Cybersecurity strategies and new sets of best practices. Cyberespionage updates.

Announcement

Cybersecurity and IT practice tests - now just $39 each.

Make 2024 the year you earn a new professional certification. For a limited time, N2K is offering our full catalog of certification practice tests for just $39 each. Choose from our extensive library of certification titles from leading vendors like AWS, CompTIA, Microsoft, CISCO, and more. Visit n2k.com/certify to view our practice test catalog and get started today.

Quarterly Industry Insights Analyst Call - open to the public.

Join us for our quarterly Industry Insights Analyst Call on Tuesday, December 19th, 2023 at 2:00 PM EST. During this live and interactive event, Rick Howard and a panel of security experts will breakdown the most impactful news and events from the last 90 days, and dive into why it matters to organizations and our industry. Register now.

Summary

By the CyberWire staff

At a glance.

US DHS releases healthcare cybersecurity strategy.
Former HHS officials speak out about 2020 incident.
The GRU expects Swifties to take their marching orders from Aquarium bots.
UK calls out an FSB influence campaign.
Privilege-escalation and denial-of-service vulnerabilities outlined.
Supply chain threats.
Retail bot activity in the shopping season.
Memory-safe coding practices.

US DHS releases healthcare cybersecurity strategy.

The US Department of Health and Human Services (HHS) has released Healthcare Sector Cybersecurity: Introduction to the Strategy of the U.S. Department of Health and Human Services. Intended as the Department's plan for implementing the President's cybersecurity strategy, the document reviews a range of existing initiatives and then outlines the next steps HHS intends to take toward improving the sector's security. Noting growing risk and a rising rate of cyberattacks against healthcare targets, the strategy explains, "Healthcare facilities are attractive targets for cyber criminals in light of their size, technological dependence, sensitive data, and unique vulnerability to disruptions."

The way forward, HHS says, will proceed in four steps:

"Establish voluntary cybersecurity performance goals for the healthcare sector"
"Provide resources to incentivize and implement these cybersecurity practices"
"Implement an HHS-wide strategy to support greater enforcement and accountability" and
"Expand and mature the one-stop shop within HHS for healthcare sector cybersecurity".

The American Hospital Association (AHA) welcomed the HHS commitment to improving cybersecurity, but with reservations. The AHA points out that many of the threats its members face work either directly on behalf of nation-states, or at least with the tacit permission of such hostile states, and these threats require a whole-of-government commitment. The Association also cautioned against a too prescriptive, too punitive approach to mandatory regulation. Many of its members' most serious vulnerabilities, the AHA says, lie in third-party systems beyond the healthcare sector's control.

Former HHS officials speak out about 2020 incident.

Coincidentally, former HHS officials, former Chief Information Officer Jose Arrieta and former Chief Information Security Officer Janet Vogel, this week described a cyberattack that hit HHS networks on March 15th, 2020, at the outset of the COVID pandemic. Bloomberg Businessweek describes one incident, believed to be state-sponsored, in which HHS systems were taken down by an unusually large distributed denial-of-service (DDoS) attack. Retrospectively the attack seems to have represented misdirection for an attempt to penetrate US networks involved in coordinating public response to that pandemic. “It was clear that our network had been mapped and that there was an understanding of different areas within our network,” Arrieta told Businessweek. “They understood where large data repositories were, and they were actively seeking to gain some type of information from those environments.” Many intelligence services worldwide sought to collect against vulnerable networks during the pandemic. In this case, Arrieta and Vogel think the likeliest suspect is China.

Real time cloud security powered by runtime insights. Secure every second.

In the cloud, every second counts. Attacks move at warp speed; security teams must protect the business without slowing it down. Sysdig stops cloud attacks in real time, instantly detecting changes in risk with runtime insights and open source Falco. We correlate signals across cloud workloads, identities, and services to uncover hidden attack paths and prioritize real risk. From prevention to defense, Sysdig helps enterprises focus on what matters: innovation. Visit our website to learn more.

The GRU expects Swifties to take their marching orders from Aquarium bots.

WIRED reports that Russia's military intelligence service, the GRU, is using the images of celebrities juxtaposed with fake quotations denouncing Ukraine in an attempt to sway public opinion, mostly in Europe, against support for Ukraine's defensive war. The tenor of the messages in this crude influence campaign portrays Ukraine as, first, at fault for the war, and second, as wasting the aid it's received from the West. The celebrities whose images are being misappropriated include Taylor Swift, Selena Gomez, Kim Kardashian, Beyoncé, Oprah, Gigi Hadid, Lady Gaga, Jennifer Lopez, Justin Bieber, Shakira, Gwyneth Paltrow, and Cristiano Ronaldo.

