This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Adam Arellano, former vp, enterprise cybersecurity, PayPal
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Crowdstrike update goes wrong, Friday morning is canceled
A worldwide blue screen of death greeted Windows users and their CISOs this morning. Flights were canceled or delayed, banks could not complete transactions and even some 911 services became non- operational for a time. George Kurtz, CEO of Crowdstrike stated that “the problems were caused by a “defect” in a “content update” for Microsoft Windows devices. He added, “The issue has been identified, isolated and a fix has been deployed.”
The personal security implications of the AT&T breach
The phone carrier’s data breach, which was announced on Friday, contained records of the phone numbers that were called to or texted to by customers between May 1, 2022 and October 31, 2022. The stolen data does not include any content of calls or texts, nor their time or date. In some instances cell site information was stolen, which might assist threat actors to triangulate customers’ locations as well as the people they interacted with, through the numbers themselves. According to Rachel Tobac, a social engineering expert and founder of cybersecurity firm SocialProof Security, quoted in TechCrunch, this type of data, referred to as metadata, “makes it easier for cybercriminals to impersonate people you trust, making it easier for them to craft more believable social engineering or phishing attacks against AT&T customers.” She continues, “the attackers know exactly who you’re likely to pick up a call from, who you’re likely to text back, how long you communicate with that person, and even potentially where you were located during that conversation due to the metadata that was stolen.”
CDK Global reportedly pays $25M ransom following cyberattack
Following up on the story regarding CDK Global, the maker of specialized software for car dealerships, The Register reports that the company paid the $25 million ransom in bitcoin, to the group that runs BlackSuit ransomware. The consulting firm Anderson Economic Group suggests that the total financial damage to dealers in the first two weeks of the shutdown is just over $600 million, or 24 times the ransom. The problems for CDK and its customers are not yet over, with certain parts of the network still offline as restoration and rebuilding continues.
(The Register and Anderson Economic Group)
Thanks to today’s episode sponsor, Conveyor
A few reasons.
One. Market-leading AI accuracy
Two. They don’t have to maintain a crazy knowledge base anymore because ConveyorAI can read from any source like external support sites, documents, past questionnaires and more.
Three. It can process ANY customer file format – even PDFs! It will even auto-scroll and auto-complete portal-basedl questionnaires.
Don’t believe it? Try it yourself for free at www.conveyor.com.
Cloud security and PowerShell expertise emerge as key SOC analyst skills
According to a survey conducted by the SANS Institute, a series of hard skills have emerged as key to success of analysts working in enterprise security operations centers (SOCs). These include a knowledge of cloud security issues, PowerShell expertise, and the ability to automate repetitive tasks and systems management functions. The SANS survey polled 400 respondents from small, medium, and large companies globally. The responses showed that many SOCs continue to struggle with a lack of automation and orchestration of key functions, high-staffing requirements, a shortage of skilled staff, and a lack of visibility. They also reported a pervasive silo mentality among security, incident response, and operations teams. On the positive side, SOC analyst retention improved with 30% of respondents indicating the average tenure is between three and five years, compared to the one-to-three year tenures reported in previous SANS surveys.
Google introduces AI agent to look for software bugs
At its Google I/O Bengaluru developer conference, Google announced an open-source platform called Project Oscar that allows developers to create AI monitoring agents that can be used throughout the software development cycle. These agents interact through natural language. Google’s Go group project manager Cameron Balahan said it deployed Oscar on the programming language project. Project Oscar agents don’t write code but serve to enrich bug reports and interact with people reporting issues to clarify submissions. Google plans to deploy Project Oscar to its other open-source projects.
APT41 infiltrates global shipping and tech sectors
Researchers at Mandiant are warning of an uptick in malware attacks launched by Chinese nation state threat actor APT41, against organizations in shipping, logistics, technology, and automotive sectors in Europe and Asia. Most of the compromised organizations are based in the United Kingdom, Italy, Spain, Turkey, Taiwan, and Thailand, with Mandiant stating APT41 has been present in these organizations since at least 2023.