By Deeba Ahmed
Hackers are dusting off old tricks! A recent attack exploited vulnerabilities in systems running outdates Microsoft Office to deliver Cobalt Strike malware. Learn how to protect yourself!
This is a post from HackRead.com Read the original post: 7-Year-Old 0-Day in Microsoft Office Exploited to Drop Cobalt Strike

Cybersecurity firm Deep Instinct has discovered that attackers are using the Cobalt Strike loader to deploy old zero-day exploits, a relatively new trend. Let’s delve deeper into this.

Deep Instinct Threat Lab has discovered a targeted operation against Ukraine in which hackers are using an old zero-day vulnerability, CVE-2017-8570, as the initial vector and a custom loader for Cobalt Strike Beacon, a professional pen-testing tool designed for evaluating computer security by red teams. However, in this attack, hackers have used a cracked version with no legitimate user. 

They’ve exploited CVE-2017-8570, an old Microsoft Office vulnerability identified in 2017, to launch the Cobalt Strike Beacon, targeting Ukraine’s systems. They used a malicious PPSX (PowerPoint Slideshow) file disguised as an old US Army instruction manual for mine-clearing tank blades, bypassing traditional security measures and allowing them to hide the payload and complicate analysis. The file used a “script:” prefix before the HTTPS URL to hide the payload and complicate analysis. 

> _“The lure contained military-related content, suggesting it was targeting military personnel. But the domain names weavesilk(.)space and petapixel(.)fun are disguised as an obscure generative art site (weavesilk(.)com) and a popular photography site (petapixel(.)com). These are unrelated, and it’s a bit puzzling why an attacker would use these specifically to fool military personnel.”_
> 
> Deep Instinct

The use of the Cobalt Strike loader, a malicious, versatile toolset commonly employed in targeted attacks, suggests a sophisticated approach by the attackers. Cobalt Strike allows adversaries to deploy malware, steal data, and maintain persistence on compromised systems. In the context of Ukraine, it is used as a delivery mechanism for these zero-day exploits, maximizing their impact.

Deep Instinct’s research indicates that attackers are actively leveraging zero-day exploits, which are vulnerabilities unknown to security software vendors. This makes them particularly dangerous as traditional defences may not be able to detect and block them.

Researchers couldn’t attribute the attacks to any known threat actor or rule out the possibility of a red team exercise. Evidence indicates the sample was uploaded from Ukraine, the second stage was hosted under a Russian VPS provider, and the Cobalt beacon C&C was registered in Warsaw, Poland.

_“_Given the n-day exploitation trends against > 12-month-old edge device and email server CVEs we’ve seen over the past 4 years, seeing a threat actor exploit a Wine vulnerability from 2017 is weirdly refreshing,_“_ stated Casey Ellis, Founder and Chief Strategy Officer at Bugcrowd

_“_The use of undocumented low-level WinAPI calls is unusual as well. I can understand why threat analysts are having difficulty with attribution, it’s an esoteric and somewhat nerdy kill chain._“_ Casey explained.

“Aside from the technical pieces, the fact that it’s not Russia is noteworthy, and the TTPs suggest a previously unknown player. Cobalt Strike usage as a C2 is fairly commonplace and the key takeaway here is that old vulnerabilities in easily forgotten software still matter._“_

**How to Stay Safe?**

Deep Instinct’s research suggests that traditional security solutions may not be enough for zero-day exploits. Organizations should adopt advanced threat detection through behavioural analysis and machine learning. Vigilance is also crucial, especially for cyber threats targeting Ukraine, and a proactive defence strategy combining firewalls and antivirus software.

1.  APTs Exploiting WinRAR 0day Flaw Despite Patch Availability
2.  5 year old vulnerability used for Monero mining on Linux servers
3.  Protestware Uses npm Packages to Call for Peace in Gaza, Ukraine
4.  12-Year-Old vulnerability in Windows Defender risked 1 billion devices
5.  17-year-old “wormable” SigRed vulnerability found in Windows servers

7-Year-Old 0-Day in Microsoft Office Exploited to Drop Cobalt Strike

Our collection of the most relevant reporting and industry perspectives for those guiding cybersecurity strategies and focused on SecOps. Also included: security license mandates; a move to four-day remediation requirements; lessons on OWASP for LLMs.

Welcome to CISO Corner, Dark Reading's weekly digest of articles tailored specifically to security operations readers and security leaders. Every week, we'll offer articles gleaned from across our news operation, The Edge, DR Technology, DR Global, and our Commentary section. We're committed to bringing you a diverse set of perspectives to support the job of operationalizing cybersecurity strategies, for leaders at organizations of all shapes and sizes.

**In this issue of CISO Corner:**

*   Kindervag Says: 5 Hard Truths About the State of Cloud Security 2024
    
*   MITRE ATT&CKED: InfoSec's Most Trusted Name Falls to Ivanti Bugs
    
*   Lessons for CISOs From OWASP's LLM Top 10
    
*   Cyberattack Gold: SBOMs Offer an Easy Census of Vulnerable Software
    
*   Global: Licensed to Bill? Nations Mandate Certification & Licensure of Cybersecurity Pros
    
*   Johnson & Johnson Spin-Off CISO on Maximizing Cybersecurity
    
*   SolarWinds 2024: Where Do Cyber Disclosures Go From Here?
    