The disinformation is being spread over coordinated networks of inauthentic Facebook accounts as part of the GRU's Doppelgänger campaign. The messaging may be primitive, but there's considerable sophistication involved in spreading it. Doppelgänger automates creation of Facebook accounts and exploits loopholes in the platform's ad moderation to disseminate its bogus influencer posts. The not-for-profit disinformation research group Reset told WIRED the campaign “exploits loopholes in Facebook’s ad verification and content moderation systems to foster hostility against Ukrainians and undermine EU support for Kyiv.”

UK calls out an FSB influence campaign.

The British Government has summoned the Russian ambassador for an explanation of the "Cold River" campaign, a sustained effort by Russia's FSB security service to influence elections in the UK. Reuters quotes junior foreign minister Leo Docherty's statement to Parliament: "I can confirm today that the Russian Federal Security Services, the FSB, is behind a sustained effort to interfere in our democratic processes." Cold River, also tracked by researchers as "Callisto," "Iron Frontier," and "Star Blizzard," is associated with the FSB's "Centre 18." Richard Dearlove, former head of Britain's Secret Intelligence Service, MI6, told Reuters, "Because of the UK’s support for Ukraine we are in a state of ‘grey warfare’ with Russia; and the Russians will use every means at their disposal to attack British interests short of open conflict." ComputerWeekly describes the campaign's goal as being "to selectively leak information obtained through cyber espionage and amplify its release in line with Russia’s geopolitical goals, or to undermine trust in UK politics."

The UK's National Cyber Security Centre (NCSC) issued a report on the campaign. Unlike its GRU sister service's Doppelgänger, which is an exercise in automated mass-marketing, the FSB's operators make heavy use of highly tailored spearphishing. They're also given to careful preparation of their targeting. "Using open-source resources to conduct reconnaissance, including social media and professional networking platforms, Star Blizzard [the NCSC's preferred name for the FSB's Cold River operators] identifies hooks to engage their target. They take the time to research their interests and identify their real-world social or professional contacts," the NCSC writes. "Star Blizzard creates email accounts impersonating known contacts of their targets to help appear legitimate. They also create fake social media or networking profiles that impersonate respected experts and have used supposed conference or event invitations as lures."

The NCSC has also updated its guidance on resisting election interference.

GRU continues exploitation of Outlook vulnerability.

Palo Alto Network's Unit 42 this morning published research into the ongoing GRU exploitation of the Outlook vulnerability, CVE-2023-23397, against espionage targets in the West. "Unit 42 researchers have observed this group using CVE-2023-23397 over the past 20 months to target at least 30 organizations within 14 nations that are of likely strategic intelligence value to the Russian government and its military."

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Microsoft Federal: Mission innovation, secure by design

Cybersecurity is a national security priority. That’s why Microsoft is setting the standard with security built-in. And our 8,000 threat hunters analyze 65 trillion+ signals daily, partnering with federal agencies to protect their digital estate. We help strengthen cybersecurity at scale—from identity, data, and apps to endpoints, infrastructure, and networks—so you can focus on what matters: your mission. Visit aka.ms/FedCyber today to get started.

Supply chain threats.

BlueVoyant has published its annual State of Supply Chain Defense report, finding that 85% of respondents said their budget for third-party cyber risk has increased over the past twelve months, “with 51% indicating they’ll allocate additional internal resources and 46% likely to add external resources.” Additionally, “47% of respondents monitored their supply chain for cyber risk monthly or more in 2023, compared to 41% in 2022.” 44% of employees responsible for supply chain and cyber risk management said they brief senior management teams monthly or more in 2023, compared to 38% in 2022.

Retail bot activity in the shopping season.

Kasada’s 2023 Holiday Bot Activity Report describes a 198% increase in bot traffic this year compared to 2022. Bot traffic peaked the day before Thanksgiving, which Kasada believes is due to “pre-holiday sales that bots are privy to before real shoppers.” Overall bot traffic was higher in October than in November, however, which the researchers say suggests that “early bird holiday sales were popular for retailers, humans, and adversaries alike.” Additionally, login fraud attempts spiked by 251% on November 25th (Cyber Monday) and the following day.

Build an Effective Endpoint Detection and Response Strategy

Are you ready to simplify your endpoint security? Join the live virtual event to discover how you can safeguard your AWS environment with tools available in AWS Marketplace. Register now.

Memory-safe coding practices.

The US Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and the cybersecurity authorities of Australia, Canada, the United Kingdom, and New Zealand have released a joint guide for memory-safe coding practices.

CISA explains, “The guide strongly encourages executives of software manufacturers to prioritize using memory safe programing languages, write and publish memory safe roadmaps and implement changes to eliminate this class of vulnerability and protect their customers. Software developers and support staff should develop the roadmap, which should detail how the manufacturer will modify their software development life cycle (SDLC) to dramatically reduce and eventually eliminate memory unsafe code in their products. This guidance also provides a clear outline of elements that a memory safe roadmap should include.”

