ICS exposure to the Internet. BunnyLoader in C2C markets. Phantom Hacker scams. DHS IG reports. Hybrid war updates.

Summary

By the CyberWire staff

At a glance.

Nearly 100,000 ICS services exposed to the Internet.
BunnyLoader in the C2C market.
Phantom Hacker scams. API risks.
Cybersecurity attitudes and behaviors.
Homeland Security IG finds flaws in TSA pipeline security regulations.
DHS IG also finds privacy issues with CBP, ICE, and USSS use of commercial telemetry.
Kyiv prepares for Russian attacks on Ukraine's power grid.
Russian disinformation expected to aim at undermining US support for Ukraine.

Nearly 100,000 ICS services exposed to the Internet.

BitSight has identified nearly 100,000 industrial control systems exposed to the Internet, particularly in the education, technology, government and politics, and business sectors. The researchers note, however, that overall there’s been a steady decline in Internet-exposed ICS services since 2019. So in some respects this is actually a good-news story.

BitSight adds, “Exposed systems and devices communicating via the Modbus and S7 protocols are more common in June 2023 than before, with the former increasing in prevalence from 2020 and the latter more recently from mid-2022. However, exposed industrial control systems communicating via Niagara Fox have been trending downward since roughly 2021. Organizations should be aware of these changes in prevalence to inform their OT/ICS security strategies.”

BunnyLoader in the C2C market.

Zscaler is tracking a new malware-as-a-service offering called “BunnyLoader” that’s being sold on underground forums for a one-time price of $250. The malware “is designed to steal information related to web browsers, cryptocurrency wallets, VPNs and much more.” BunnyLoader targets cryptocurrency wallets for Bitcoin, Monero, Ethereum, Litecoin, Dogecoin, ZCash, Tether. The researchers note that the malware “has been under rapid development” since its initial release on September 4th.

Phantom Hacker scams.

The US Federal Bureau of Investigation (FBI) has warned of an increase in “Phantom Hacker” scams targeting senior citizens. “This Phantom Hacker scam is an evolution of more general tech support scams, layering imposter tech support, financial institution, and government personas to enhance the trust victims place in the scammers and identify the most lucrative accounts to target. Victims often suffer the loss of entire banking, savings, retirement, or investment accounts under the guise of ‘protecting’ their assets.” The Bureau says victims have lost over $542 million to tech support scams in the first half of 2023, with 66% of these losses from victims over 60 years old.

Earn your cybersecurity master’s from an NSA-recognized institution.

Further your career and secure your future with an advanced degree from the George Washington University — choose from 100% online master’s in cybersecurity analytics or in cybersecurity policy & compliance. Designed by D.C. experts and taught by cybersecurity leaders, these programs integrate computer science and engineering courses to give you the well-rounded expertise you need for leadership roles and professional advancement. Discover how you can get a world-class education made for working professionals.

API risks.

BreachLock has published an article for The Hacker News looking at cybersecurity risks associated with APIs: “2023 reports indicate cyberattacks targeting APIs have jumped 137%, with healthcare and manufacturing seen as prime targets by attackers. Attackers are especially interested in the recent influx of new devices under the Internet of Medical Things and associated apps and API ecosystem that has supported the provision of more accessible patient care and services. Another industry that is also vulnerable is manufacturing, which has experienced an increase in IoT devices and systems, leading to a 76% increase in media attacks in 2022.”

Cybersecurity attitudes and behaviors.

The National Cybersecurity Alliance (NCA) and CybSafe have published a report looking at cybersecurity behaviors around the world. In the United States, the researchers found, “A significant majority (79%) now recognize Multi-Factor Authentication (MFA) and, encouragingly, 70% within this group are actively using it to enhance their online security on a regular basis. However, despite these positive trends, there are concerns about access to adequate training; based on the survey only 44% of participants in the United States reported having access to cybersecurity training programs.”

A clear, friendly guide to mastering the hot new category in cloud-native security that's taking the industry by storm.