**5 Hard Truths About the State of Cloud Security 2024**

By Ericka Chickowski, Contributing Writer, Dark Reading

Dark Reading talks cloud security with John Kindervag, the godfather of zero trust.

Most organizations aren't working with fully mature cloud security practices, despite almost half of the breaches originating in the cloud and almost $4.1 million lost to cloud breaches in the past year.

That's a big problem, according to the godfather of zero trust security, John Kindervag, who conceptualized and popularized the zero-trust security model as an analyst at Forrester. He tells Dark Reading that there are some hard truths to face in order to turn things around.

1\. You don't become more secure just by going to the cloud: The cloud is not innately more secure than most on-premises environments: hyperscale cloud providers may be very good at protecting infrastructure, but the control and responsibility they have over their customers' security posture is very limited. And the shared responsibility model doesn't really work.

2\. Native security controls are hard to manage in a hybrid world: Quality is inconsistent when it comes to offering customers more control over their workloads, identities, and visibility, but security controls that can be managed across all the multiple clouds are elusive.

3\. Identity won't save your cloud: With so much emphasis placed on cloud identity management and disproportionate attention on the identity component in zero trust, it's important for organizations to understand that identity is only part of a well-balanced breakfast for zero trust in the cloud.

4\. Too many firms don't know what they're trying to protect: Each asset or system or process will carry its own unique risk, but organizations lack a clear idea of what is in the cloud or what connects to the cloud, let alone what needs protecting.

5\. Cloud-native development incentives are out of whack: Too many organizations simply do not have the right incentive structures for developers to bake in security as they go — and, in fact, many have perverse incentives that end up encouraging insecure practice. "I like to say that the DevOps app people are the Ricky Bobbys of IT. They just want to go fast," Kindervag says.

Read more: 5 Hard Truths About the State of Cloud Security 2024

Related: Zero Trust Takes Over: 63% of Orgs Implementing Globally

**MITRE ATT&CKED: InfoSec's Most Trusted Name Falls to Ivanti Bugs**

By Nate Nelson, Contributing Writer, Dark Reading

The irony is lost on few, as a nation-state threat actor used eight MITRE techniques to breach MITRE itself — including exploiting the Ivanti bugs that attackers have been swarming on for months.

Foreign nation-state hackers have used vulnerable Ivanti edge devices to gain three months' worth of "deep" access to one of MITRE Corp.'s unclassified networks.

MITRE, steward of the ubiquitous ATT&CK glossary of commonly known cyberattack techniques, previously went 15 years without a major incident. The streak snapped in January when, like so many other organizations, its Ivanti gateway devices were exploited.

The breach affected the Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified, collaborative network the organization uses for research, development, and prototyping. The extent of the NERVE damage (pun intended) is currently being assessed.

Whatever their goals were, the hackers had ample time to carry them out. Though the compromise occurred in January, MITRE was only able to detect it in April, leaving a quarter-year gap in between.

Read more: MITRE ATT&CKED: InfoSec's Most Trusted Name Falls to Ivanti Bugs

Related: Top MITRE ATT&CK Techniques & How to Defend Against Them

**Lessons for CISOs From OWASP's LLM Top 10**

Commentary by Kevin Bocek, Chief Innovation Officer, Venafi

It's time to start regulating LLMs to ensure they're accurately trained and ready to handle business deals that could affect the bottom line.

OWASP recently released its top 10 list for large language model (LLM) applications, so developers, designers, architects, and managers now have 10 areas to clearly focus on when it comes to security concerns.

Almost all of the top 10 LLM threats center around a compromise of authentication for the identities used in the models. The different attack methods run the gamut, affecting not only the identities of model inputs but also the identities of the models themselves, as well as their outputs and actions. This has a knock-on effect and calls for authentication in the code-signing and creating processes to halt the vulnerability at the source.

While more than half of the top 10 risks are ones that are essentially mitigated and calling for the kill switch for AI, companies will need to evaluate their options when deploying new LLMs. If the right tools are in place to authenticate the inputs and models, as well as the models' actions, companies will be better equipped to leverage the AI kill-switch idea and prevent further destruction.

Read more: Lessons for CISOs From OWASP's LLM Top 10

Related: Bugcrowd Announces Vulnerability Ratings for LLMs

**Cyberattack Gold: SBOMs Offer an Easy Census of Vulnerable Software**

By Rob Lemos, Contributing Writer, Dark Reading

Attackers will likely use software bills-of-material (SBOMs) for searching for software potentially vulnerable to specific software flaws.

Government and security-sensitive companies are increasingly requiring software makers to provide them with software bills of material (SBOMs) to address supply-chain risk — but this is creating a new category of worry.

In a nutshell: An attacker who determines what software a targeted company is running, can retrieve the associated SBOM and analyze the application's components for weaknesses, all without sending a single packet, says Larry Pesce, a director for product security research and analysis at software supply-chain security firm Finite State.

He's a former penetration tester of 20 years who plans to warn about the risk in a presentation on "Evil SBOMs" at the RSA Conference in May. He will show that SBOMs have enough information to allow attackers to search for specific CVEs in a database of SBOMs and find an application that is likely vulnerable. Even better for attackers, SBOMs will also list other components and utilities on the device that the attacker could use for "living off the land" post-compromise, he says.