Notes.

Today's issue includes events affecting Australia, Canada, China, the European Union, Gaza, India, Iran, Israel, New Zealand, Russia, Saudi Arabia, Ukraine, the United Arab Emirates, the United Kingdom, and the United States.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+651: Disinformation and collection, wholesale and retail. (CyberWire) Russian intelligence and security services are running at least two large-scale influence and cyberespionage campaigns against Western targets, one a mass-marketed coordinated inauthenticity effort, the other a closely targeted spearphishing operation.

Israel-Hamas war latest news: Israeli forces pictured setting seawater pumps to flood Hamas tunnels (The Telegraph) Israeli troops have been pictured setting up pumps to flood Hamas tunnels with water.

Battle Lines: As the ceasefire ends we reflect on the hostage releases - and those left behind (The Telegraph) Join the Telegraph's top journalists as they analyse the conflict in Israel and Gaza from all angles and tell you what you need to know

Israel is pushing into southern Gaza as the clock ticks down (The Economist) The fighting in Khan Younis is the most intense yet

What Is Hamas Hiding? (Puck) The West Wing conversations surrounding the ceasefire collapse, and the horrifying theories about what is happening to female Israeli hostages in Gaza.

The Israeli-Palestinian Conflict and the Psychology of Trauma (Foreign Affairs) How insights from therapeutic practice can help build peace.

Grant program aims to overthrow Iran's Islamic Republic with crypto (Blockworks) “Iran Unchained” is built for sending crypto to anti-government activists in Iran where compliance laws make donations difficult.

Putin greeted with fanfare in UAE despite international arrest warrant (The Telegraph) Russian president to meet Middle Eastern leaders on rare visit outside of former Soviet Union

Putin moves a step closer to a fifth term as president after Russia sets 2024 election date (AP News) Putin hasn’t yet announced his intention to run again, but he is widely expected to do so in the coming days.

Russia is gearing up for a long war. Will the West follow suit? (Defense News) The country has demonstrated a remarkable degree of adaptability to Western sanctions.

How responsible is the average Russian for Putin’s war? (The Hill) When three-quarters or more of a population endorse war and genocide, we are in a realm that goes beyond public opinion surveys and involves culture.

'Liquidated': Two 'Traitors Of Ukraine' Killed In Separate Incidents (RadioFreeEurope/RadioLiberty) Two Ukrainians who collaborated with Russian authorities have been killed -- one in a shooting in a village southwest of Moscow and the other in a car bombing in the Russian-occupied part of Ukraine's Luhansk region.

Fighting Ursa Aka APT28: Illuminating a Covert Campaign (Unit 42) In three campaigns over the past 20 months, Russian APT Fighting Ursa has targeted over 30 organizations of likely strategic intelligence value using CVE-2023-23397.

Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397) (Help Net Security) APT28 has been using a known Microsoft Outlook vulnerability (CVE-2023-23397) to target public and private entities in Poland.

How Ukraine's tech experts joined forces with the government despite differences (Ideastream Public Media) Across Ukraine, tech experts are at the forefront of the defense against Russia, from drones to cybersecurity. But it's after the war that their innovation might help bolster Ukraine's future.

Fake Taylor Swift Quotes Are Being Used to Spread Anti-Ukraine Propaganda (WIRED) A disinformation campaign led by a group linked to Russia's GRU is using images of celebrities like Taylor Swift, Beyoncé, Kim Kardashian, Justin Bieber, and Oprah to lambast Ukraine.

Britain summons Russian ambassador over years-long FSB cyberespionage campaign (Reuters) The British government has summoned the Russian ambassador and sanctioned two people for what it said was a sustained but failed attempt to interfere in politics by Russian cyber spies.

Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns (NCSC) The Russia-based actor is targeting organisations and individuals in the UK and other geographical areas of interest.

Austin Meets With Ukrainian Minister of Defense at Pentagon (U.S. Department of Defense) Secretary of Defense Lloyd J. Austin III hosted Ukrainian Defense Minister Rustem Umerov at the Pentagon to discuss Ukraine's strategic goals for the coming year and a long-term vision for a future

Biden Administration Announces New Security Assistance for Ukraine (U.S. Department of Defense) The DOD announced new security assistance to meet Ukraine's critical security and defense needs.

Fact Sheet on U.S. Security Assistance to Ukraine (US Department of Defense) The United States has committed more than $44.8 billion in security assistance to Ukraine since the beginning of the Biden Administration, including $44.2 billion since the beginning of Russia’s unprovoked and brutal invasion on February 24, 2022.