Wiz partnered with Wiley to create the Cloud Native Application Protection Platform (CNAPP) for Dummies eBook. This free 48-page PDF includes everything you *need* to know to secure the changing landscape of cloud-native applications and protect your cloud environment today. Get your free guide here.

Homeland Security IG finds flaws in TSA pipeline security regulations.

A redacted version of a report by the Office of the Inspector General at the Department of Homeland Security has been released. The IG was looking into the Transportation Security Administration’s (that’s TSA’s) formulation and enforcement of pipeline safety regulations after the May 2021 ransomware attack against Colonial Pipeline.

TSA responded with two regulations:

Security Directive Pipeline–2021–01, “Enhancing Pipeline Cybersecurity (SD-01),” issued on May 26th, 2021, rule required that operators of “critical” pipelines–those that carry hazardous fluids and natural gas–to designate a cybersecurity coordinator, report cyber incidents, and conduct a vulnerability assessment.
The second regulation, Security Directive Pipeline–2021– 02 “Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing,” issued on July 19th of that year, required owners and operators of pipelines designated as “critical” “to implement additional and immediately needed cybersecurity measures to prevent disruption and degradation to their infrastructure in response to an ongoing threat.

The IG found that TSA, while it properly worked with stakeholders to develop the rules, didn’t effectively follow-up to track compliance. The IG made three recommendations, all of them procedural enhancements designed to ensure proper oversight of operator compliance. TSA has concurred with the IG’s report and its recommendations.

DHS IG also finds privacy issues with CBP, ICE, and USSS use of commercial telemetry.

Another Homeland Security Inspector General (IG) report found that three of the Department's agencies--Customs and Border Protection, Immigration and Customs Enforcement, and the Secret Service--"did not adhere to Department privacy policies or develop sufficient policies before procuring and using commercial telemetry data." The data the agencies purchased included mobile device geolocation information, and the IG found that they hadn't prepared to preserve the privacy of the individuals whose data they purchased.

Join the Lacework CISO book club!

Get a copy of the classic novel, The Phoenix Project, and join quarterly interactive discussions with cybersecurity leaders. Sign up here.

Kyiv prepares for Russian attacks on Ukraine's power grid.

Ukraine is preparing for winter attacks against its energy infrastructure, the Economist reports, a reprise of last winter's Russian counter-grid program. That program was dominated by kinetic attacks, and Ukraine expects more of the same over the coming months, but it's also working to increase its resilience in the face of cyberattacks against power generation and distribution, as these are also expected.

Russian disinformation expected to aim at undermining US support for Ukraine.

The US Intelligence Community expects Russia to mount influence operations directed against US support for Ukraine, the New York Times reports, Russian disinformation about NATO in general and the US and UK in particular have been common during the war, but the next round of influence operations is thought likely to be directly disruptive in concept. The US elections next year are expected to be targeted, with Russian operators seeking to support candidates unsympathetic to Ukraine, and to denigrate candidates who favor continued US support of Kyiv. Heavy use of influence washing and troll farms, directed by Russian intelligence services, is expected.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Schedule a Complimentary Threat Briefing On LUCR-3 (aka Scattered Spider)

Learn the cloud TTPs of LUCR-3 (aka Scattered Spider), the group responsible for breaching the cloud environments of some of the largest enterprises in the world. Permiso is now offering complimentary threat briefings on this threat group with Ian Ahl, SVP of P0 Labs and former head of advanced practices at Mandiant. Learn how to better defend against cloud attacks orchestrated across identity providers, Iaas, Saas and CI/CD pipelines. Schedule your briefing today.

Notes.

Today's issue includes events affecting Canada, India, NATO/OTAN, Russia, Ukraine, the United Kingdom, and the United States.

Dateline: Russias hybrid war against Ukraine.

Ukraine at D+586: Seeking narrative control. (CyberWire) Ukrainian drones hit a missile factory in Smolensk and Russia shells homes and markets around Kherson. Ukraine prepares for cyberattacks on its power grid, and the US prepares for influence operations directed at the 2024 elections.

