At Camel Secure we want you to be informed. That is why we present you this summary with the most important news in cybersecurity of the week
CISA ORDER US AGENCIES TO MITIGATE VULNERABILITY IN PULSE CONNECT SECURE VPN
CISA, the United States Cybersecurity and Infrastructure Security Agency, issued an executive order for all organizations of the executive branch of that country to mitigate, no later than this Friday, a zero-day vulnerability in Pulse Connect Secure VPN.
The warning was issued after Ivanti, the company behind of Pulse Secure, together with the firm FireEye, indicated that at least two APT groups were exploiting the discovered vulnerabilities.
This Wednesday, CISA issued directive 21-03 in which it requires government agencies to take immediate action to mitigate the vulnerability using the Pulse Connect Secure Integrity Tool to verify the integrity of file systems, designed by Ivanti to determine if it is you are carrying out malicious activity.
MI5 WARNING OF THOUSANDS OF ESPIONAGE TARGETED AT UK CIVIL SERVANTS
As a consequence of more than 10 thousand cases of espionage attempts in all branches of government in the United Kingdom through the use of malicious profiles on social networks, the MI5 Center for the Protection of National Infrastructure launched a campaign called “Think Before You Link ” targeting civil servants.
The awareness campaign seeks to prevent hostile organizations from other states from infiltrating or blackmailing UK government officials, especially through the use of platforms such as LinkedIn. According to the cases analyzed, many of the actors use false profiles and pose as organizations or people who recruit professionals, offering them attractive job opportunities in order to collect information that could be used in cyberattacks.
The Think Before You Link campaign urges public officials and other government employees to recognize the potential threat from existing or potential contacts, report them to their security manager, and remove people from their network.
THE SECOND LARGEST AUTOMOBILE INSURER IN THE US WAS THE VICTIM OF A DATA BREACH
Geico, the second largest car insurance company in the United States, informed the attorney general of the State of California that it was the victim of a computer data breach, which would have occurred between January 21 and March 1, 2021.
The company did not disclose the type of incident, but it was determined that the breach of its systems resulted in the theft of customer data information, without specifying if it was limited to people residing in the State of California or throughout the country.
Data stolen by attackers could be used to file false unemployment claims, for example.
According to Verizon statistics, 81% of data breaches occur due to poor passwords or compromised credentials.
Geico informed its clients about the violation of its systems, but its notification letter generated criticism, because according to the insurer, the attackers would have used data acquired elsewhere. In this way, critics point out to the company, Geico tries to evade its guilt in the incident by making customers take responsibility for protecting their information.