US to announce fresh weapons aid for Ukraine as Congress is stalled (Federal Times) The latest weapons package will be provided through presidential drawdown authority, or PDA, which pulls weapons from existing U.S. stockpiles.

Biden open to ‘significant’ concessions on border security in return for Ukraine aid (The Telegraph) US president appeals for support as Senate blocks emergency aid package including $60bn for Kyiv

What would happen if Congress stopped supporting allies under siege? (Defense News) Lawmakers are ignoring the trillion-dollar impact their actions might have — actions that may reverberate over the next 20 years and beyond.

Senate Republicans block funding bill that included aid for Ukraine and Israel (the Guardian) Congress unlikely to approve more funding for Ukraine before end of year after GOP demanded stricter border regulations

Putin is close to victory. Europe should be terrified (The Telegraph) Ukraine’s time is running out. The danger is that the EU faces the same fate as the Holy Roman Empire

Ukraine man charged with Starlink fraud (Cybernews) A Ukrainian has been arrested on suspicion of faking the sale of Starlink technology to a military volunteer, conning them out of nearly 2 million hryvnias (about $50,000).

Attacks, Threats, and Vulnerabilities

Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates (Akamai) Akamai researchers discovered a new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers.

Researchers discover dozens of new bugs affecting Sierra Wireless routers (Record) The company’s AirLink cellular routers are often used in critical infrastructure sectors, such as government and emergency services.

These malicious Android loan apps could leave millions of users seriously out of pocket (TechRadar) More than a dozen Android apps made it to the Play Store

Malicious SpyLoan apps gain traction on Android (SC Media) BleepingComputer reports that more than 12 million Android devices have collectively downloaded 18 malicious loan apps dubbed "SpyLoan," which could exfiltrate not only call logs, local Wi-Fi network information, and image metadata but also text messages, location information, and contact lists.

Qualcomm Releases Details on Chip Vulnerabilities Exploited in Targeted Attacks (The Hacker News) Qualcomm has disclosed details about three high-severity security vulnerabilities that were exploited in limited, targeted attacks in October 2023.

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack (Ars Technica) UEFIs booting Windows and Linux devices can be hacked by malicious logo images.

Millions of patient scans and health records spilling online thanks to decades-old protocol bug (TechCrunch) Thousands of servers are spilling the medical records of millions of patients. Researchers say many patient images are at risk of tampering.

Curse of the Krasue: New Linux Remote Access Trojan targets Thailand (Group-IB) This piece of malware has an insatiable appetite. Group-IB's Threat Intelligence unit offers their insights on the new RAT used in attacks against Thai companies.

Exploitation of Recent Cisco IOS XE Vulnerabilities Spikes (SecurityWeek) The Shadowserver Foundation warns of an increase in the number of devices hacked via recent Cisco IOS XE vulnerabilities.

Enterprise, Consumer Devices Exposed to Attacks via Malicious UEFI Logo Images (SecurityWeek) LogoFAIL is an UEFI image parser attack allowing hackers to compromise consumer and enterprise devices using malicious logo images.

Request smuggling and HTTP/2 downgrading: exploit walkthrough (Outpost24) Detailed overview and real-world exploit of request smuggling vulnerability from HTTP/2 downgrading.

Apple and some Linux distros are open to Bluetooth attack (Register) Issue has been around since at least 2012

Discovering MLflow Framework Zero-day Vulnerability | Machine Language Model Security (Contrast Security) Learn more about how Contrast discovered a MLflow framework zero-day security vulnerability that threatens to poison machine language models.

Generative AI, deepfakes will ‘pollute’ election campaigns, CSE warns (Daily Guardian) Descrease article font size Increase article font size Canada’s cybersecurity watchdog is warning fake images and videos created by artificial

Austal USA Investigates Cyberattack Claimed by Ransomware Group (Dark Reading) The company is conducting an investigation but claims that no personal or classified information was accessed by the threat actors.

Dangerous vulnerability in fleet management software seemingly ignored by vendor (CyberScoop) Researchers say Digital Communications Technologies has not addressed a bug impacting its Syrus4 IoT gateway, leaving open the possibility for vehicle fleets to be shut down.

Navy contractor Austal USA confirms cyberattack after data leak (BleepingComputer) Austal USA, a shipbuilding company and a contractor for the U.S. Department of Defense (DoD) and the Department of Homeland Security (DHS) confirmed that it suffered a cyberattack and is currently investigating the impact of the incident.

Important Update from Nissan Oceania (Nissan Australia) The Australian and New Zealand Nissan Corporation and Financial Services (“Nissan”) advises that its systems have been subject to a cyber incident. Nissan is working with its global incident response team and relevant stakeholders to investigate the extent of the incident and whether any personal information has been accessed. Nissan has also notified the Australian Cyber Security Centre and the New Zealand National Cyber Security Centre.