Read more: Cyberattack Gold: SBOMs Offer an Easy Census of Vulnerable Software

Related: Southern Company Builds SBOM for Electric Power Substation

**Global: Licensed to Bill? Nations Mandate Certification & Licensure of Cybersecurity Pros**

By Robert Lemos, Contributing Writer, Dark Reading

Malaysia, Singapore, and Ghana are among the first countries to pass laws that require cybersecurity firms — and in some cases, individual consultants — to obtain licenses to do business, but concerns remain.

Malaysia has joined at least two other nations — Singapore and Ghana — in passing laws that require cybersecurity professionals or their firms to be certified and licensed to provide some cybersecurity services in their country.

While the legislation's mandates have yet to be determined, "this will likely apply to service providers that provide services to safeguard information and communications technology device of another person — \[for example\] penetration testing providers and security operation centers," according to Malaysia-based law firm Christopher & Lee Ong.

Asia-Pacific neighbor Singapore has already required the licensing of cybersecurity service providers (CSPs) for the past two years, and the West African nation of Ghana, which requires the licensing and the accreditation of cybersecurity professionals. More widely, governments such as the European Union have normalized cybersecurity certifications, while other agencies — such as the US state of New York — require certification and licenses for cybersecurity capabilities in specific industries.

However, some experts see potentially dangerous consequences from these moves.

Read more: Licensed to Bill? Nations Mandate Certification & Licensure of Cybersecurity Pros

Related: Singapore Sets High Bar in Cybersecurity Preparedness

**J&J Spin-Off CISO on Maximizing Cybersecurity**

By Karen D. Schwartz, Contributing Writer, Dark Reading

How the CISO of Kenvue, a consumer healthcare company spun out from Johnson & Johnson, combined tools and new ideas to build out the security program.

Johnson & Johnson's Mike Wagner helped shape the Fortune 100 company's security approach and security stack; now, he's the first CISO of J&J's year-old consumer healthcare spinoff, Kenvue, tasked with creating a streamlined and cost-effective architecture with maximum security.

This article breaks down the steps that Wagner and his team worked through, which include:

Define key roles: Architects and engineers to implement tools; identity and access management (IAM) experts to enable secure authentication; risk management leaders to align security with business priorities; security operations staff for incident response; and dedicated staff for each cyber function.

Embed machine learning and AI: Tasks include automating IAM; streamlining supplier vetting; behavioral analysis; and improving threat detection.

Choose which tools and processes to retain, and which to replace: While J&J's cybersecurity architecture is a patchwork of systems created by decades of acquisitions; tasks here included inventorying J&J's tools; mapping them to Kenvue's operating model; and identifying new needed capabilities.

Wagner says there is more to do. Next, he plans to lean into modern security strategies, including adoption of zero trust and enhancement of technical controls.

Read more: J&J Spin-Off CISO on Maximizing Cybersecurity

Related: A Peek into Visa's AI Tools Against Fraud

**SolarWinds 2024: Where Do Cyber Disclosures Go From Here?**

Commentary by Tom Tovar, CEO & Co-Creator, Appdome

Get updated advice on how, when, and where we should disclose cybersecurity incidents under the SEC's four-day rule after SolarWinds, and join the call to revamp the rule to remediate first.

In a post-SolarWinds world, we should move to a remediation safe harbor for cybersecurity risks and incidents. Specifically, if any company remediates the deficiencies or attack within the four-day time frame, it should be able to (a) avoid a fraud claim (i.e., nothing to talk about) or (b) use the standard 10Q and 10K process, including the Management Discussion and Analysis section, to disclose the incident.

On Oct. 30, the SEC filed a fraud complaint against SolarWinds and its chief information security officer, alleging that even though SolarWinds employees and executives knew about the increasing risks, vulnerabilities, and attacks against SolarWinds' products over time, "SolarWinds' cybersecurity risk disclosures did not disclose them in any way."

To help prevent liability issues in these situations, a remediation safe harbor would allow companies a full four-day time frame to evaluate and respond to an incident. Then, if remediated, take the time to disclose the incident properly. The result is more emphasis on cyber response and less impact to a company’s public stock. 8Ks could still be used for unresolved cybersecurity incidents.

Read more: SolarWinds 2024: Where Do Cyber Disclosures Go From Here?

Related: What SolarWinds Means for DevSecOps

CISO Corner: Evil SBOMs; Zero-Trust Pioneer Slams Cloud Security; MITRE's Ivanti Issue

The targeted operation utilized CVE-2017-8570 as the initial vector and employed a notable custom loader for Cobalt Strike, yet attribution to any known threat actor remains elusive.

Source: Yuriy Tuchkov via Alamy Stock Photo

An unknown threat actor targeted government entities in Ukraine toward the end of 2023 using an old Microsoft Office remote code execution (RCE) exploit from 2017 (CVE-2017-8570) as the initial vector and military vehicles as the lure.

The threat actor initiated the attack using a malicious PowerPoint file (.PPSX) sent as an attachment through a message on secure messaging platform Signal. This file, which masqueraded as an old instruction manual by the US Army for mine-clearing blades for tanks, had in fact a remote relationship to an external script hosted on a Russian virtual private server (VPS) provider domain protected by Cloudflare.

The script executed the CVE-2017-8570 exploit to achieve RCE, according to a Deep Instinct blog post on the attack this week, in an effort to steal information.