Russia-Ukraine war: List of key events, day 587 (Al Jazeera) As the war enters its 587th day, these are the main developments.

Russia-Ukraine war at a glance: what we know on day 587 of the invasion (the Guardian) EU promises another €5bn in military aid to Ukraine at surprise meeting in Kyiv; White House says it is in touch with allies about continued funding for Ukraine

Ukraine intel directorate confirms drone attack on Russian missile-producing factory (Al Arabiya) Ukrainian attack drones struck a Russian aircraft factory where Kh-59 missiles were produced, Ukraine’s Main Intelligence Directorate (GUR) confirmed on Monday.

EU foreign ministers convene in Kyiv in ‘historic’ show of support (the Guardian) Josep Borrell condemns Russia’s war as he says meeting is taking place ‘within the future borders of the EU’

Ukraine’s defense intel reveals details of Russian turncoat soldier operation (Ukrinform) The GUR defense intelligence thoroughly vetted Russian Lieutenant Danil Alfyorov before concluding it was possible to approach him. — Ukrinform.

Yevgeny Prigozhin’s son ‘takes over command of Wagner’ (The Telegraph) Military analysts believe the 25-year-old is the new leader of the mercenary group that was founded by his father

Rightsizing the Russia Threat (Foreign Affairs) Whatever Putin’s intentions are, he is hemmed in by limited capabilities.

Russians Unofficially Honor Wagner Mercenary Leader Prigozhin On 40th Day After His Death (RadioFreeEurope/RadioLiberty) Russians have commemorated the founder and leader of Wagner mercenary group Yevgeny Prigozhin on the 40th day since his death, a Russian Orthodox tradition to honor those who have passed away.

Ukrainian Lawmakers, Elon Musk Trade Barbs On Social Media (RadioFreeEurope/RadioLiberty) A simmering feud between Elon Musk and Ukraine neared a boil after the tech billionaire mocked Ukrainian President Volodymyr Zelenskiy's continued pleas for wartime aid from the West, triggering Kyiv to respond with accusations Musk had become a tool of Moscow by spreading its "propaganda."

Putin’s Pals Brag: Elon Musk ‘Really Is Our Agent!’ (The Daily Beast) Kremlin propagandists are rejoicing after Congress omitted aid to Ukraine from its most recent government funding bill.

Ukraine prepares for winter again as Russia targets its power grid (The Economist) Things may be tougher this time

Putin’s Next Target: U.S. Support for Ukraine, Officials Say (New York Times) Russian spy agencies and new technologies could be used to push conspiracy theories, U.S. officials say.

Interfax-Ukraine agency's website undergoes cyberattack (Interfax-Ukraine) On Sunday, October 1, the website of the Interfax-Ukraine News Agency underwent a cyberattack.

UK Royal Family Website Hit by DDoS Attack from KillNet (Hackread) The DDoS attack took place around 10 a.m. local time.

KillNet Claims DDoS Attack Against Royal Family Website (Dark Reading) The royal takedown was a brief but effective PR stunt for Russia's most notorious hacktivist group.

Royal family’s website suffers Russia-linked cyberattack (CSO Online) Pro-Russian hacker group KillNet took responsibility for the attack days after King Charles condemned the invasion of Ukraine.

Why the Royal Family website was the target of a cyber attack (Tatler) Russian hackers have claimed responsibility

Attacks, Threats, and Vulnerabilities

Mass exploitation attempts against WS_FTP have begun (Register) Early signs emerge after Progress Software said there were no active attempts last week

Cisco warns of attempted exploitation of zero-day in VPN software (Record) The bug, first published Sept. 27, affects the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software.

Bitsight identifies nearly 100,000 exposed industrial control systems (Bitsight) Bitsight has identified nearly 100,000 exposed industrial control systems (ICS) potentially allowing an attacker to access and control physical infrastructure.

Number of Internet-Exposed ICS Drops Below 100,000: Report (SecurityWeek) The number of internet-exposed ICS has dropped below 100,000, a significant decrease from the 140,000 in 2019.

