U.S. Govt. Hackers Ready to Hit Back If Russia Tries to Disrupt Election

We are a few days away from the 2016 U.S. Presidential election. It should be no secret to no one that Cyber Security has been amid several controversial topics such as emails and alleged state-sponsored cyber-attacks to influence the results of this year’s presidential election. The Federal Government believes that Russia can be behind recent waves of DDoS attacks which caused internet disruptions in the Northeast region. Multiple major news outlets have now confirmed that the U.S. military has been preparing and is ready to retaliate against any possible cyber-attacks from Russia to disrupt the election next week.

http://www.nbcnews.com/news/us-news/u-s-hackers-ready-hit-back-if-russia-disrupts-election-n677936

intro-to-ethical-hacking-week-10

This article is a perfect example of upper management not taking IT security seriously. Even though this article is 2 years old it shows a blatant act on Home Depot’s part not to address known security issues. Home Depot cyber security team presented concerns to management back in 2008 and they were slow to respond, resulting in 56 million credit cards being compromised four years later. You would have thought after the Target data breech; Home Depot would have tightened up their act.

http://www.theverge.com/2014/9/20/6655973/the-home-depot-reportedly-ignored-warnings-from-its-own-cybersecurity-team

http://www.theverge.com/2016/10/31/13481502/windows-vulnerability-sandbox-google-microsoft-disclosure

This is a good article for this week’s lesson.  The Google Threat analysis group disclosed a critical vulnerability in Windows in a public post on the company’s security blog.  The vulnerability allows hackers to escape from security sandboxes through a weakness in the win32k system.  Google went public ten days after reporting the bug to Microsoft, before a patch could be deployed.  Google has already sent out a fix to protect users that use Chrome and Windows is still vulnerable.

Microsoft has launched a new security program for its Azure cloud platform to help improve customer’s security when they are dealing with the IoT. It is a response to customer requests fro increased security assurances as they deploy IoT products. Microsoft has partnered with security auditors to evaluate customers’ IoT infrastructure, detect security problems, and provide recommendations. Partners so far include Praetorian, Casaba Security, CyberX, and Tech Mahindra. The massive DDoS attacks on Dyn through IoT was a wakeup call for business that vulnerable IoT devices such as webcams, routers, printers and DVRs would easily become the security targets of attackers. IoT product teams struggles a balance between quickly releasing products to market and the risk of insecurity. IT experts said the security issues of IoT requires the entire ecosystem to work together and collaborate to ensure security.

One of the biggest IT news last week was the IoT-Based DDoS Attacks on Dyn. IoT security problems suddenly attracted everyone’s attention. Vulnerable devices in the IoT system with default setting were turned into “bots” under control of a malware to attack DNS. Since IoT products are increasingly used within organizations, their security and privacy issues should be the top concerns of organizations before implementation.

Link: http://www.darkreading.com/iot/microsoft-launches-security-program-for-azure-iot/d/d-id/1327350

A US bank regulator, now retired, who downloaded large amount of data on two thumb drives says that he lost them. The Office of the Comptroller of the Currency, which is part of the Department of Treasury, says that this is a “a major information security incident.” The specifics on the data lost hasn’t been disclosed, but it involved “controlled unclassified information, including privacy information.” The agency discovered this loss by conducting a review on all information downloaded to removable media back in September. This issue would have been avoided if there was a policy in place that restricting data to be downloaded to devices, like most companies are doing now.

Link to article: http://www.csoonline.com/article/3137005/security/lost-thumb-drives-bedevil-us-banking-agency.html