**Underneath the Hood of a Tricky Cyberattack**

In terms of the technical nitty-gritty, the obfuscated script masqueraded as Cisco AnyConnect APN configuration and was responsible for setting persistency, decoding, and saving the embedded payload to disk, which happened in several stages to evade detection.

The payload includes a loader/packer dynamic link library (DLL) named "vpn.sessings" that loads a Cobalt Strike Beacon into memory and awaits instructions from the command-and-control (C2)  server of the attacker.

Mark Vaitzman, threat lab team leader at Deep Instinct, notes that the penetration testing tool Cobalt Strike is very commonly used among threat actors, but this particular beacon makes use of a custom loader that relies on several techniques that slow down analysis.

"It is continuously updated to provide attackers with a simple way to move laterally once the initial footprint is set," he says. "\[And\] it was implemented in several anti-analysis and unique evasion techniques."

Vaitzman notes that in 2022, a severe CVE allowing RCE was found in Cobalt Strike — and many researchers predicted that threat actors would alter the tool to create open source alternatives.

"Several cracked versions can be found on underground hacking forums," he says.

Beyond the tweaked version of Cobalt Strike, he says, the campaign is also notable for the lengths to which the threat actors continuously attempt to masquerade their files and activity as a legitimate, routine OS and common applications operations, to remain hidden and maintain the control of infected machines as long as possible. In this campaign, he says, the attackers took this "living off the land" strategy further.

"This attack campaign shows several masquerading techniques and a smart way of persistence that has not been documented yet," he explains, without divulging details.

**Cyberthreat Group Has Unknown Make & Model**

Ukraine has been targeted by multiple threat actors on multiple occasions during its war with Russia, with the Sandworm Group serving as the aggressor's primary cyberattack unit.

But unlike in most attack campaigns during the war, the threat lab team couldn’t link this effort to any known threat group, which may indicate that this is the work of a new group or representative of a fully upgraded tool set of a known threat actor.

Mayuresh Dani, manager of security research at Qualys Threat Research Unit, points out the use of geographically disparate sources to help the threat actors dispel attribution also make it difficult for security teams to provide targeted protection based on geographical locations.

"The sample was uploaded from Ukraine, the second stage was hosted and registered under a Russian VPS provider, and the Cobalt beacon \[C2\] was registered in Warsaw, Poland," he explains.

He says that what he found most interesting about the chain of attack was that the initial compromise was accomplished via the secure Signal app.

"The Signal messenger has been largely used by security-focused personnel or those who are involved in sharing clandestine information, such as journalists," he notes.

**Beef Up Cyber Armor With Security Awareness, Patch Management**

Vaitzman says that because most of cyberattacks start with phishing or link-luring via emails or messages, broader employee cyber awareness plays an important role in mitigating such attack attempts.

And for security teams, "We also recommend scanning for the provided IoCs in the network, as well as making sure that Office is patched to the latest version," Vaitzman says.

Callie Guenther, senior manager of cyber threat research at Critical Start, says that from a defense perspective, the reliance on older exploits also stresses the importance of robust patch management systems.

"Additionally, the sophistication of the attack underscores the need for advanced detection mechanisms that go beyond signature-based cyber-defense approaches," she says, "incorporating behavior and anomaly detection to identify modified malicious software."

**About the Author(s)**

Nathan Eddy is a freelance journalist and award-winning documentary filmmaker specializing in IT security, autonomous vehicle technology, customer experience technology, and architecture and urban planning. A graduate of Northwestern University’s Medill School of Journalism, Nathan currently lives in Berlin, Germany.

Military Tank Manual, 2017 Zero-Day Anchor Latest Ukraine Cyberattack

By Waqas
In 2024, integrated residential security solutions are vital for comprehensive protection against evolving threats, safeguarding homes and families with advanced technology and seamless connectivity.
This is a post from HackRead.com Read the original post: Integrated Residential Security Solutions to Employ in 2024

As we progress through 2024, home security is rapidly advancing, with a notable shift towards integrated residential security solutions. These systems are the cornerstone of keeping your living space safe, using cutting-edge Internet of Things (IoT) technologies to provide comprehensive protection. 

Your home can now be outfitted with a suite of smart security devices, ranging from intelligent alarms to automated surveillance cameras, all working in unison to offer round-the-clock monitoring and real-time alerts.

With the increase in smart home devices, your home’s network faces many cyber threats. Robust firewalls, encrypted Wi-Fi systems, and consistent software updates are essential to safeguard your domain from potential digital breaches. 

Image: Hackread.com

Embracing these sophisticated security systems empowers you to create a safer and smarter home environment. Whether through enhanced connectivity that allows for seamless control over your security devices or via improved sensors that detect the slightest anomalies, your home security is now more reliable and intuitive. 

****Evolving Technologies in Home Security****

You’ll find now more than ever that your home’s defense is revolutionized by smart technologies that adapt and learn. These innovations are not only enhancing security but also ensuring seamless compatibility with your digital lifestyle.

****Artificial Intelligence and Machine Learning****

To keep your home safe, Artificial Intelligence and machine learning are no longer just buzzwords—they are crucial components that drive modern security systems. 

Large-scale AI models in residential security mean your system can now accurately detect potential threats by distinguishing between normal and suspicious behaviors. This intelligence layer allows for proactive measures, significantly minimizing false alarms that were once a common nuisance.