Malicious Packages Hidden in NPM (Fortinet Blog) FortiGuard Labs investigates several malicious packages hidden in NPM and provides an overview of these packages, grouping them on similar styles of code or functions. Learn more.…

Seaports in India were left vulnerable to takeover by hackers (Cybernews) The National Logistics Portal (NLP), a newly launched platform to manage all port operations in India, left public access to sensitive data, posing the risk of a potential takeover by threat actors.

Live Exploitation Underscores Urgency to Patch Critical WS-FTP Server Flaw (SecurityWeek) Rapid7 says attackers are targeting a critical pre-authentication flaw in Progress Software’s WS_FTP server just days after disclosure.

Cyberattacks hit military, Parliament websites as India hacker group targets Canada (CTVNews) The federal government is coping with cyberattacks this week, as a hacker group in India claims it has sowed chaos in Ottawa, but Canada's signals-intelligence agency says the 'nuisance' attacks likely haven't put private information at risk.

How "Antiquated Infrastructure" Undermines Crypto Security (BeInCrypto) Explore the cybersecurity challenges in the crypto market, where outdated infrastructures and human errors threaten assets and data.

ShadowSyndicate Cybercrime gang has used 7 ransomware families over the past year (CSO Online) Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations

Protecting against FraudGPT, ChatGPT's evil twin (Help Net Security) In this video, Mike Newman discusses the risks that FraudGPT poses and the techniques criminals use to target organizations.

APIs: Unveiling the Silent Killer of Cyber Security Risk Across Industries (The Hacker News) APIs are under attack! Explore the top API security concerns and why healthcare and manufacturing sectors are targeted

CYFIRMA RESEARCH - CHIT-CHAT WITH A RANSOMWARE OPERATOR - CYFIRMA (CYFIRMA) INTRODUCTION Recently, CYFIRMA Research published a report on a new threat actor group known as FusionCore. In a follow-up, we...

Hackers steal user database from European telecommunications standards body (Record) The European Telecommunications Standards Institute (ETSI) said it brought in French authorities to investigate. ETSI has more than 900 member organizations from over 60 countries.

Furry hackers claim to have breached NATO, stolen 3,000 files (The Daily Dot) The hacking group SiegedSec says it leaked what are claimed to be more than 3,000 files from the North American Treaty Organization (NATO).

"Phantom Hacker" Scams Target Senior Citizens and Result in Victims Losing their Life Savings (FBI) The FBI is warning the public of a recent nationwide increase in "Phantom Hacker" scams, significantly impacting senior citizens.

FBI warns of surge in 'phantom hacker' scams impacting elderly (BleepingComputer) The FBI issued a public service announcement warning of a significant increase in 'phantom hacker' scams targeting senior citizens across the United States.

New BunnyLoader threat emerges as a feature-rich malware-as-a-service (BleepingComputer) Security researchers discovered a new malware-as-a-service (MaaS) named 'BunnyLoader' advertised on multiple hacker forums as a fileless loader that can steal and replace the contents of the system clipboard.

Phishing via Dropbox (Check Point Blog) A burgeoning attack involving Dropbox is making the rounds. In the first two weeks of September, we saw 5,440 of these attacks. Hackers are using Dropbox

Feds hopelessly behind the times on ransomware trends (Register) Better late than never, we guess

South African insurance clients hit in massive global cyberattack (MyBroadband) Aon South Africa has warned customers that the Cl0P ransomware gang likely compromised their personal information during a mass-exploitation campaign earlier this year.

Motel One Newsroom (Motel One Press) The Motel One Group has become the target of a hacker attack.

Motel One discloses data breach following ransomware attack (BleepingComputer) The Motel One Group has announced that it has been targeted by ransomware actors who managed to steal some customer data, including the details of 150 credit cards.

CISA Adds One Known Exploited Vulnerability to Catalog | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-5217 Google Chrome libvpx Heap Buffer Overflow Vulnerability

Vulnerability Summary for the Week of September 25, 2023 | CISA (Cybersecurity and Infrastructure Security Agency CISA) High Vulnerabilities Primary Vendor -- Product Description Published

Security Patches, Mitigations, and Software Updates

Progress, the company behind MOVEit, patches new actively exploited security flaws | TechCrunch (TechCrunch) Security researchers say thousands of WS_FTP servers are vulnerable and hackers are already taking advantage.