Nissan is investigating cyberattack and potential data breach (BleepingComputer) Japanese car maker Nissan is investigating a cyberattack that targeted its systems in Australia and New Zealand, which may have let hackers access personal information.

Nissan investigates cyberattack in Australia and New Zealand (Record) The automaker said that it is working with security researchers “to investigate the extent of the incident and whether any personal information has been accessed.”

Cyber attack on Toronto Public Library leaves patrons reeling over loss of ‘social service network’ (Toronto Star) The Toronto Public Library is “much, much more than a place where people just get books.”

Lower Bucks Hospital Patients Alerted To Vendor Data Breach (Levittown, PA Patch) The Bristol-based hospital is mailing patients whose personal information was involved in a third-party vendor incident.

Data breach by Addenbrooke's Hospital reveals patient information (BBC) Cambridge MP calls for a full review after Addenbrooke's Hospital apologises for two data breaches.

WVU notifies employees of ‘cybersecurity incident’ (WBOY) West Virginia University has notified some of its employees that have been affected by a recent “cybersecurity incident” that reportedly their included social security numbers and perso…

1.3 Million Maine Residents Affected by MOVEit Breach (Trend Micro News) Maine’s official state government website recently suffered a data breach, affecting 1.3 million residents.

Mercy Health uses third-party vendor hit by cyber attack (13ABC) A spokesperson for Mercy Health said it uses Perry Johnson & Associates (PJ&A) for its medical transcription services.

LockBit Remains Top Global Ransomware Threat (Infosecurity Magazine) The strain was responsible for over a quarter of global ransomware attacks between January 2022 and September 2023

2023 Holiday Bad Bot Report (Kasada) The 2023 Holiday Bad Bot Report compiles online traic and data from September to November to demonstrate how automated threats, bot attacks, and online fraud impacted eCommerce and holiday sales.

Security Patches, Mitigations, and Software Updates

Meta begins rolling out end-to-end encryption across Messenger and Facebook (the Guardian) Under the changes, Meta will no longer have access to the contents of what users send or receive, unless a user reports a message

Atlassian Releases Critical Software Fixes to Prevent Remote Code Execution (The Hacker News) Atlassian has released software fixes to address four critical flaws in its software that could lead to remote code execution.

Atlassian reveals four fresh critical flaws (Register) Bitbucket, Confluence and Jira all in danger, again. Sigh

What Is Citrix Bleed? The Next Ransomware Patch You Need (GovTech) Adopting a patch released in October — and removing any threat actors that may already be exploiting unpatched instances of the software — is important to defending against new actors known to exploit this flaw.

CISA finally removes dud vulnerability from must-patch list (Register) Apparently no one thought to check if this D-Link router 'issue' was actually exploitable

Trends

Cybersecurity Perception Problem in 2023 (Hive Systems) The 2023 update to our research that compares how cybersecurity incidents and data breaches occurred, what academia published, what the news covered, and what people Googled. So what’s new this year, what was our methodology, and what was surprising? Read on!

A Hidden Risk in the Municipal Bond Market: Hackers (Wall Street Journal) Cyberattacks leave schools, hospitals and utilities struggling to pay ransom, restore services and boost security.

AI and Mass Spying (Schneier on Security) Spying and surveillance are different but related things. If I hired a private detective to spy on you, that detective could hide a bug in your home or car, tap your phone, and listen to what you said.

How Ransomware Gangs Are Fueling a New Cybersecurity Arms Race (Barron's) Ransomware and crypto have become inseparable, and they're fueling a new arms race for protection. Demand for cyber insurance is growing.

2023 Manufacturing Threat Briefing (Trustwave) An in-depth threat briefing on the unique challenges manufacturing faces, including actionable insights on how to navigate industry trends and mitigate attack cycles.

SecurityScorecard Threat Intelligence Reveals 90% of Energy Companies Experienced a Third-Party Breach (Business Wire) SecurityScorecard today released new research revealing that 90% of the world’s leading energy companies experienced a third-party data breach in the past 12 months. The research highlights how the energy industry faces a significant threat from third-party risks, where attackers target an organization's vendor ecosystem.

Hackers are targetting UAE, Saudi businesses' cloud services — survey (Gulf Business) The targetting of cloud infrastructure among corporates in these two countries is on the rise, according to a new survey.

One in five businesses have been victims of cyber attack in the last year (Aviva) Aviva research reveals that one in five UK businesses have experienced a cyber attack or incident, with 9% of small businesses experiencing this in the last year.

Marketplace

Almost 50% of organizations plan to reduce cybersecurity headcounts: Survey (CSO Online) While organizations are realizing the need for knowledgeable teams to address unknown threats, they are also looking to reduce their security headcount and infrastructure spending.