****IoT and Smart Device Integration****

The intersection of IoT and home security forms a network of smart devices working in concert to safeguard your premises. 

Your security setup extends beyond traditional alarms, incorporating smart locks, cameras, and lighting to create a responsive environment. Integration with IoT devices ensures your home responds intuitively to various scenarios, such as adjusting lights and lock settings as you arrive or depart.

****Cloud and Edge Computing****

Your security system’s efficiency and scalability are vastly improved thanks to cloud computing, which provides reliable data storage and remote access to your system. Meanwhile, edge computing takes processing closer to the data source—your home’s security devices. 

This means faster responses to security triggers and less reliance on bandwidth, as data can be processed locally. The harmonious combination of cloud and edge computing improves reliability and streamlines the management of your home security infrastructure.

****Enhanced Surveillance and Monitoring Solutions****

State-of-the-art surveillance technology is key to ensuring the safety of residential spaces. These systems leverage advanced sensors and artificial intelligence to provide real-time alerts and high-quality video imaging, transforming traditional security measures.

****Advanced Camera Technologies****

Modern security cameras come equipped with intelligent noise reduction and superior imaging capabilities. 

This ensures you receive clear videos, reducing false alarms due to poor image quality. Enhanced low-light performance is now a standard feature, providing better surveillance, even in dim conditions.

****AI-Driven Surveillance****

Surveillance systems have grown smarter, incorporating AI technology to analyze video feeds in real time. This means your cameras can distinguish between routine movements and potential security threats, allowing for accurate alarms and alerts. 

AI-driven multi-family residential security camera solutions can aid in recognizing suspicious activities quickly, bolstering the security of private residences.

****Real-Time Monitoring and Alerts****

Your security solution can offer real-time monitoring, with the ability to automatically notify you or dispatch personnel when an incident occurs. 

Cameras and remote monitoring services provide constant vigilance for your property. Should an incident occur, you will be immediately informed with a detailed alert, enabling swift response and ensuring your peace of mind.

****Security Systems Implementation****

When choosing the optimal security system for your home, it’s essential to understand the installation process, recognize the significance of digital identity and authentication, and ensure the solution is tailored to meet your specific needs.

****Professional vs. DIY Installation****

The decision between professional installation and DIY solutions depends largely on your comfort level with technology and specific security needs. 

With professional installation, you’re guaranteed expert setup and continued professional monitoring. 

On the other hand, DIY installation provides a more hands-on approach and may be cost-effective if you have technical proficiency.

****Digital Identity and Authentication****

Incorporating digital identity and authentication into your residential security system adds a robust layer of protection. Reflecting on FTX’s downfall, it’s evident how vital stringent security measures are in any technology-dependent system, preventing unauthorized access and ensuring the integrity of sensitive information. 

Such systems usually involve biometric scanners or advanced code encryption, providing a more personalized and secure method for access control.

****Customization for Specific Needs****

Your home’s security system should be as unique as your household’s. Customization can range from selecting cameras with advanced motion detection to installing smart locks that integrate with your entire home automation system. Identify your specific needs to determine the features that will best secure your residence.

****Innovative Access Control Systems****

Innovative access control systems have evolved to offer not only enhanced security but also user convenience and system efficiency. 

From unlocking doors with a simple facial scan to managing access rights via sophisticated digital models, these systems are transforming residential security.

****Biometric and Facial Recognition****

Biometric security systems utilize your unique physical characteristics to ensure that only authorized individuals can access your home. 

Facial recognition technology, an integral part of this security approach, provides a touchless, fast, and secure method to manage entry. The security industry has embraced this technology for its ability to combine convenience with robust security.

****Smart Lock Technologies****

Smart locks represent a revolutionary step in home security, offering you the ability to control and monitor your door locks remotely. 

Characterized by home Wi-Fi connectivity or Bluetooth, these locks can integrate with your smart home systems, allowing real-time alerts and remote access management. They contribute significantly to your security and sustainability by reducing the need for physical keys and waste.

****Digital Twin Access Management****

The application of digital twin technology in access control refers to a virtual representation of your physical security system. You can visualize and manage the flow of people within your home in a secure digital environment. 

By layering this technology onto access point systems (APS), you gain a comprehensive view that enhances financial security and physical safety. Digital twins in security may also integrate with blockchain technology, offering a decentralized approach that can bolster security protocols.

****Conclusion****

With enhanced connectivity and smarter algorithms, your home security system in 2024 integrates flawlessly across devices. Your standard video systems are upgraded to advanced sensors and high-definition video capabilities, providing you with crisp imagery and precise detection of events.

Cybersecurity is no longer an afterthought in your connected home. Employing strong firewalls, encrypted Wi-Fi systems, and consistent software updates will help safeguard your digital assets on top of the physical ones. Moreover, cloud technology brings a new layer of convenience and efficiency. Your security feeds, storage, and real-time alerts are accessible anytime, anywhere, providing a seamless user experience.

By incorporating these integrated security solutions, your home remains a sanctuary, fortified against potential threats and giving you the peace of mind you deserve.

1.  The Pros and Cons of Smart Homes
2.  NDR in the Modern Cybersecurity Landscape
3.  Top 3 Cybersecurity Tools to Protect Business Data
4.  Cybersecurity for Startups: Best Tips and Strategies
5.  IT and Cybersecurity Jobs in the Age of Emerging AI Tech

Integrated Residential Security Solutions to Employ in 2024

Caliptra 1.0 offers a blueprint for integrating security features directly into microprocessors.

