Federal government issues voluntary security guidelines.
The White House has announced a cybersecurity labeling program for smart devices: “Under the proposed new program, consumers would see a newly created ‘U.S. Cyber Trust Mark’ in the form of a distinct shield logo applied to products meeting established cybersecurity criteria. The goal of the program is to provide tools for consumers to make informed decisions about the relative security of products they choose to bring into their homes.” Manufacturers and retailers that have committed to the voluntary program include Amazon, Best Buy, Google, LG Electronics U.S.A., Logitech, and Samsung Electronics.
The US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued guidance for 5G network slicing. The guidance is intended to “help foster communication amongst mobile network operators, hardware manufacturers, software developers, non-mobile network operators, systems integrators, and network slice customers in the hopes that it may facilitate increased resiliency and security hardening within network slicing.”
CISA has also published a factsheet outlining free tools for cloud environments, “to help businesses transitioning into a cloud environment identify proper tools and techniques necessary for the protection of critical assets and data security.”