Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and Default

Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and Default

Now more than ever, it is crucial for technology manufacturers to make Secure-by-Design and Secure-by-Default the focal points of product design and development processes. Some vendors have made great strides driving the industry forward in software assurance, while others lag behind. The authoring agencies strongly encourage every technology manufacturer to build their products in a way that prevents customers from having to constantly perform monitoring, routine updates, and damage control on their systems to mitigate cyber intrusions. Manufacturers are encouraged to take ownership of improving the security outcomes of their customers.

To accomplish this high standard of software security, the authoring agencies encourage manufacturers to prioritize the integration of product security as a critical prerequisite to features and speed to market. Over time, engineering teams will be able to establish a new steady-state rhythm where security is truly designed-in and takes less effort to maintain. Reflecting this perspective, the European Union reinforces the importance of product security in the Cyber-Resilience-Act, emphasizing that manufacturers should implement security throughout a product’s life-cycle in order to prevent manufacturers from introducing vulnerable products into the market.

For the full article, and additional publications by the authoring agencies please click below. For the full article in PDF format please click here. 

Joint guide for cybersecurity best practices for Smart Cities

Smart city technologies present fantastic opportunities for more innovative and sustainable communities, but they also introduce risks to our security and critical infrastructure.

The Cybersecurity Best Practices for Smart Cities guide has been released in collaboration with our international cyber security partners.

Smart cities can create safer, more efficient, more resilient communities through technological innovation and data-driven decision making. However, this opportunity also introduces potential vulnerabilities that are an attractive target for criminals and cyber threat actors.

Communities and organisations implementing smart city technologies should account for these potential vulnerabilities as part of their overall risk management approach.

This guide provides three recommendations for communities and organisations looking to implement smart city technologies: secure planning and design, proactive supply chain risk management, and operational resilience.

Find out more about this important joint initiative and read the full guide.

2023-03: ACSC Ransomware Profile – Lockbit 3.0

The ACSC is aware of an increase in domestic­ and global activities of LockBit 3.0 ransomware group in 2022 and they continued targeting organisations in 2023. The Lockbit 3.0 BLACK variant is the most observed ransomware variant worldwide.

Lockbit 3.0 ransomware encrypts files on compromised computer systems and make them inoperable. Victims receive instructions to initiate ransom negotiation with the threat actors. It performs a check to avoid executing on computer systems with installed languages common to Commonwealth of Independent States (CIS) countries. Lockbit 3.0 threat actors operate as a Ransomware-as-a-Service (RaaS). Affiliates have compromised organisations worldwide, including Australia, where the ACSC is aware of numerous incidents since 2022. The threat actors conduct multifaceted extortions as they steal victim data, encrypt files, and threaten to publish the stolen data as a strategy for pressuring victims into paying the ransom. The threat actors rely on stolen or compromised credentials to establish the initial access into the victim’s network.

Further information on tactics, techniques, procedures, post-exploitation, and mitigations is available here.

High Severity Vulnerability present in Microsoft Outlook for Windows

A critical elevation of privilege vulnerability (CVE-2023-23397) has been identified in all versions of Microsoft Outlook for Windows.

Microsoft Outlook for Windows is a personal information manager software system from Microsoft, available as a part of the Microsoft Office and Microsoft 365 software suites. Microsoft Outlook for Windows is available on Windows.

Exploitation of this vulnerability occurs when a threat actor delivers a specially crafted message to a user. These can leak the new technology LAN manager (NTLM) hash of the user to the untrusted network which an attacker can then relay to another service and authenticate as the user.

Affected Australian organisations should apply the available patch immediately.

The ACSC is not aware of any successful exploitation attempts against Australian organisations.

Australian organisations that use Microsoft Outlook for Windows should review their patch status and update to the latest version.

Additionally the ACSC recommends organisations block outbound SMB traffic (Ports 139 and 445).

 Cyber News

Domestic Cyber News

ACCC calls for united front as scammers steal over $3bn from Australians | Scamwatch

The latest Targeting Scams report has revealed Australians lost a record $3.1 billion to scams in 2022, as government, law enforcement and the private sector look to improve collaborative efforts to support the community in the fight against scams.  This is an 80 per cent increase on total losses recorded in 2021.

The report compiles data reported to the ACCC’s Scamwatch, ReportCyber, the Australian Financial Crimes Exchange (AFCX), IDCARE and other government agencies.

It shows that investment scams were the highest loss category ($1.5 billion), followed by remote access scams ($229 million) and payment redirection scams ($224 million).

“Australians lost more money to scams than ever before in 2022, but the true cost of scams is much more than a dollar figure as they also cause emotional distress to victims, their families and businesses,” ACCC Deputy Chair Catriona Lowe said.

“As scammers become increasingly sophisticated in their tactics, it is clear a co-ordinated response across government, law enforcement and the private sector is essential to combat scams more effectively.”

“That’s why we continue to lend our expertise and support to prepare for the establishment of the Government’s National Anti-Scam Centre, with the ultimate aim of making Australia the hardest target for scammers,” Ms Lowe said

International Cyber News

CISA, Cyber National Mission Force Leaders Share How They Partner: First-Ever Ops Revealed to Industry | CISA

In line with the theme for this year’s RSA Conference, Stronger Together, officials from the Cybersecurity and Infrastructure Security Agency (CISA) and U.S. Cyber Command’s Cyber National Mission Force, delivered a presentation on the importance of partnership in defending America’s critical infrastructure while holding malicious cyber actors accountable.

The officials shared newly-declassified details of interagency responses to cyber-attacks from nation-state actors and cybercriminals, including how CNMF shares information from foreign operations to enable CISA’s domestic defensive mission. They also discussed how CISA shares information from domestic cyber incidents to enable CNMF’s operations to impose costs on foreign malicious cyber actors.

“As our nation’s cyber defence agency, CISA recognizes that we must leverage all tools and capabilities to increase costs against our adversaries. Our work with CNMF enables us to not only more effectively defend our nation’s critical infrastructure from cyberattacks but also clearly demonstrate to our adversaries that there is a price to pay if you decide to attack American infrastructure,” said the CISA official.

The CNMF mission is broad, continuous, joint, and enduring in the combat against foreign malicious cyber actors. Together, and in collaboration with partners across government and the private sector, we can make our nation more secure and resilient.

Small Business Resources

The Australian Cyber Security Centre (ACSC) provides trusted and relevant information on how Australia’s small and medium businesses can protect themselves from the most common cyber security threats.

Get social

Be sure to follow us on Twitter and Facebook and subscribe to our YouTube channel for the latest campaign content and practical advice to help Australians improve their cyber security.

Are you a victim of cybercrime? Visit ReportCyber to take your next steps.

We use hyperlinks to give you more information. If you don’t want to click hyperlinks, you can search for the information on cyber.gov.au.

CONTACT US
Facebook: https://www.facebook.com/cybergovau
Twitter: https://twitter.com/CyberGovAU
Web: www.cyber.gov.au