Trends

New Study by CR, Aspen Digital, and GCA Reveals Consumer Attitudes Towards Cybersecurity and Online Privacy (GCA | Global Cyber Alliance) Consumer Reports, Aspen Digital, and GCA released the 2nd Consumer Cyber Readiness report, marking the start of Cybersecurity Awareness Month.

Marketplace

Is Your AI Model Going Off the Rails? There May Be an Insurance Policy for That (Wall Street Journal) The many ways a generative artificial intelligence project can go off the rails poses an opportunity for insurance companies, even as those grim scenarios keep business technology executives up at night.

Tenable Completes Acquisition of Ermetic (Tenable®) Tenable® Holdings, Inc., the Exposure Management company, today announced it has closed its acquisition of Ermetic, Ltd. (“Ermetic”), an innovative cloud-native application protection platform (CNAPP) company, and a leading provider of cloud infrastructure entitlement management (CIEM). The acquisition combines two cybersecurity innovators and marks an important milestone in Tenable’s mission to shift organizations to proactive security.

Cohesity Forms Industry’s Largest Alliance of DSPM Vendors To Reduce Customer Risks of Cloud Transformation and Data Democratization (Cohesity) Six Data Security Posture Management Partners Join Cohesity’s Data Security Alliance, Representing the Vast Majority of Solutions in the Industry that Identify and Locate Previously Unknown Data Repositories and Mitigate Associated Security and Privacy Risks

MEF Launches Enterprise Leadership Council with Esteemed Corporate Leaders (GlobeNewswire News Room) MEF formed a council of senior executives from all major enterprise vertical markets to bring important end user perspective and involvement to MEF....

Frontegg Appoints Enterprise Sales Leader Dane Mustola as Head of Global Sales (GlobeNewswire News Room) Okta, Auth0 and Workday Veteran Will Oversee the Company’s Global Sales Team and Drive Frontegg’s Next Era of Growth...

Products, Services, and Solutions

Visa Enters Strategic Partnership with Expel to Help Clients Manage Cybersecurity Risk (Business Wire) Expel brings Managed Detection and Response (MDR) capabilities, which Visa uses to augment its own security team, to Visa’s Value-Added Services portfolio, helping to protect global clients from emerging cyberthreats

NINJIO gives companies free access to next-gen training resources for National Cybersecurity Awareness Month (NINJIO) NINJIO is making its SENSE Training Pack free to the public through the end of October.

LogRhythm Unveils Major Advancements to Cloud-Native SIEM Platform, LogRhythm Axon (LogRhythm) New platform automations and optimizations empower SOC team to more efficiently mitigate threats and reduce the skills gap LogRhythm, the company helping security teams stop breaches by turning disconnected data and signals into trustworthy insights, today announced its 6th consecutive…

Cerby and Okta partnership announcement (Cerby) Cerby partners with Okta to secure nonstandard applications, expanding the reach of modern identity-powered security.

McAfee's AI technology strengthens privacy and identity protections for users (Help Net Security) McAfee’s AI technology addresses the rise in AI-generated phishing scams by detecting suspicious URLs in texts before they’re opened.

AWS stirs the MadPot – busting bot baddies and eastern espionage (Register) Security exec Mark Ryland spills the tea on hush-hush threat intel tool

Quanergy Integrates Q-Track into Milestone Systems’ XProtect® VMS (GlobeNewswire News Room) Quanergy Integrates Q-Track into Milestone Systems’ XProtect® VMS...

Akamai Client-Side Protection & Compliance Introduces New Capabilities to Help Organizations Comply with PCI DSS v4.0 (Akamai) New capabilities simplify PCI DSS v4.0 compliance and help achieve the latest JavaScript security requirements: 6.4.3 and 11.6.1.

