Here's what's important this week: September 14, 2018
Original Release Date:
Friday, September 14, 2018
Federal and defense contractors: remove all Kaspersky software from your networks by October 1, 2018, as required by the National Defense Authorization Act. Why? There are concerns the Russian anti-virus could be used as a Kremlin spying tool or that Kaspersky could be required to turn over customer information to Kremlin officials.
In last week's bulletin, I mentioned building your insider threat mitigation program. Tim Casey of Intel, one of the creators of the Threat Agent Library, has created a new Insider Threat Field Guide. These are great resources to help identify risks based on the "bad guys" most likely to harm your organization.
Threat actors, including financial crime gang Cobalt Group, have recently shifted tactics to incorporate lightweight modular downloaders that "vet" target machines for their attractiveness before proceeding with a full-fledged attack. In other words, they're planting hard-to-find malware on your systems to check you out to see if you're worth attacking.
The ACTIC and Urban Area Security Initiative issue this product to increase Arizona's awareness and cyber resilience. It's up to you to make sure you take the proper steps to secure your networks and devices. Although venders, products, and/or services may be mentioned, we do not endorse any specific one.
Contact [email protected] with any questions, to provide feedback, or to be added/removed from this distribution. Please note, this email is not monitored 24/7.
Report potential, suspected, and/or confirmed cyber threats to ACTIC via: