RSAC 2020. Cloud Snooper. US states' purchase of Chinese tech. Voatz under scrutiny. Facebook looks for trolls (but no joy).

Today's issue includes events affecting Australia, China, European Union, Israel, Kenya, Mexico, Russia, United Arab Emirates, and United States.

Bring your own context.

How about a run-down of some suspicious behavior an enterprise ought to be on the lookout for?.

"Number one is the known bad. An attack will most likely not originate from an Iranian IP address. It might not even be a foreign IP, but at least still having your beefing up your known bads, I think, will help a little bit in that respect. When I say known bads, I mean IPs and domains and indicators of compromise that the Iranians have allegedly used in the past. Having those loaded into your monitoring infrastructure won't hurt. But I'll tell you, I'm a little bit skeptical if the Iranians are going to use the same approach or tactics, techniques and procedures they've used before. But it still helps to have the known bad there. 

"The second one is anomalous behavior - hosts acting in a strange way but not necessarily malicious. It could be odd administrative activity. It could be some weird registry settings that were changed. Essentially, anomalous means looking for the weird. 

"And the third one would be looking for the suspicious, particularly around users and/or administrators. So one of the areas that I think needs a lot of work in our industry is scrutinizing privileged access actions. So, for instance, if you're - if you work at all with Linux, you know it's generally not a good thing to log in as root, particularly via SSH. You want to log in as yourself. And then you want to use a command like pseudo to become root or the system administrator."

—Justin Harvey, global incident response leader at Accenture, on the CyberWire Daily Podcast, 2.20.20.

The known bad, the odd, and the suspicious. Not quite the good, the bad, and the ugly, because, really, they're all pretty bad.

Coming soon: CyberWire Pro.

Our new subscription program, CyberWire Pro, will be available soon. Designed for cyber security professionals and others who want to stay abreast of our rapidly evolving industry, CyberWire Pro is a premium news service that will save you time and keep you informed. Learn more and sign up to get launch updates here. And please do swing by and check out our new site design.