Welcome to Ironshare’s Cyber Round-up, where we look back at the events of that last week and year to cover some of the news, posts, views, and highlights from the world of Security.
In this week’s round-up:
At the end of last week, we started to get indications across the online infosec & cyber community, that not one, but two zero-day flaws were currently being exploited in Microsoft Exchange Server. This is another in a long line of critical vulnerabilities seen in Microsoft Exchange over the last year or so.
If you run or manage on-premises Exchange servers we advise you focus your immediate attention on these exploited vulnerabilities.
Check out our post here for more information.
By ironshare.co.uk
An ex-employee of a Hawaii-based finance company who was positioned in an IT admin role, attempted to disrupt the company’s business in order to be rehired with a higher wage. Casey K Umetsu accessed the company’s domain registrar using unrevoked credentials, deliberately changed the firm’s DNS records to misdirect the business’s web and email traffic, and locked the company out of its domain name registrar account. The man thought, in doing so the company would be forced into a position to rehire him, however the company instead sought the assistance of the FBI. “Umetsu criminally abused the special access privileges given to him by his employer to disrupt its network operations for personal gain,” said US Attorney Clare E. Connors. Casey K Umetsu pleaded guilty to the charges and is expected to be sentenced in January. He faces punishment of up to 10 years in prison, a maximum fine of $250,000, and up to three years of supervised release.
BY tripwire.com
The General Data Protection Regulation brought in by the European Union in 2018 was designed to increase the overall protection of personal data being stored by businesses as well as enhance individuals’ rights to their data. The UK is planning to introduce a new system to be more straightforward for businesses to navigate. “No longer will our businesses be shackled by lots of unnecessary red tape,” said the UK Secretary of State for Digital, Culture, Media and Sport, Michelle Donelan. “We will be replacing GDPR with our own business and consumer-friendly British data protection system.” The backlash has been growing against the new reform especially as information about the new system is yet to be disclosed by the UK government. UK Businesses operating with the EU are expected to be compliant with both the GDPR and the new reform causing concern that the new system will put additional pressure on businesses.
By personneltoday.com
Microsoft has recently launched its #BeCyberSmart campaign to help provide companies with tips on how to keep their employees safe online. The most common cyber attacks seen in 2021 were malware (22%) and phishing (20%). With this, Microsoft is advising people to check the sender's email addresses for an unrelated or incorrectly spelled email and not to click on links or email attachments from unknown senders. Other key preventative measures are enabling multi-factor authentication, running well-trusted antivirus software, installing system updates and using a password manager. Stay up to date and secure by reading the #BeCyberSmart tips.
By Microsoft.com
With cybersecurity awareness month starting many companies have shown their appreciation for the importance of awareness around cybersecurity. AWS, Cisco, Netflix and SAP are such companies trying to inspire others to do the same. From creating a “security first” culture to providing resources to help get people into a career in cybersecurity these companies are paving the way in increasing awareness. Each hopes that providing the correct support and engagement will increase overall security and protect against growing threats. Read more about what AWS, Cisco, Netflix and SAP are doing to protect their organisations through awareness here.
By darkreading.com
G4S has been put under pressure after information about current and former Australian employees were stolen and posted online. The cyber attack occurred when an unauthorised third party “or malware program” gained access to G4S internal systems. Information such as employee names, addresses, dates of birth, contact details, police and medical checks, tax file numbers, bank account details, superannuation information, Medicare numbers and licence details were stolen and in some cases payslips, health information shared with the company, and details about Workcover claims or incident reports. Employees affected in the cyber attack have been notified and informed how to replace their identity documents however G4S has refused to offer to pay for the replacements or provide credit monitoring of its affected employees.
By theguardian.com
Red Hot Cyber has reported that documents relating to Ferrari have been leaked online. Documents such as repair manuals and datasheets were discovered as RansomEXX claimed to have hacked Ferrari. In an email sent between Ferrari and Red Hot Cyber, it was reported that there is no evidence of a ransomware attack or any disruption to its services. Dario Esposito, responsible for governing communication at Ferrari stated that “The Company is working to identify the source of the event and take all necessary actions.”
By Spiceworks.com
And that’s it for this week’s round-up, please do check in next week for our new batch of security news and posts.
Stay Safe, Secure and Healthy!
Edition #207 – 30th September 2022
Why not follow us on social media:
Stuart Hare is a Technologist with a passion for helping people in all aspects of IT & Cyber Security. Stuart is the Founder of Ironshare, an Information and Cyber Security company providing consultancy and managed services.
Samuel is a Security Analyst with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
Joshua is working as a Managed Service Lead with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