Source: Alexmillos via Alamy Stock Vector

A consortium of top chip makers have finalized the first version of Caliptra, a specification to add zero-trust security features directly inside silicon.

The Caliptra 1.0 specification has hardware and software blocks providing multiple protection layers for encrypted data on chips.

"We believe Caliptra is a foundational aspect to the future of confidential computing and couldn't be more excited to reach our 1.0 milestone," says Andrés Lagar-Cavilla, a distinguished engineer at Google. Caliptra is currently being integrated by companies across the ecosystem into chips that will start to appear in the market in 2026.

Security-focused hardware exists, but usually as separate components on the hardware. At the moment, chips typically access security features that are available as separate hardware components on the motherboard. The Caliptra specification provides a blueprint to embed the security features into the chip instead of accessing those hardware cores.

For example, the Trusted Platform Module (TPM), which is required on all machines running Windows 11, is a secure processor carrying out cryptographic functions, such as Windows Hello authentication and BitLocker drive encryption. Caliptra could make possible an on-silicon version of TPM.

The specification was built around the concept of confidential computing, an emerging technology focused on building walls to protect data and programs during storage, transport, and execution. Users and code are verified before being allowed to enter the secure area, after which they can run programs.

**Caliptra-Spec Chips on the Way?**

The Caliptra specification aims to fend off cyberattacks and protect from vulnerabilities, such as Meltdown and Spectre, which exposed confidential user data to hackers.

Caliptra's protection layers on silicon include a root-of-trust block, in which code, users, and firmware are isolated, verified, and authenticated. The spec extends to protecting firmware and ROMs. The root-of-trust layer also detects and recovers data that may be corrupted.

The specification is now available for tape-in, which means it is also ready for testing for chips that may be going into production. Google's Lagar-Cavilla says the company is actively integrating Caliptra in first-party silicon designs and collaborating with suppliers to ensure their system-on-chips — across CPUs, GPUs, DPUs, BMCs, SSDs, and more — include Caliptra.

Caliptra is an open source technology, so chip makers can adopt and modify it for free.

A company called Antmicro is developing a Caliptra-based security core for an emerging chip architecture called RISC-V. The technology is an alternative to the dominant x86 and ARM instruction set architectures. RISC-V has a modular design that makes it easier to include technologies like Caliptra in production-level silicon.

Google is a lead developer of Caliptra, working alongside Advanced Micro Devices, Microsoft, Marvell, and NVIDIA. The Linux Foundation's CHIPS Alliance is managing the development of the specification.

Intel is one of the big names in chips missing from the group of companies developing Caliptra. Intel is pushing its own on-chip security technology to protect user data and chips from hackers.

**About the Author(s)**

Agam Shah has covered enterprise IT for more than a decade. Outside of machine learning, hardware, and chips, he's also interested in martial arts and Russia.

Chip Giants Finalize Specs Baking Security Into Silicon

Cyberattacks on logistics are becoming increasingly common, and the potential impact is enormous.

Chahak Mittal, Cybersecurity GRC Manager, Universal Logistics Holdings, Inc.

April 25, 2024

5 Min Read

Source: Rawf8 via Alamy Stock Photo

COMMENTARY

Imagine you're standing in a bustling city, surrounded by the symphony of commerce. The exchange of goods and the flow of transportation are all around you. This is the heartbeat of our global economy. But what would happen if this heartbeat were to be disrupted? If the very lifeblood of our interconnected world were to falter — or worse, come to a grinding halt?

The consequences would be catastrophic. Imagine empty shelves in grocery stores, gas stations running out of fuel, and hospitals unable to get the supplies they need. Imagine widespread panic and social unrest.

This is not just a hypothetical scenario. It's a real threat we need to take seriously. Cyberattacks on logistics are becoming increasingly common, and the potential impact is enormous. Logistics is the backbone of our global economy. It's the process that keeps the world's shelves stocked and the wheels of commerce turning.

**Cyberattacks on Logistics May Have Severe Ramifications**

Let's first discuss why cyberattacks on logistics are so concerning.

Remember back to the haunting early days of the pandemic. Lockdown measures paralyzed entire nations, factories fell silent, and transportation came to a grinding halt. The repercussions were profound, as essential goods faced severe delays, and shortages left many in dire straits. The fabric of our interconnected world was put to the test, and the challenges were immense.

Four years later, we see news headlines about cyberattacks on Ukraine's logistics and its global impact. Think for a moment about the unimaginable consequences if a cyberattack were to disrupt logistics on a larger scale than COVID-19 or even exceed its impact.

It is unsettling that a nation could be brought to its knees not by an army or weapons but by code on a computer. This prospect cannot be ignored, especially given that the transport and logistics industry is undergoing a digital transformation.

Companies are increasingly using digitalization tools to streamline all processes, from warehouse inventory management to vehicle tracking. This is a good thing, of course. Digitalization can help to improve efficiency, reduce costs, and improve customer service. But there is a dark side to digitalization. The more digitized a company is, the more vulnerable it is to cyberattacks.

