What I am Reading 12/4/2022

Common Supply Chain Challenges (flowchart)

https://www.linkedin.com/feed/update/urn:li:activity:7002550665881214976/?commentUrn=urn%3Ali%3Acomment%3A(activity%3A7002550665881214976%2C7002675978879598592)&dashCommentUrn=urn%3Ali%3Afsd_comment%3A(7002675978879598592%2Curn%3Ali%3Aactivity%3A7002550665881214976)&origin=COMMENTS_BY_YOUR_NETWORK

How Capitalism—Not a Few Bad Actors—Destroyed the Internet

https://www.bostonreview.net/articles/how-capitalism-not-a-few-bad-actors-destroyed-the-internet/

Online Safety Bill: Plan to make big tech remove harmful content axed

https://www.bbc.com/news/technology-63782082?at_medium=RSS&at_campaign=KARANGA

How to build a public profile as a cybersecurity pro

https://www.csoonline.com/article/3680390/how-to-build-a-public-profile-as-a-cybersecurity-pro.html#tk.rss_all

What Every Enterprise Can Learn From Russia’s Cyber Assault on Ukraine

https://www.darkreading.com/microsoft/what-every-enterprise-can-learn-from-russia-s-cyber-assault-on-ukraine

7 free cybersecurity resources you need to bookmark

https://www.helpnetsecurity.com/2022/11/28/7-free-cybersecurity-resources-you-need-to-bookmark/

The 5 Core Principles of the Zero-Trust Cybersecurity Model

https://www.imperva.com/blog/5-core-principles-of-zero-trust/

Cisco ISE Vulnerabilities Can Be Chained in One-Click Exploit

https://www.securityweek.com/cisco-ise-vulnerabilities-can-be-chained-one-click-exploit

US bans Chinese telecoms imports – won't even consider authorizing them

https://www.theregister.com/2022/11/27/fcc_china_equipment_authorization_ban/

Using Hardware Logic to Protect Critical Infrastructure

https://www.forcepoint.com/blog/x-labs/hardware-logic-protect-critical-infrastructure

The exodus from Elon Musk’s Twitter has begun. Should the infosec community care?

https://www.scmagazine.com/analysis/careers/the-exodus-from-elon-musks-twitter-has-begun-should-the-infosec-community-care

Mitsubishi Electric PLCs Exposed to Attacks by Engineering Software Flaws

https://www.securityweek.com/mitsubishi-electric-plcs-exposed-attacks-engineering-software-flaws

What the CISA Reporting Rule Means for Your IT Security Protocol

https://thehackernews.com/2022/12/what-cisa-reporting-rule-means-for-your.html

One Year After Log4Shell, Most Firms Are Still Exposed to Attack

https://www.darkreading.com/application-security/one-year-later-log4shell-exposed-attack

Update added 12/4/2022: 

State of Emergency declared, FBI investigating power grid attack in Moore County, sheriff says

https://www.wsoctv.com/news/local/intentional-vandalism-leaves-38000-customers-without-power-moore-county-sheriffs-office-says/SNCENVLP5NH5VCBOEI4G2G5CZY/

If you have Audible I highly recommend this podcast "Operation Paperclip"  which revolves around the takedown of of Shadowcrew.com and then the subsequent return of Albert Gonzalez to credit card fraud via the TJX and Office Depot hacks.  https://www.audible.com/pd/Operation-Firewall-Podcast/B09YMRX5HM?eac_link=w8aV51BMTzPc&ref=web_search_eac_asin_1&eac_selected_type=asin&eac_selected=B09YMRX5HM&qid=uy6QCUZXie&eac_id=140-4680215-3707455_uy6QCUZXie&sr=1-1

What I'm Reading 11/27/2022 (including 3 books I recently finished)

 US Government Begins Researching 'Climate Intervention' Geoengineering

https://news.slashdot.org/story/22/11/20/2026209/us-government-begins-researching-climate-intervention-geoengineering

A Third of Global Organizations Were Breached Over Seven Times in the Past Year

https://www.darkreading.com/attacks-breaches/a-third-of-global-organizations-were-breached-over-seven-times-in-the-past-year

5 free resources from the Cybersecurity and Infrastructure Security Agency (CISA)

https://www.helpnetsecurity.com/2022/11/21/5-free-resources-cybersecurity-and-infrastructure-security-agency-cisa/

73 Percent of Retail Applications Contain Security Flaws, but Only a Quarter Are Fixed

https://finance.yahoo.com/news/73-percent-retail-applications-contain-125000195.html

Digesting CISA's Cross-Sector Cybersecurity Performance Goals

https://www.securityweek.com/digesting-cisas-cross-sector-cybersecurity-performance-goals