Acclaim Technical Services acquires Alder Technology (Intelligence Community News) Reston, VA-based Acclaim Technical Services (ATS), a leader in specialized operational support, technology solutions, and language-enabled services to the U.S. Intelligence Community (IC) announced today that it has acquired Alder Technology Corporation, a Chantilly, VA-based provider of high-end network engineering, network security, and data management services and solutions supporting the national security mission.

LogicGate Named a Leader in Governance Risk & Compliance by Independent Research Firm (PR Newswire) LogicGate, a leading provider of Governance, Risk, and Compliance (GRC) solutions through its Risk Cloud® platform, today announced it...

Elon Musk’s X is especially vulnerable to an ad boycott (The Economist) The perils of telling advertisers to clear off

Shift5 selected by Army to cyber-harden HIMARS fleet (C4ISRNet) The U.S. military’s increasingly computerized weapons are at risk of harassment or hijacking, the Government Accountability Office has said.

Sam Altman Is TIME's 2023 CEO of the Year (TIME) Altman emerged as one of the most powerful executives in the world, the public face of a technological revolution.

Microsoft Hires New CISO in Major Security Shakeup (SecurityWeek) Microsoft announced a major shakeup of its security hierarchy, removing the CISO and Deputy CISO and handing the reins to a recent hire.

Microsoft Gets New Security Leader 'Who Can Shake Things Up' In Major Reshuffle - Microsoft (NASDAQ:MSFT) (Benzinga) Insiders suggest that these changes reflect a revamp in the strategy for the CISO position.

Products, Services, and Solutions

Coro Revolutionizes the Way Midmarket Companies Manage Security with World’s First Modular Cybersecurity Platform (Business Wire) Coro 3.0 consolidates critical capabilities including EDR, SASE and email security into a single platform with 14 integrated security modules that can be deployed on demand

Trail of Bits Spinout iVerify Tackles Mercenary Spyware Threat (SecurityWeek) iVerify, a seed-stage startup spun out of Trail of Bits, ships a mobile threat hunting platform to neutralize iOS and Android zero-days.

Lenovo’s New All-in-One, AI-Powered Solution with Microsoft Simplifies Security and Removes the Need for Multiple Vendors - Lenovo StoryHub (Lenovo StoryHub) Cyber Resiliency as a Service ensures business continuity by integrating greater visibility with cyber protection, detection, response, and recovery.

Malwarebytes Announces Free Vulnerability Assessment to Help IT Organizations Improve Security Posture Without Extra Costs (PR Newswire) Malwarebytes, a global leader in real-time cyber protection, today announced its comprehensive vulnerability assessment module is now included...

Permiso Offers Complimentary Cloud Identity Threat Briefings in Wake of Okta Breaches (Permiso) Permiso has been researching and detecting attacks against the identity provider control plane for last several years and built over a hundred detections and signals based on known TTPs from advanced threat actor groups.

Netskope Is First Vendor To Deliver Security Service Edge Globally With A Seamless, Localized Experience (Netskope) With its extensively-peered NewEdge Private Security Network, customers benefit from security coverage everywhere without performance trade-offs SANTA

Fortinet Extends its Universal SASE Footprint Through Expanded Strategic Partnership with Digital Realty (GlobeNewswire News Room) Fortinet’s commitment to providing a more extensive global cloud network ensures customers can more seamlessly connect and secure their hybrid workforces...

Foresite Cybersecurity Partners with Crowdstrike (PR Newswire) Foresite, announces a new partnership with CrowdStrike, a global leader in cloud-delivered protection of endpoints, cloud workloads, identity,...

Rimidi Achieves HITRUST Essentials 1-year (e1) Certification, Demonstrating Foundational Cybersecurity Measures (Rimidi) HITRUST e1 Certification demonstrates that Rimidi’s clinical management platform is focused on the most critical cybersecurity controls.

VulnCheck Offers Vulnerability Management Continuity by Maintaining NIST NVD 1.0 After Migration Deadline (Business Wire) VulnCheck Community Platform Tier Offering Provides Security Teams with Extended Timeline to Migrate to NVD’s 2.0 APIs After December 15 Deadline

Technologies, Techniques, and Standards

Digital Deceptions: The War Over Truth in the Age of Disinformation (AFCEA International) Exploring the impact of disinformation in modern conflicts reveals the urgent need for strategies to counteract digital deceit.