**An Expanded Battlefield**

Let's now delve into the second part of our journey: understanding how cyberattacks on logistics can be weaponized. Throughout history, proper logistics have always been the secret weapon behind any victorious endeavor, whether in war or other ventures. From the days of the Civil War, where horses, mules, and wagons provided armies the food, equipment, and ammunition they needed, to the modern era with colossal military operations with intricate supply chains, logistics have always been the beating heart of success.

Now the battlefield has expanded into the digital realm. The logistics that have propelled economies and nations forward are now vulnerable to a new kind of adversary –— one that wields not swords and shields, but lines of code and malicious intent.

But let's go even deeper. What if these cyberattacks on logistics were not just the work of lone hackers seeking chaos? What if they were orchestrated by state actors with strategic intent? The Russia-Ukraine conflict has demonstrated the potential of such scenarios. The cyber offensive aimed at Ukraine reached far beyond its borders, affecting global supply chains and sending shockwaves through economies. 

In this ever-evolving digital landscape, a new kind of arsenal is being amassed in the shadows: stockpiled zero-day vulnerabilities. Just as nations once accumulated weapons to safeguard their sovereignty, they now amass vulnerabilities as digital ammunition. These zero-day vulnerabilities, arcane exploits unknown even to software creators, have become potent tools of cyber warfare.

Imagine the power of a nation armed with a stockpile of these vulnerabilities. It can strike silently, crippling logistical infrastructures without firing a single shot. This reality becomes more tangible as each day passes. The Russia-Ukraine conflict showcases this new arsenal's alarming potential, serving as a reminder that our reliance on interconnected logistics is both a strength and a vulnerability.

**Fortifying Our Defenses**

So, where do we go from here? How can we fortify our logistical arteries against these emerging threats? Just as the strength of a nation's military once depended on its ability to ensure a steady flow of supplies to the frontlines, today's battles are won by safeguarding the flow of data, goods, and services.

The lessons of history remain relevant — a robust logistics network is not only essential for prosperity, but it is also a fundamental pillar of security. We must invest in cyber-defense strategies that mirror the importance we place on physical defense. Collaboration between governments, industries, and international partners is paramount. The private sector, too, holds a pivotal role.

As we embrace digitalization, we must do so with cybersecurity at the forefront. Companies must not only prioritize efficiency but also fortify their digital infrastructure against potential attacks. 

Strong alliances, collaborative diplomacy, and international cooperation are essential to our defense strategy. Just as alliances between nations bolster our military might, alliances between industries and governments can fortify cybersecurity. By harnessing the power of cyber and soft power in harmony, we can navigate the intricate dance of modern warfare.

The time to act is now. We stand at a crossroads where the path of progress intersects with the shadows of uncertainty. The interconnectedness that has fueled our global economy is also its Achilles' heel. Cyberattacks on logistics are not a distant possibility; they are a sobering reality.

The disruption of our supply chains, the paralysis of our economies — these are the stakes we face. But history has shown us that challenges can become catalysts for innovation. We can forge a new paradigm, one where technology and diplomacy converge to safeguard our way of life.

It is a future where alliances are not just forged on battlefields, but in virtual boardrooms and digital summits, and where the strength of a nation's cybersecurity is as integral to its defense strategy as its military might.

**About the Author(s)**

Cybersecurity GRC Manager, Universal Logistics Holdings, Inc.

Chahak Mittal is a Certified Information Systems Security Professional (CISSP) and Cybersecurity Governance, Risk, and Compliance Manager at Universal Logistics. She is a cybersecurity leader deeply committed to knowledge sharing and community engagement. Through her roles as a Judge at Globee Awards, Major League Hacking (MLH) Hackathons, and as a dedicated cybersecurity instructor volunteer in the Microsoft TEALS Program, she has actively contributed to the cybersecurity ecosystem. Chahak's active involvement in organizations such as the Information Systems Security Association and SecureWorld's Detroit Advisory Council has been instrumental in her pursuit of staying at the forefront of industry trends and challenges. Furthermore, she has channeled her insights into thought-provoking cybersecurity articles, published on SecureWorld.io, ISC2, and CyberDefense Magazine, making a meaningful contribution to the field's intellectual discourse.

Digital Blitzkrieg: Unveiling Cyber-Logistics Warfare

How the CISO of Kenvue, a consumer healthcare company spun out from Johnson & Johnson, combined tools and new ideas to build out the security program.

Source: Timon Schneider via Alamy Stock Photo

As a longtime information security professional at Johnson & Johnson, Mike Wagner helped shape the Fortune 100 company's security approach and security stack. Wagner recently became the first CISO of Kenvue, J&J's year-old spin-off, which was previously J&J's consumer healthcare division. In his new role, Wagner aims to combine the best of J&J with an efficient and modern approach that fits the new standalone company.

"We wanted to create a streamlined and cost-effective architecture with maximum security," Wagner explains.

The first step was defining key roles required to build an effective security program. That included architects and engineers to implement tools, identity and access management (IAM) experts to enable secure authentication, risk management leaders to align security with business priorities, security operations staff for incident response, and dedicated staff for each cyber function.

To ensure maximum effectiveness and future scalability for the cyber architecture, the newly created cyber team knew it wanted to embed machine learning and artificial intelligence (AI). That included automating IAM, streamlining supplier assessments through automated questionnaires, implementing AI for behavioral analysis, and using machine learning to improve threat detection.