CISA Updates Infrastructure Resilience Planning Framework

https://www.securityweek.com/cisa-updates-infrastructure-resilience-planning-framework

The Biden administration has racked up a host of cybersecurity accomplishments

https://www.csoonline.com/article/3680558/the-biden-administration-has-racked-up-a-host-of-cybersecurity-accomplishments.html#tk.rss_all

Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries

https://thehackernews.com/2022/11/hackers-exploiting-abandoned-boa-web.html

Crypto Firm FTX’s Ownership of a U.S. Bank Raises Questions

https://www.nytimes.com/2022/11/23/business/ftx-cryptocurrency-bank.html

How the cyber incident reporting law could finally fix the information sharing problem

https://www.cyberscoop.com/cisa-cyber-reporting-law/

How Xi Jinping leveled-up China's hacking teams

https://www.cyberscoop.com/china-hacking-talent-xi-jinping-education-policies/

MIT Research Documents Effectiveness of Consensus Cyber Risk Oversight Principles

https://www.darkreading.com/risk/mit-research-documents-effectiveness-of-consensus-cyber-risk-oversight-principles

90% of organizations have Microsoft 365 security gaps

https://www.helpnetsecurity.com/2022/11/22/microsoft-365-security-protections/

US tech layoffs: India workers face painful exit from the US

https://www.bbc.com/news/world-asia-india-63658535?at_medium=RSS&at_campaign=KARANGA

US bans sale of Huawei, ZTE tech amid security fears

https://www.bbc.com/news/world-us-canada-63764450?at_medium=RSS&at_campaign=KARANGA

Three Books I have read recently --

Project Zero Trust: A Story about a Strategy for Aligning Security and the Business

https://www.amazon.com/Project-Zero-Trust-Strategy-Aligning-ebook/dp/B0B99BJF2V

Investments Unlimited: A Novel About DevOps, Security, Audit Compliance, and Thriving in the Digital Age

https://www.amazon.com/Investments-Unlimited-Security-Compliance-Thriving-ebook/dp/B09L329V7C/

These books use the same concept as The Phoenix Project, working through a technical or management issue in a novelization format.  Neither is an in-depth technical resource but they do provide solid underpinnings for beginning in DevOps or Zero Trust Security.

Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency

https://www.amazon.com/Tracers-Dark-Global-Crime-Cryptocurrency-ebook/dp/B09SKW8WRV/

Pretty interesting story on how law enforcement used Bitcoins reputation as being untraceable to track and arrest online drug dealers and CSAM peddlers. 

What I'm Reading 11/20/2022

Exclusive: Russian software disguised as American finds its way into U.S. Army, CDC apps

https://www.reuters.com/technology/exclusive-russian-software-disguised-american-finds-its-way-into-us-army-cdc-2022-11-14/

5 Kali Linux tools you should learn how to use

https://www.helpnetsecurity.com/2022/11/14/kali-linux-tools/

Swimlane and Nozomi Networks, Vulnerability Management Automation for Critical Infrastructure

https://securityboulevard.com/2022/11/swimlane-and-nozomi-networks-vulnerability-management-automation-for-critical-infrastructure/

Will a Labeling System Solve IoT Security Challenges?

https://www.hackread.com/abeling-system-iot-security-challenges/

Is the Grid Secure Enough for the Electric Vehicle Influx?

https://www.itsecurityguru.org/2022/11/14/is-the-grid-secure-enough-for-the-electric-vehicle-influx/?utm_source=rss&utm_medium=rss&utm_campaign=is-the-grid-secure-enough-for-the-electric-vehicle-influx

Applying IP network guidance has harmed control system field devices and legacy control systems

https://www.controlglobal.com/protect/cybersecurity/blog/21436469/applying-ip-network-guidance-has-harmed-control-system-field-devices-and-legacy-control-systems

Microsoft: Hackers are using this 'concerning' tactic to dodge multi-factor authentication

https://www.zdnet.com/article/microsoft-hackers-are-using-this-concerning-tactic-to-dodge-multi-factor-authentication/#ftag=RSSbaffb68

Get Ahead of the Five Most Dangerous New Attack Techniques

https://www.sans.org/blog/get-ahead-of-the-five-most-dangerous-new-attack-techniques/

US govt: Iranian hackers breached federal agency using Log4Shell exploit

https://www.bleepingcomputer.com/news/security/us-govt-iranian-hackers-breached-federal-agency-using-log4shell-exploit/

US Gov Warning: Start Hunting for Iranian APTs That Exploited Log4j

https://www.securityweek.com/us-gov-warning-start-hunting-iranian-apts-exploited-log4j