Virtru Releases Data Security Integration for Zendesk (GlobeNewswire News Room) Virtru Secure Share now offers a direct integration with Zendesk, which protects data flowing in and out of Zendesk without disrupting usability....

ThreatQuotient Bridges Artificial Intelligence with Threat Intelligence in the SOC (Business Wire) Security operations teams work smarter, not harder, with the latest enhancements to the ThreatQ Platform including ThreatQ TDR Orchestrator and a data-driven approach to automation

Say (an encrypted) hello to a more private internet. (The Mozilla Blog) As web users, what we say and do online is subject to pervasive surveillance. Although we typically associate online tracking with ad networks and other th

Concentric AI Introduces Industry’s First Data Lineage Functionality in a Data Security Posture Management Solution for Improved Data Protection and Management (Business Wire) Organizations Can Now Make Better Business Decisions to Secure their Data by Understanding Data’s Entire Journey and How it is Sourced, Processed, Modified, Entitled and Consumed

Technologies, Techniques, and Standards

DISARMing cyber threats with ATT&CK: A winning combination (C4ISRNet) As this framework gains recognition, it holds the potential to evolve into a universal language for identifying and countering influence, the authors say.

Sauce Labs Survey Reveals: Majority of Developers Are Pushing Code to Production Without Testing, Circumventing Security Protocols, Relying on ChatGPT (GlobeNewswire News Room) Sauce Labs surveyed 500 developers to quantify how pervasive bad behavior is; such as using ChatGPT, bypassing security and quality protocols for...

Sonatype’s 9th Annual State of the Software Supply Chain Report Reveals Ways to Improve Developer, DevSecOps Efficiency (Sonatype) Sonatype's new 9th Annual State of the Software Supply Chain Report highlights alarming open source software and software supply chain security trends.

About | SMICI Data Portal (SMICI Data Portal) Welcome to the Significant Multi-domain Incidents against Critical Infrastructure (SMICI) Data Portal

What Cyber Response Can Learn from Traditional Disasters (GovTech) Government has battle-tested playbooks for dealing with hurricanes, tornadoes and wildfires. As cyber emergencies become both more common and more devastating, what can cyber reponders learn from physical emergency response?

Linux distros need to take more responsibility for security (InfoWorld) Between the rapid release of open source software, and modern OSes preloaded with packages, enterprises are vulnerable to attacks they aren’t even aware of.

Why every company should include threat intelligence in their cybersecurity strategy (BetaNews) In the fast-evolving digital landscape, the prevalence of cyber threats has become a stark reality for businesses and individuals. While essential, conventional cybersecurity measures are often reactive and inadequate against sophisticated attacks. This is where Cyber Threat Intelligence (CTI) emerges as a proactive and complementary approach to cybersecurity.

16 Leading Technology and Service Providers Launch Industry's First SASE Product and Services Certification (GlobeNewswire News Room) MEF launched beta certification program of SASE products and services with Cisco, Fortinet, Juniper Networks, Palo Alto Networks, Versa Networks, VMware....

Design and Innovation

Levan Center of Innovation and iQ4 Corporation Unite to Bridge Florida's Cyber Talent Gap (NewsBreak Original) In a significant move to address the surging demand for cybersecurity professionals, theAlan B. Levan | NSU Broward Center of Innovation (Levan Center of Innovation) has announced a strategic partnership with iQ4 Corporation and its Cybersecurity Workforce Alliance (CWA) division. This collaboration aims to align with the Biden-Harris National Cybersecurity Workforce and Education Strategy to catalyze the development of America's next-generation cybersecurity talent. Florida, in particular, faces a pressing need, with 34,377 open cybersecurity positions as of September 2023, according to Cyberseek.org.

CIOs Feel Heat From CEOs on Generative AI (Wall Street Journal) The rise of generative AI within companies often starts at the top with chief executives, making it different from other business tech booms typically led by technologists.

Why Big Tech’s bet on AI assistants is so risky (MIT Technology Review) Tech companies have not solved some of the persistent problems with AI language models.

