A panel of experts discussed practical strategies to implement security on a budget

Read More

Kaseya, a maker of IT service and security management software, announced Thursday that it had finalized its $6.2 billion acquisition of cybersecurity company Datto, promising tight integration between the two companies’ products and lower pricing for customers.

The deal’s closure marks the third high-profile acquisition for Kaseya in the past 18 months, as the company acquired security threat response company Infocyte in January, and threat detection company BitDam in March 2021. A total of 12 acquisitions have been completed by Kaseya under CEO Fred Voccola.

The company’s public messaging about the Datto deal emphasized impending price cuts—an average of 10% across the board, according to Kaseya. Some products are expected to remain at the same price point, while others will drop significantly more, Kaseya said. Datto will continue to operate as an independent brand, Kaseya added.

To read this article in full, please click here

Read More

Cisco has issued alerts for a vulnerability found in its email security and web management products that could allow an authenticated remote actor to retrieve sensitive information from an affected device.

An advisory issued by Cisco this week outlined that the vulnerability—detected in the web management interface of Cisco Secure Email and Web Manager, known formerly as Cisco Security Management Appliance (CSMA), and Cisco Email Security Appliance (ESA)—allows an authenticated actor to extract sensitive information through a Lightweight Directory Access Protocol (LDAP) server connected to the affected device.

This vulnerability is due to a design oversight in the querying process, according to Cisco. LDAP is an external authentication protocol for accessing and maintaining distributed directory information services on the public internet or corporate intranet.

To read this article in full, please click here

Read More

Securing end points is just one challenge facing firms in the legal sector

Read More

Securing endpoints is just one challenge facing firms in the legal sector

Read More

Ian Hill hosted a roundtable discussion on disinformation warfare

Read More

OT:ICEFALL Research from Forescout Explores Insecure-by-Design State of Operational Technology

The latest research from Forescout’s Vedere Labs explores the state of risk management in operational technology through the lens of 56 insecure-by-design vulnerabilities.

Background

On June 20, Forescout’s Vedere Labs published their latest research findings into operational technology (OT) vulnerabilities titled OT:ICEFALL. This group has been examining vulnerabilities affecting OT security for a few years now and has produced notable findings including: NUCLEUS:13, NAME:WRECK, NUMBER:JACK and AMNESIA:33.

OT:ICEFALL sought to analyze and understand the prevalence and impact of insecure-by-design vulnerabilities in OT products. The researchers took a systemic look at OT risk management. The research notes that many factors complicate OT risk management including the certification of vulnerable products, lack of CVE assignment and supply chains propagating vulnerabilities. In the course of this research, Forescout also disclosed 56 vulnerabilities across nine vendor’s products. A tenth vendor is also affected by four vulnerabilities, but they are still going through the disclosure process.

Analysis

The 56 vulnerabilities are all tied to “insecure-by-design” flaws common in the OT space within the following products:

These vulnerabilities can be grouped into four categories:

Insecure engineering protocols
Weak cryptography or broken authentication schemes
Insecure firmware updates
Remote code execution via native functionality

In a worst case scenario, an attacker with network access to a vulnerable device could exploit some of these flaws to “remotely execute code, change the logic, files or firmware of OT devices, bypass authentication, compromise credentials, cause denials of service or have a variety of operational impacts.” According to Forescout, 35% of the 56 vulnerabilities disclosed could allow for firmware manipulation or remote code execution.

This research harkens back to past industrial attacks, like Industroyer and TRITON, that relied on similar insecure-by-design flaws in their targeted OT environments. It also traces its history to Project Basecamp, an effort by Digital Bonds in 2017 to “highlight and demonstrate the fragility and insecurity of most [supervisory control and data acquisition] SCADA and [distributed control system] DCS field devices.”

Proof of concept

There are no proofs-of-concept available for any of the 56 vulnerabilities disclosed. Because “many of [these vulnerabilities] will remain unpatched in production environments for a significant amount of time,” Forescout did not release any technical details of the individual vulnerabilities discovered through the course of its research.

Vendor response

Forescout does not provide specific details on whether or when any of the vendors will be patching these vulnerabilities. Organizations should monitor for vendor advisories from all of their OT providers.

The Cybersecurity and Information Security Agency has also published an advisory for OT:ICEFALL, along with five Industrial Controls Systems Advisories for some of the affected products. Yokogawa has also issued an advisory for the vulnerabilities in its STARDOM product.

Solution

The best defense for these vulnerabilities at this time is to ensure OT best practices are being followed.

Assess systems for vulnerable devices
Segment vulnerable devices, particularly from the internet
Use secure methods for remote access when that access is necessary to operations
Keep up to date on patches from vendors and establish remediation practices
Develop network monitoring rules to block or alert for anomalous traffic

Identifying affected systems

Tenable Research has developed plugins to identify devices that may be vulnerable to the OT:ICEFALL related flaws:

500655 – Saia Burgess OT:ICEFALL Multiple Potential Vulnerabilities
500656 – Honeywell OT:ICEFALL Multiple Potential Vulnerabilities
500657 – Omron OT:ICEFALL Multiple Potential Vulnerabilities
500658 – Emerson OT:ICEFALL Multiple Potential Vulnerabilities

Get more information

Full OT:ICEFALL Report
CISA Releases Security Advisories Related to OT:ICEFALL (Insecure by Design) Report

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More