Researchers Say China State-backed Hackers Breached a Digital Certificate Authority

https://thehackernews.com/2022/11/researchers-say-china-state-backed.html

Omron PLC Vulnerability Exploited by Sophisticated ICS Malware

https://www.securityweek.com/omron-plc-vulnerability-exploited-sophisticated-ics-malware

Over 12,000 Cyber Incidents at DoD Since 2015, But Incident Management Still Lacking

https://www.securityweek.com/over-12000-cyber-incidents-dod-2015-incident-management-still-lacking

How to overcome OT security threats?

https://securityboulevard.com/2022/11/how-to-overcome-ot-security-threats/

What I'm Reading 11/13/2022 #infosec #cybersecurity #reading

 A Cypherpunk's Manifesto

https://what.cd/

Guess what we find in books? A look Inside our Midwest Regional Digitization Center– by Jeff Sharpe

https://blog.archive.org/2016/03/11/guess-what-we-find-in-books-a-look-inside-our-midwest-regional-digitization-center-by-jeff-sharpe/

NSA - Software Memory Safety

https://media.defense.gov/2022/Nov/10/2003112742/-1/-1/0/CSI_SOFTWARE_MEMORY_SAFETY.PDF

NSA urges orgs to use memory-safe programming languages

https://www.theregister.com/2022/11/11/nsa_urges_orgs_to_use/

Mysterious company with government ties plays key internet role

https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-government-connections/

concerns about Trustcor

https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/etbBho-VBQAJ?pli=1

Tech’s Talent Wars Have Come Back to Bite It

https://www.nytimes.com/2022/11/10/technology/big-tech-layoffs.html

Is web3 bullshit? (Transcript)

https://blog.mollywhite.net/is-web3-bullshit/

World population to reach 8 billion on 15 November 2022

https://www.un.org/en/desa/world-population-reach-8-billion-15-november-2022

The Email Caste's Last Stand

https://compactmag.com/article/the-email-caste-s-last-stand

The Fallout From the First Trial of a Corporate Executive for ‘Covering Up’ a Data Breach

https://www.lawfareblog.com/fallout-first-trial-corporate-executive-covering-data-breach

the most unethical thing I was asked to build while working at Twitter.

https://twitter.com/stevekrenzel/status/1589700721121058817

How corporate chiefs dodge lawsuits over sexual abuse and deadly products

https://www.reuters.com/investigates/special-report/bankruptcy-tactics-releases/

Silicon Valley’s Horrible Bosses

https://newsletters.theatlantic.com/galaxy-brain/62a7fbc951acba00209259f5/elon-musk-brian-armstrong-coinbase-crypto/

The fall of the FTX ‘King of Crypto’ Sam Bankman-Fried

https://www.bbc.com/news/technology-63612489?at_medium=RSS&at_campaign=KARANGA

High-Severity Flaw Reported in Critical System Used by Oil and Gas Companies

https://thehackernews.com/2022/11/high-severity-flaw-reported-in-critical.html

Expert warns that the US and Israel are still unprepared to defeat a cyber attack against organizations in the water sector.

https://securityaffairs.co/wordpress/138185/hacking/water-sector-us-israel-cyberattacks.html

China is likely stockpiling and deploying vulnerabilities, says Microsoft

https://www.theregister.com/2022/11/07/china_stockpiles_vulnerabilities_microsoft_asserts/

Nation-State Hacker Attacks on Critical Infrastructure Soar: Microsoft

https://www.securityweek.com/nation-state-hacker-attacks-critical-infrastructure-soar-microsoft

5 Reasons to Consolidate Your Tech Stack

https://thehackernews.com/2022/11/5-reasons-to-consolidate-your-tech-stack.html

This Hidden Facebook Tool Lets Users Remove Their Email or Phone Number Shared by Others

https://thehackernews.com/2022/11/this-hidden-facebook-tool-lets-users.html

Expert warns that the US and Israel are still unprepared to defeat a cyber attack against organizations in the water sector.

https://securityaffairs.co/wordpress/138185/hacking/water-sector-us-israel-cyberattacks.html

CISA Releases Decision Tree Model to Help Companies Prioritize Vulnerability Patching

https://www.securityweek.com/cisa-releases-decision-tree-model-help-companies-prioritize-vulnerability-patching

The future of cybersecurity: DAST solutions, SBOMs, and APIs to take center stage

https://securityboulevard.com/2022/11/the-future-of-cybersecurity-dast-solutions-sboms-and-apis-to-take-center-stage/

Why it's time to review your Microsoft patch management options

https://www.csoonline.com/article/3679248/why-its-time-to-review-your-microsoft-patch-management-options.html#tk.rss_all

What I'm Reading 11/6/2022

Well, the summer haitus went on much longer than intended. Work got extremely busy and I just didn't have the time or energy, but now I'm back (even though no one reads this blog).