The UK-US Blog Series on Privacy-Preserving Federated Learning: Introduction (NIST) This post is the first in a series on privacy-preserving federated learnin

The Case for Memory Safe Roadmaps (CISA) Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously

CISA Releases Joint Guide for Software Manufacturers: The Case for Memory Safe Roadmaps (Cybersecurity and Infrastructure Security Agency | CISA) Today, as part of the Secure by Design campaign, CISA published The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously in collaboration with the following partners:

CISA, NSA, FBI and International Cybersecurity Authorities Publish Guide on The Case for Memory Safe Roadmaps (Cybersecurity and Infrastructure Security Agency) Guide encourages software manufactures to address memory safety vulnerabilities and implement secure by design principles

Here are the Army's new planned EW, signals programs (Breaking Defense) Brig. Gen. Ed Barker gave reporters a look ahead on his fiscal 2024, 2025 and 2026 priorities.

DSPM deep dive: debunking data security myths (Register) To maintain a strong data security posture, you must protect the data where it lives

How a strong cybersecurity strategy affects customer acquisition and retention (Digital Insurance) Cyber insurance can provide peace of mind and affect customer acquisition and retention.

Design and Innovation

App-centric connectivity: A new paradigm for a multicloud world (IBM Blog) We're helping clients accelerate positive business outcomes by building, deploying and managing applications and services anytime, anywhere.

Google's AI chatbot Bard gets a big upgrade with Gemini, Google's next-gen AI model (TechCrunch) Google Bard, the company's generative AI chatbot and ChatGPT rival, is getting an update today that the company claims will significantly enhance its

Google DeepMind’s new Gemini model looks amazing—but could signal peak AI hype (MIT Technology Review) It outmatches GPT-4 in almost all ways—but only by a little. Was the buzz worth it?

Research and Development

RTX wins $8M DARPA contract to improve Department of Defense supply chain resilience (Homeland Preparedness News) The Defense Advanced Research Projects Agency (DARPA) awarded an $8 million contract to address systemic risk surrounding procurement and delivery of supplies to aerospace and defense company RTX and its Raytheon BBN Technologies unit this week.

Academia

Two K-State computer science faculty secure $1M+ for AI research (WIBW) Two Kansas State University computer science faculty members secured more than $1 million for artificial intelligence research.

Legislation, Policy, and Regulation

China’s Hackers Are Expanding Their Strategic Objectives (Default) China-based hackers are accessing U.S. infrastructure and developing methods to disrupt it in the event of conflict.

How Nations Are Losing a Global Race to Tackle A.I.’s Harms (New York Times) Alarmed by the power of artificial intelligence, Europe, the United States and others are trying to respond — but the technology is evolving more rapidly than their policies.

Coming EU Rules on AI May Shape Companies’ Use of Automated Systems (Wall Street Journal) Financial software maker Intuit said it designs AI products that can meet European privacy requirements.

CISA and ENISA enhance their Cooperation (ENISA) The European Union Agency for Cybersecurity (ENISA) has signed a Working Arrangement with the Cybersecurity and Infrastructure Security Agency (CISA) of the US, in the areas of capacity-building, best practices exchange and boosting situational awareness.

Healthcare Sector Cybersecurity: Introduction to the Strategy of the U.S. Department of Health and Human Services (US Department of Health and Human Services) The healthcare sector is particularly vulnerable to cybersecurity risks and the stakes for patient care and safety are particularly high. Healthcare facilities are attractive targets for cyber criminals in light of their size, technological dependence, sensitive data, and unique vulnerability to disruptions

HHS releases cybersecurity strategy for health care sector (American Hospital Association | AHA News) The Department of Health and Human Services Dec. 6 released a concept paper outlining its cybersecurity strategy for the health care sector, which builds on a national strategy President Biden released last year.

HHS wants Congress to fund cybersecurity resilience programs with 'financial consequences' for hospitals (Fierce Healthcare) New Medicare program requirements, hospital incentive programs and better internal coordination are all at the heart of the Biden administration’s strategy to bolster cybersecurity within the healthcare industry.

House Judiciary easily clears bill to renew surveillance tools with warrant mandate (Record) The House Judiciary Committee on Wednesday overwhelmingly approved a bipartisan bill that would require all U.S. intelligence agencies to obtain a court warrant before searching for information about Americans retrieved by powerful electronic spying tools.

FBI director cites mysterious Iran-linked attack in arguing for Section 702 (Washington Post) FBI Director Christopher A. Wray made a fresh appeal to lawmakers this week to renew an expiring surveillance power, revealing that in one recent case, it had helped authorities alert 300 potential victims in all 50 states as well as in other countries that they might be targets of a cyberattack.

Congress should reauthorize Section 702 (Federal News Network) “The intelligence community used Section 702 information to avert the 2009 attempted New York City subway bombing, the 2010 attempted vehicle bombing at a Portland Christmas tree lighting ceremony …

Final defense bill drops Cyber Force study (Record) The proposal would have mandated the Defense Department hire the National Academy of Public Administration to examine the feasibility of creating a seventh, cyber-specific military service.