Legislation, Policy, and Regulation

New SEC Cyber Rules to Push Publics and Their Third Parties to Strengthen Programs (PR Newswire) Following the Securities and Exchange Commission's (SEC) adoption of new rules for cybersecurity risk management, strategy, governance, and...

New cyber rules aim to standardize requirements for federal contractors (Nextgov.com) The proposed rules would create new information sharing and incident reporting requirements.

Senators push for USPS identity proofing to thwart AI-generated deepfakes (Nextgov.com) The U.S. Postal Service already offers identity proofing services for some government agencies.

Citizen Cyber Brigades Held Promise — Have They Delivered? (GovTech) Amid struggles to fill open cybersecurity positions, some states have looked toward volunteer citizen brigades trained to respond when smaller jurisdictions need help. Experts consider whether the benefits outweigh the risks.

National Security Agency to create an artificial intelligence center (C4ISRNet) China has in recent months stepped up cyber operations focused on U.S. and allied institutions that may include pre-positioning malware.

Don’t Say ‘Skynet’ — NSA’s AI Security Center is New Hub for Agency Efforts (Security Boulevard) COME WITH ME IF YOU WANT TO LIVE: Nothing suspicious to see here—move along.

What do US Spies Do? Don’t Ask America’s Espionage Chiefs (Bloomberg) Spy chiefs miss deadline to define intelligence terms. Civil liberties rest on spying terms’ definitions, Wyden says.

Litigation, Investigation, and Law Enforcement

Watchdog says pipeline security regulations, data collection safeguards not up to snuff at DHS (Washington Post) Pipeline security regulations, device data collection safeguards not up to snuff at DHS, watchdog says

Better TSA Tracking and Follow-up for the 2021 Security Directives Implementation Should Strengthen Pipeline Cybersecurity (REDACTED) (Office of Inspector General, Department of Homeland Security) The Transportation Security Administration’s (TSA) fiscal year 2021 pipeline security directives, if implemented, should strengthen pipeline operators’ posture against cyber threats.

CBP, ICE, and Secret Service Did Not Adhere to Privacy Policies or Develop Sufficient Policies Before Procuring and Using Commercial Telemetry Data (REDACTED) (Office of Inspector General, Department of Homeland Security) U.S. Customs and Border Protection (CBP), U.S. Immigration and Customs Enforcement (ICE), and the United States Secret Service (Secret Service) did not adhere to Department privacy policies or develop sufficient policies before procuring and using commercial telemetry data (CTD).

DHS Investigating Extent of Johnson Controls Security Breach - Campus Safety Magazine (Campus Safety Magazine) CNN reports Homeland Security is investigating if attack on Johnson Controls compromised sensitive physical security information.

Sam Bankman-Fried must now convince a jury that the former crypto king was not a crook (Quartz) For a while, Sam Bankman-Fried tried to convince politicians and the public that he was the next J

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Schellmancon 2023 (Virtual, Nov 3, 2023) This event is intended for our clients, compliance experts, and all with a passion for cybersecurity to share relevant and impactful information in the cybersecurity and compliance space. And it is completely free, including the CPE! Prepare to unite with the foremost thought leaders in the world of compliance, where we discuss the emerging trends in compliance, cybersecurity, threat management, artificial intelligence and more. Industry expert panelists will explore best practice approaches to cybersecurity assessments, and share their winning strategies through networking and knowledge cafes. Participants are automatically enrolled for complimentary training and other prizes. Extend your invitations to your teams and partake in an action-packed, day-long agenda that promises to be truly enriching.