Securing OT That Can’t Be Patched

https://www.itsecurityguru.org/2022/08/17/securing-ot-that-cant-be-patched/?utm_source=rss&utm_medium=rss&utm_campaign=securing-ot-that-cant-be-patched

Critical infrastructures cannot be secure when critical equipment isn’t 

https://www.controlglobal.com/blogs/unfettered/critical-infrastructures-cannot-be-secure-when-critical-equipment-isnt/

Security Culture: An OT Survival Story

https://www.darkreading.com/operations/security-culture-an-ot-survival-story

Engineering workstation attacks on industrial control systems double: Report

https://www.csoonline.com/article/3678352/engineering-workstation-attacks-on-industrial-control-systems-double-report.html#tk.rss_all

CISA releases cybersecurity performance goals to reduce risk and impact of adversarial threats

https://www.csoonline.com/article/3678191/cisa-releases-cybersecurity-performance-goals-to-reduce-risk-and-impact-of-adversarial-threats.html#tk.rss_all

CISA's critical infrastructure performance goals win praise, but questions remain about effectiveness

https://www.cyberscoop.com/cisa-performance-goals-operational-technology/

The 8 Best Vintage Self-Improvement Books

https://www.artofmanliness.com/living/reading/the-8-best-vintage-self-improvement-books/

Social Engineering Kill–Chain: Predicting, Minimizing & Disrupting Attack Verticals

https://ahead.feedly.com/posts/social-engineering-kill-chain-predicting-minimizing-and-disrupting-attack-verticals

OpenSSL dodges a security bullet

https://www.zdnet.com/article/openssl-dodges-a-security-bullet/#ftag=RSSbaffb68

How to securely manage LAPS on a Windows network

https://www.csoonline.com/article/3678293/how-to-securely-manage-laps-on-a-windows-network.html#tk.rss_all

Security Leaders Share 5 Steps to Strengthen Cyber Resilience

https://www.darkreading.com/microsoft/security-leaders-share-5-steps-to-strengthen-cyber-resilience

Federal bans aren't stopping US states from buying forbidden Chinese kit

https://www.theregister.com/2022/10/28/federal_bans_china_law/

I'll try and get back on the weekly schedule in the future.

What I'm Reading 8/29/2022 #infosec #cybersecurity

 I'm back a week early - Hooray!!

How to Recognize and Treat Heat Stroke and Heat Exhaustion - (late but still a few 90+ degree days left so...)

https://www.artofmanliness.com/health-fitness/health/how-to-recognize-and-treat-heat-stroke-and-heat-exhaustion/

How secure is America's electric grid?

https://www.cbsnews.com/video/america-electric-grid-60-minutes-video-2022-08-28/#x

(here is the website mentioned in the video if you are interested: Grid Security Now!  https://michaelmabee.info/)

Critical infrastructure is under attack from hackers. Securing it needs to be a priority - before it's too late

https://www.zdnet.com/article/critical-infrastructure-is-under-attack-from-hackers-securing-it-needs-to-be-a-priority-right-now/#ftag=RSSbaffb68

'Quiet quitting' has nothing to do with lazy employees. It's about rejecting broken work culture

https://www.zdnet.com/education/professional-development/quiet-quitting-has-nothing-to-do-with-rejecting-work-its-about-saying-no-to-toxic-work-culture/#ftag=RSSbaffb68

CISA: Action required now to prepare for quantum computing cyber threats

https://www.zdnet.com/article/quantum-computing-poses-cyber-threats-to-critical-infrastructure-action-to-secure-it-is-needed-now-warns-cisa/#ftag=RSSbaffb68

CISA wants you to patch these actively exploited vulnerabilities before September 8

https://www.malwarebytes.com/blog/news/2022/08/cisa-wants-you-to-patch-these-actively-exploited-vulnerabilities-before-september-8

Computer Networks from Scratch

https://www.networksfromscratch.com/table_of_contents.html

Employee’s compromised Google credentials led to Cisco breach

https://news.hitb.org/content/employees-compromised-google-credentials-led-cisco-breach

Security and Cheap Complexity

https://www.schneier.com/blog/archives/2022/08/security-and-cheap-complexity.html

New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data

https://thehackernews.com/2022/08/new-air-gap-attack-uses-mems-gyroscope.html

New Evil PLC Attack Weaponizes PLCs to Breach OT and Enterprise Networks

https://thehackernews.com/2022/08/new-evil-plc-attack-weaponizes-plcs-to.html

 

Pause on the weekly reading updates til 9/5/2022

 It's summer, work is busy and I am lazy so I am calling a hiatus until 9/5/2022