OPM Opens Portal for Cyber Position Rotation Program (FEDweek) OPM has opened a portal for a cyber position allowing for rotations of between six months and a year for employees with at least one OPM cyber code, or

FCC partners with four states on privacy and data protection enforcement (Record) The attorneys general of Connecticut, Illinois, New York and Pennsylvania signed a memorandum of understanding with the FCC.

Litigation, Investigation, and Law Enforcement

Reuters Takes Down Blockbuster Hacker-for-Hire Investigation After Indian Court Order (404 Media) The investigation gave unprecedented insight into how hacker-for-hire shops operated. Reuters says it stands by the reporting.

Bank of England will review the risks that AI poses to UK financial stability (AP News) The Bank of England says it will make an assessment next year about the risks posed by artificial intelligence and machine learning.

UK minister demands answers for security failings at Sellafield (the Guardian) Claire Coutinho says alleged cybersecurity issues at UK’s most hazardous nuclear site must be urgently addressed

GAO blames staffing shortages for agencies’ failures to battle cyber attacks (Federal News Network) In today's Federal Newscast: Sen. Tommy Tuberville (R-Ala.) has lifted his abortion-driven hold on military promotions. Job satisfaction at the Homeland Security Department has increased.

WSJ News Exclusive | Facebook and Instagram Steer Predators to Children, New Mexico Attorney General Alleges in Lawsuit (Wall Street Journal) State investigators’ test accounts with AI-generated photos were deluged with sexual propositions and adult sex content, the suit claims. Meta says it works hard to protect young users.

$10 million up for grabs in fight against North Korean hackers (Hot for Security) Fancy earning $10 million? Of course you do! Well, today could be your lucky day.

Texas claims US State Department funds tech that censors conservative news (Reuters) Texas' Republican state attorney general and two conservative media companies on Wednesday sued the U.S. Department of State, accusing it of funding of technologies used to counter disinformation online that they claim censor right-leaning news outlets.

Ex-Roadrunner dispatch manager sentenced to 18 months for wire fraud (FreightWaves) Feds say Kansas woman and trucker teamed up to steal $113K from refrigerated division

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SANS Phoenix-Tempe 2023 (Phoenix, Arizona, USA, Dec 4 - 9, 2023) At SANS Phoenix-Tempe 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

2023 CyberMaryland Conference (Hyattsville, Maryland, USA, Dec 6 - 7, 2023) For over 10 years The CyberMaryland Annual Conference, presented by the Federal Business Council (FBC), has brought together the leading Cybersecurity and IT professionals in the state of Maryland across academia, government, and industry to promote the community of cybersecurity. This networking and educational event is an incredible opportunity to connect with the best and brightest professionals as well as up and coming newbies and the latest in industry products and services. This exclusive event connects cybersecurity on all levels to ensure the cyber-safety of today and educate the cybersecurity professionals of tomorrow. Additionally, Maryland is a notable hub of natural leadership in the cybersecurity field. This unique community of people share in the same passion - to strengthen the cyber security industry through unity, improved security awareness while helping Marylanders lead safer digital lives.

CyberMarketingCon 2023 (Austin, Texas, USA, Dec 10 - 13, 2023) CyberMarketingCon 2023 is a must-attend event for marketing professionals, industry experts, and anyone seeking to master the art of marketing in the ever-evolving realm of cybersecurity. With a focus on innovation, collaboration, and the latest trends in the industry, this conference will deliver invaluable insights and networking opportunities. In addition, conference content and materials will be accessible to digital ticketholders as both a live-stream and replays for a limited time after the event concludes.

SANS Cyber Defense Initiative Washington DC 2023 (Washington, DC, USA, Dec 11 - 16, 2023) At SANS Cyber Defense Initiative Washington DC 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

CyberQuest Leaders Breakfast Forum (Arlington, Virginia, USA, Dec 12, 2023) This is a unique opportunity to hear a fireside chat between Stacy Bostjanick, Chief, Defense Industrial Base Cybersecurity, Office of DoD CIO, and Hon. Ellen Lord, the first Undersecretary for Defence, and notable industry veteran. The insightful conversation will be followed by a leading industry panel drawn from diverse stakeholder groups. The panel will discuss perspectives and industry concerns, and consider how the supply chain is fundamentally faring with prime accountability in regulatory compliance, and strategic operations in the rollout of regulations. Interactive peer roundtable discussions will allow attendees to share industry lessons learned and recommend actionable strategies. The program concludes with table 'calls to action' and Q&A. Non-attributable recommendations will be recorded and shared post-event. Join us for breakfast and grow your leadership network and professional sphere of influence.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.