**Deciding Which Cyber Tools to Keep or Replace**

With the basics ironed out, the next step was choosing which tools and processes should be retained from J&J and which should be replaced. While J&J's cybersecurity architecture was solid, it was a patchwork of systems created by decades of acquisitions.

To make their determinations, Wagner's team first inventoried J&J's tools, mapping them to Kenvue's operating model and choosing the ones with capabilities Kenvue would need. In many cases, the team found that J&J's security tools were more full-featured than the smaller spin-off needed. In other cases, J&J's technology was duplicative. In still others, existing J&J technology wasn't affordable or didn't provide the maximum security footprint for Kenvue's mission.

And, sometimes, it simply came down to how well-integrated J&J's security architecture was.

"Take something like endpoint detection and response," Wagner says. "Where J&J may have had two to three pieces of software on the endpoint to accomplish that mission due to different acquisitions over time, we consolidated it into one more modern solution."

The ultimate decision for each type of security function also depended on the number and types of dependencies. For example, applications tend to be dependent on IAM, which meant that for the time being, Kenvue is going to stick with J&J's IAM systems. Over time, though, Wagner plans to migrate to a more modern IAM system.

In the end, Kenvue chose to adopt about half of its tech stack from J&J.

Choosing what to retain and what to replace can be tricky, notes Scott Crawford, research director for the 451 Research Information Security channel with S&P Global Market Intelligence. Typically, though, it comes down to weighing the tool's functionality and how well it will fit into the new company's architecture against other options that might be a better fit. In some cases, new investments may be required, while in others, subscription or licensing terms will have to be determined as part of spin-off costs, he says.

**The Right People, Working Together**

Another challenge Wagner faced was assembling the right combination of expertise for his cyber team. After evaluating the capabilities of existing J&J employees along with external candidates, he chose a combination of former J&J employees with deep business knowledge and new hires with modern technical and cyber skills. They included architects and engineers to implement defense controls, IAM experts, risk management leaders, and SecOps staff.

Wagner also chose to add one other type of personnel to his team: business information security officers (BISO), who act as intermediaries between the cyber organization and different business units. Wagner says that the BISO role is critical to his team's success.

"They focus on scouting what's new, the direction it's going, and how we can make sure the business is going about it securely," he explains.

With the tools and team in place, the final challenge was maintaining security for both J&J and Kenvue during the transition. It required constant communication among different functions, with daily meetings that included J&J leaders, Kenvue leaders, and suppliers to ensure that everything went smoothly.

With the foundation in place, Kenvue's security team is operating steadily, but Wagner says there is more to do. Next, he plans to lean into modern security strategies, including adoption of zero trust and enhancement of technical controls.

Continuing to improve cybersecurity programs is critical to helping ensure scalability and adaptability over the long term, Crawford says. That means making greater use of automation to handle overwhelming volumes of data at speed and scale.

"Automation will have to become even more trusted to handle problems at the scale and level of detail," he said. "Forward-thinking CISOs are, without doubt, looking at these opportunities seriously."

**About the Author(s)**

Contributing Writer, Dark Reading

Karen D. Schwartz is a technology and business writer with more than 20 years of experience. She has written on a broad range of technology topics for publications including ITProToday, CIO, InformationWeek, GCN, FCW, FedTech, BizTech, eWeek, and Government Executive.

J&amp;J Spin-Off CISO on Maximizing Cybersecurity

Red Hat Security Advisory 2024-2042-03 - An update for tigervnc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2042.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: tigervnc security updateAdvisory ID:        RHSA-2024:2042-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2042Issue date:         2024-04-24Revision:           03CVE Names:          CVE-2024-31080====================================================================Summary: An update for tigervnc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.Security Fix(es):* xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080)* xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081)* xorg-x11-server: User-after-free in ProcRenderAddGlyphs (CVE-2024-31083)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-31080References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2271997https://bugzilla.redhat.com/show_bug.cgi?id=2271998https://bugzilla.redhat.com/show_bug.cgi?id=2272000

Red Hat Security Advisory 2024-2042-03

Red Hat Security Advisory 2024-2041-03 - An update for tigervnc is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2041.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: tigervnc security updateAdvisory ID:        RHSA-2024:2041-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2041Issue date:         2024-04-24Revision:           03CVE Names:          CVE-2024-31080====================================================================Summary: An update for tigervnc is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.Security Fix(es):* xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080)* xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081)* xorg-x11-server: User-after-free in ProcRenderAddGlyphs (CVE-2024-31083)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-31080References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2271997https://bugzilla.redhat.com/show_bug.cgi?id=2271998https://bugzilla.redhat.com/show_bug.cgi?id=2272000

Red Hat Security Advisory 2024-2041-03

Red Hat Security Advisory 2024-2040-03 - An update for tigervnc is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2040.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: tigervnc security updateAdvisory ID:        RHSA-2024:2040-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2040Issue date:         2024-04-24Revision:           03CVE Names:          CVE-2024-31080====================================================================Summary: An update for tigervnc is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.Security Fix(es):* xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080)* xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081)* xorg-x11-server: User-after-free in ProcRenderAddGlyphs (CVE-2024-31083)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-31080References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2271997https://bugzilla.redhat.com/show_bug.cgi?id=2271998https://bugzilla.redhat.com/show_bug.cgi?id=2272000

Tag

#mac