A group of nine senators, including past presidential hopefuls Bernie Sanders, Elizabeth Warren, Kamala Harris and Cory Booker, want to know why Amazon keeps firing COVID-19 whistleblowers. The senators penned a letter to the company asking about its “policies for discipline and termination regarding workers who raise health and safety concerns” in order to determine that the spate of recent firings “did not constitute retaliation for whistleblowing.”
Cisco’s Talos threat intelligence and research group revealed on Wednesday that one of its researchers discovered a critical remote code execution vulnerability in the CODESYS Control SoftPLC industrial controller software.
CODESYS Control SoftPLC is a runtime system that converts any PC or embedded device into an IEC 61131-3-compliant industrial controller.
In this post, I want to share my observations of how SaaS companies approach the trade-off between having solid cloud infrastructure security and pissing off their own engineers by overdoing it.
Security is annoying. Life could be much easier if security did not get in the way of getting things done. If you are a site reliability engineer in the middle of dealing with an emergency downtime, getting an “access denied” message from a troubled database master can be as infuriating as a doctor getting punched in the face by a patient they are trying to bring back to life!!
SC Magazine - Vulnerabilities in two Schneider Electric ICS products reminiscent of Stuxnet -
Vulnerabilities reminiscent of Stuxnet found in two Schneider Electric products could allow an attacker to gain operation control of a device by intercepting then retransmitting commands.
Trustwave’s Global OT/IoT security research team uncovered the flaws in Schneider’s SoMachine Basic v1.6 and Schneider Electric M221, firmware version 1.6.2.0, Programmable Logic Controller (PLC). By exploiting the flaws, a malicious actor could take control of the devices in the same manner operators circa 2005 used the Stuxnet worm to control and ultimately cause Iran’s nuclear centrifuges to destroy themselves.
Nearly five years ago, researchers unmasked a Chinese hacking group, pinpointing the unit of the People’s Liberation Army that was allegedly sponsoring it. The so-called Naikon group was key to China’s spying efforts in the South China Sea, targeting government agencies from the Philippines to Vietnam, said the report from companies ThreatConnect and Defense Group Inc.
...
Thursday, analysts with Israeli cybersecurity company Check Point said that Naikon has been far from idle in recent months, trying to hack familiar government organizations in Australia, Indonesia, the Philippines, Vietnam, and other Southeast Asian countries. The espionage campaign, which has also hit state-owned companies in the region, accelerated in the last half of 2019 and into the first quarter of 2020.
The New York Times reported on Thursday that tiny genetic mutations helped researchers track between 60% and 65% of new infections back to the outbreak in the country's biggest city.
"We now have enough data to feel pretty confident that New York was the primary gateway for the rest of the country," Nathan Grubagh, of the Yale School of Public Health, told the Times.
Grubagh said that introducing social-distancing guidelines earlier would have helped reduce the disease's spread.
(T)here is an opportunity in this Executive Order. The Secretary of Energy is authorized to create 'a criteria' for equipment to be pre-qualified. Even a very basic four point criteria to address insecure by design would be a big step forward, such as:
- signed firmware with secure boot
- encrypted and authenticated management protocols
- authenticated ICS protocols for control and monitoring
- eliminate all hard coded vendor backdoors (or special access features, ht: Ali Abbasi)
Those new to ICS may be shocked that only a small percentage of the systems available worldwide for purchase could meet these four criteria.
No comments:
Post a Comment