SANS San Diego Fall 2023 (San Diego and Virtual, California, USA, Nov 6 - 11, 2023) Hands-on cyber security training taught by world-renowned practitioners. Attend in San Diego, CA or live online. At SANS San Diego Fall 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Stay Sharp November 2023 (Virtual, Nov 13 - 15, 2023) Hands-on cyber security training taught by world-renowned practitioners. Attend live online. At SANS Stay Sharp November 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Austin Fall 2023 (Austin, Texas, USA, Nov 27 - Dec 2, 2023) At SANS Austin Fall 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Phoenix-Tempe 2023 (Phoenix, Arizona, USA, Dec 4 - 9, 2023) At SANS Phoenix-Tempe 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Cyber Defense Initiative Washington DC 2023 (Washington, DC, USA, Dec 11 - 16, 2023) At SANS Cyber Defense Initiative Washington DC 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Cloud Defender 2024 (Virtual, Jan 8 - 13, 2024) At SANS Cloud Defender 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Classic 2024 (Virtual, Jan 15 - 20, 2024) At SANS Classic 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Cyber Security Mountain: January 2024 (Virtual, Jan 22 - 27, 2024) At SANS Cyber Security Mountain: January 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Tysons Corner – NOVA 2024 (Tysons Corner, Virginia, USA, Feb 5 - 10, 2024) At SANS Tysons Corner-NOVA 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Events

Innovate Cybersecurity Summit (Scottsdale, Arizona, USA, Oct 1 - 3, 2023) Innovate Cybersecurity Summit is a highly anticipated summit that brings together Cybersecurity Executives and CISOs from all corners of the country to the tranquil Arizona desert, assembling a national community of professionals for three days of exclusive, invite-only discussion and learning. Attendees can expect a world-class experience with access to insightful CISO panels and education sessions that explore best practices and real-world challenges, unparalleled networking opportunities, and unique engagement with the industry’s latest cybersecurity technology solutions and vendors. A must-attend event for CISOs and leading Cybersecurity Practitioners looking to stay ahead of the game!

2023 RH-ISAC Cyber Intelligence Summit (Dallas, Texas, USA, Oct 2 - 4, 2023) The RH-ISAC is proud to bring you the 2023 RH-ISAC Cyber Intelligence Summit this October 2-4, 2023. This will be our second year at the Hilton Dallas/Plano Granite Park in Plano, Texas. Join us for a Welcome Reception on October 2, followed by a two-day conference on October 3-4 that brings together top cybersecurity leaders and teams representing the most prominent organizations in retailers, restaurants, hotels, gaming casinos, food retailers, consumer products, and other consumer-facing companies. Called the “Crown jewel of RH-ISAC offerings,” the annual event brings together members from the strategic, operational, and tactical levels to participate in interactive, practitioner-led case studies showcasing what works – and sometimes what does not work – in addressing the threats and challenges of the retail and hospitality industries. The RH-ISAC Summit features an RH-ISAC member-driven agenda including sessions delivered by prominent thought leaders, and experts from the provider community. This event inlcludes collaborative workshops, cybersecurity exercises, and exceptional networking opportunities. This is the “can’t miss” event for cybersecurity professionals from the retail and hospitality industries. We look forward to seeing you in October 2023.

RH-ISAC Cyber Intelligence Summit (Dallas, Texas, USA, Oct 2 - 4, 2023) The Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) has announced the agenda for the upcoming RH-ISAC Cyber Intelligence Summit. The conference, scheduled to take place on October 2-4 in Dallas, Texas, brings together industry leaders, cybersecurity practitioners, and thought influencers for a three-day event that explores the latest trends, challenges, and solutions in the ever-evolving landscape of cyber intelligence. The member-driven agenda features a diverse array of sessions, workshops, and presentations designed to empower participants with actionable insights to safeguard their organizations against modern cyber threats.

Uniting Women in Cyber 2023 (Arlington, Virginia, USA, Oct 3, 2023) Uniting Women in Cyber (UWIC) 2023 convenes a powerful and diverse network of cyber leaders and experts to discuss emerging trends and actionable strategies. Join discussions and highly interactive breakout sessions about emerging global trends and technologies, as well as the importance of cybersecurity for the sustainable success of nations, organizations, and communities.

Secureworks Global Threat Intelligence Summit 2023 (Virtual, Oct 4, 2023) Join us as we discuss emerging threats and provide the latest insight into how to combat today’s adversaries. Plus, get exclusive access to Secureworks 2023 State of the Threat Annual Report.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.