U.S. Cyber Agency, Others Warn Ukraine Crisis Could Lead to More Cyberattacks

U.S. organizations, including technology service providers that represent attractive targets to a threat actor, are being urged to implement cybersecurity protections against cyberattacks as the Ukraine crisis unfolds.

These warnings come from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as well as private sector cybersecurity software providers like Mandiant that have raised awareness of the possibility of large-scale cyberattacks from Moscow as the Ukraine situation unfolds.

CompTIA, an IT industry association that counts many managed service providers among its members, has also issued a warning to technology service providers, calling on them to take immediate steps to review and upgrade their cybersecurity defenses.

“While we do not have any information to indicate any specific threat, we believe that we all need to be in a significantly heightened state of alert,” says MJ Shoer, chief community officer for CompTIA and executive director of the CompTIA ISAO. “We urge technology companies to elevate the monitoring of their networks, as well as those of their customers and partners for any sign of suspicious activity.”

The organization calls on service providers to prepare for attacks on corporate/ networks, customer networks, networks of suppliers and partners, critical infrastructure and platforms used by individual citizens.

According to news reports, Russia has amassed over 100,000 troops near the Ukrainian border and could be preparing to invade its neighbor. While military action has yet to unfold, Ukraine has already suffered cyberattacks in recent weeks, including a malware campaign masquerading as ransomware and DDoS attacks that temporarily knocked some government and banking websites offline.

As high-level discussions between Russia and the west continue, cybersecurity experts say organizations should expect to see more cyberattacks.

In a blog post, Sandra Joyce, executive vice president and head of global intelligence at Mandiant, says Russia’s history of aggressive cyberattacks warrants concern. She cites Russia’s cyberattacks against Ukraine critical infrastructures and other attacks against Europe and the U.S.

If the West responds to an armed conflict with Ukraine, the risk of Russia conducting cyberattacks will increase, Joyce writes. These potential attacks may manifest as supply chain compromises designed to gain access to multiple network simultaneously, similar to the SolarWinds Orion compromise.

“Many of the same steps defenders might take to harden their networks against ransomware crime will serve to prepare them from a determined state actor, if they take them now,” Joyce writes.

Despite those potential threats, Joyce cautions against panic, saying that the real target of cyberattacks is our perceptions.

“The purpose of these cyberattacks is not simply to wipe hard drives or turn out the lights, but to frighten those who cannot help but notice,” Joyce writes. “The audience of these attacks is broad, but it is also empowered to determine how effective they are. While these incidents can be quite serious for many, we must remain mindful of their limitations. We only do the adversary a service by overestimating their reach.”

Meanwhile, cybersecurity giant CrowdStrike says in a blog that while cyberattacks against Russia’s adversaries during this crisis can’t be discounted, they are unlikely due to the potential for global escalation.

“However, the incidental targeting of international businesses operating within Ukraine may be used by Russian-nexus adversaries to dissuade business operations and investment and destabilize the local economy,” the company said.

In addition to Mandiant, CrowdStrike and several other high-profile cybersecurity providers advising customers to harden networks, CISA issued an advisory this week urging U.S. organizations to take steps now to harden its networks. The advisory includes several recommendations for preparing for a cyberattack and responding to one, as well as other CISA resources, including its catalog of known exploited vulnerabilities.

Here are CISA’s recommendations, in its entirety:

Reduce the likelihood of a damaging cyber intrusion

  • Validate that all remote access to the organization’s network and privileged or administrative access requires multi-factor authentication.
  • Ensure that software is up to date, prioritizing updates that address known exploited vulnerabilities identified by CISA.
  • Confirm that the organization’s IT personnel have disabled all ports and protocols that are not essential for business purposes.
  • If the organization is using cloud services, ensure that IT personnel have reviewed and implemented strong controls outlined in CISA’s guidance.
  • Sign up for CISA’s free cyber hygiene services, including vulnerability scanning, to help reduce exposure to threats.

Take steps to quickly detect a potential intrusion

  • Ensure that cybersecurity/IT personnel are focused on identifying and quickly assessing any unexpected or unusual network behavior. Enable logging in order to better investigate issues or events.
  • Confirm that the organization’s entire network is protected by antivirus/antimalware software and that signatures in these tools are updated.
  • If working with Ukrainian organizations, take extra care to monitor, inspect, and isolate traffic from those organizations; closely review access controls for that traffic.

Ensure that the organization is prepared to respond if an intrusion occurs

  • Designate a crisis-response team with main points of contact for a suspected cybersecurity incident and roles/responsibilities within the organization, including technology, communications, legal and business continuity.
  • Assure availability of key personnel; identify means to provide surge support for responding to an incident.
  • Conduct a tabletop exercise to ensure that all participants understand their roles during an incident.

Maximize the organization’s resilience to a destructive cyber incident

  • Test backup procedures to ensure that critical data can be rapidly restored if the organization is impacted by ransomware or a destructive cyberattack; ensure that backups are isolated from network connections.
  • If using industrial control systems or operational technology, conduct a test of manual controls to ensure that critical functions remain operable if the organization’s network is unavailable or untrusted.

This article originally appeared on SSI sister site MyTechDecisions where Zachary Comeau serves as Associate Editor.

The post U.S. Cyber Agency, Others Warn Ukraine Crisis Could Lead to More Cyberattacks appeared first on Security Sales & Integration.



from News Archives - Security Sales & Integration https://www.securitysales.com/emerging-tech/cybersecurity-tech/ukraine-crisis-more-cyberattacks/
via IFTTT

Comments

Post a Comment

Popular posts from this blog

Total Tech Summit Puts Call Out for Top Integrators to Apply Now

Image
FRAMINGHAM, Mass. — Total Tech Summit announces that applications are now being accepted to attend this year’s event. Comprised of the  SSI Summit, CE Pro Summit and Commercial Integrator Summit, this year’s event will take place in Las Vegas at the MGM Grand Hotel and Casino, Nov. 13-15. At this all-expense-paid, exclusive event, VIP guests will have the chance to sit in on industry-defining sessions, key boardroom presentations, and be able to meet one-on-one with potential vendors. Total Tech Summit brings together the best in class to share ideas, learn from others, and most importantly, accelerating the next stage of their businesses. It is the only event of its kind that bridges channels and connections by bringing together professional security, commercial AV and residential AV integrators. Another perk of the Total Tech Summit is the VIP Peer-to-Peer groups. These group conversations take place throughout the months leading up to the event and are guided by the edi...
Read more

Minnesota AG Calls for Cancellation of Home Security Contracts for Alleged Fraud

STEARNS COUNTY, Minn. — Bring Me the News reports that Minnesota’s Attorney General, Keith Ellison, says he’s gotten consumers in Stearns County out of home security contracts after they were misled by a door-to-door salesman. According to the report, Ellison’s office announced that home security companies Skyline Security Management and Safe Home Security have agreed to their cancel contracts with customers in and around Stearns County who purchased their systems from door-to-door salesman Gary Harvey. “Door-to-door salesmen and their employers are in the business of trust-building,” Ellison said in a statement. “They know they need to have your trust to sell you their products, particularly expensive products like security systems that are supposed to keep your home safe. When that trust is betrayed, it’s emotionally and financially painful. I appreciate Skyline and Safe Home taking the right step in canceling these contracts while my office does what we can under the law to ho...
Read more

Evolv Technology, Pittsburgh Pirates Team Up for Fan-Friendly Ballpark Security

Image
WALTHAM, Mass.—Evolv Technology has announced its partnership with Major League Baseball’s Pittsburgh Pirates, adding to the growing list of Pittsburgh, Pa. venues that have teamed up with Evolv to help keep people safe, including the Pittsburgh Cultural Trust and Acrisure Stadium, home of the Pittsburgh Steelers. When the Pirates opened the gates at PNC Park for the 2023 MLB season in early April, all attending fans passed through Evolv’s state-of-the-art Evolv Express screening solution, which uses sensor technology with artificial intelligence (AI) to provide safer, more accurate threat detection at unprecedented volume and speed, the company states. Fans can now walk through without always having to stop or open bags, reducing long lines and allowing guests to make their way directly into the ballpark. “What continues to make PNC Park so special, aside from the physical design, is the total fan experience. That begins from the moment they walk up to our gates,” said Travis Willi...
Read more