Craig Goodwin

Weekly Vulnerability Roundup (Week Commencing: 7th October 2024) We’re back again with the Weekly Vulnerability Roundup. This report covers any vulnerabilities which have had an EPSS score change of at least 10% and any new additions to the CISA Known Exploited Vulnerabilities catalogue. A new addition to this week’s report is that we’ve added the original EPSS score to add more context to the deltas. Want to receive this report and future reports right to your inbox every Friday? Enter your email address here to sign up: https://lnkd.in/gyU9QYgx See the summary of affected technologies below and read the FULL report on our blog here: https://lnkd.in/gfa5qm3y Total CVEs:  31 References: EPSS by FIRST: https://www.first.org/ CISA KEV: https://lnkd.in/gRGpREQS Penetration Testing and SOC: https://lnkd.in/gMQXZrTs

12

🇬🇧 Building Cyber Pathways ~ A UK Perspective with Juliette Wilcox CMG Dive into the latest 'Future Secured' episode featuring Juliette Wilcox CMG, UK's Cybersecurity Ambassador for Defence and Security Exports. 🔐 Strategic Insights ~ Discover how the UK is fostering a diverse cyber security workforce. 🌐 International Cooperation ~ Learn about the pivotal role of alliances like AUKUS. 💡 Clustering Expertise ~ The importance of regional partnerships among academia, industry and government. 🚀 Startups & Investment ~ Explore the opportunities and challenges for cyber security startups. 📈 Economic Impact ~ Investing in cyber security as a foundation for future growth. Watch Episode 7️⃣ now 🔗 https://lnkd.in/g7qg5kcZ #CyberSecurity #Innovation #FutureSecured #TechPodcast #CyberSecurityStrategies #AUKUS #CyberSecurityInvestment #CyberSecurityWorkforce

6

🚀 How to Break Into New Markets with Cyber Security: Exclusive Tips from the UK Cyber Ambassador 🌟 Are you ready to revolutionise your approach to cyber security and break into new markets? Our latest Future Secured episode features an exclusive interview with Juliette Wilcox CMG, Cybersecurity Ambassador for Defence and Security Exports, @UK Department for Business and Trade by our very own MurFin Group Co-Founder Jason Murrell. Dive into her expert insights on how to stay ahead in the ever-evolving cyber security landscape. Key Takeaways from Juliette Wilcox CMG: 🌍 On International Collaboration: "None of us can do it all alone. If we're going to have an alliance that works well together, the ability to cross-fertilise ideas and be interoperable is crucial. "Protecting ourselves without collaboration can be short-sighted. We need to deploy common standards and ensure that the technologies we build together are secure by design." 🛡️ On Cyber Security as a Profession: "The UK Cyber Security Council has been doing a great job in trying to map out what a professional framework looks like because if you're a chartered engineer or in many other professions, you know the areas of expertise you have acquired and how you've acquired them. "You can create a ladder of certification that helps both individuals know where their expertise lies and employers know what they're getting when they hire someone. "Once we have a recognisable standard, it helps professionalise the field, allowing for mobility across countries and creating a true chartered profession in cyber security." 👩‍💻 On Broadening the Cyber Security Workforce: "People tend to think of a hacker in a hoodie, but cyber security is much broader. "You need communication skills, risk management skills, lawyers, accountants, and financial experts who all incorporate cyber security into their roles. "The profession encompasses a wide range of skills, and we need to build a diverse technical workforce that includes these varied competencies." This is just a glimpse of the fantastic conversation we had with Juliette Wilcox. Don't miss out on the full interview – it's packed with valuable information that can help you stay ahead in the cyber security game. 🔗 https://lnkd.in/ghTdc5xZ #CyberSecurity #UKCyberAmbassador #MurFinGroup #FutureSecured #Innovation #Leadership #CyberStrategy

8

Threat hunting is not just about using the latest tools and technologies - it requires a unique blend of skills and attributes. Our “The Rise of the Threat Hunter” blog series is back for Part 3️⃣, this time featuring insights from our Head of Threat Intelligence Paul Reid who explores the three key aspects that make an effective threat hunter: 🕵‍♀️ Being structured but adaptable 🔎 Being situationally aware and well-informed 🎨 Being creative Read the full blog, available now: https://lnkd.in/grf2BFZd

30

1 Comment

🚨 Breach Alert: MoD Payroll System Compromised, State Involvement Suspected 🚨 The UK Ministry of Defence's payroll system has been compromised, sparking concerns about potential state involvement in the cyberattack. Here's what we know: ▪ Suspected State Actor: Defence Secretary Grant Shapps mentioned that the hack, affecting up to 272,000 personnel, could be the work of a state-affiliated malign actor, with suspicions pointing towards China. ▪ Critical Information at Risk: The breached system contained sensitive details like names, bank information, and in some instances, addresses of current and former armed forces members. ▪ Contractor Under Scrutiny: The system was managed by Shared Services Connected Ltd (SSCL), and there's evidence suggesting possible security lapses by the contractor. ▪ Government Response: An eight-point plan has been outlined to address the breach, including enhanced support for affected personnel and a review of the contractor's security measures. ▪ Broader Implications: This incident is part of a troubling trend of cyberattacks targeting public institutions and highlights the need for robust cybersecurity defenses across all sectors. This recent breach at the MoD highlights the ongoing challenges we face in cybersecurity. As a cybersecurity consultancy committed to safeguarding critical infrastructure, we understand the importance of proactive defense strategies. It is essential for every organization, especially those handling sensitive, national data, to continuously evaluate and enhance their cybersecurity measures. Let us help you strengthen your defenses and ensure your systems are resilient against complex cyber threats. #CriticalInfrastructure #Cybersecurity #DataBreach #NationalSecurity #InfoSec https://lnkd.in/gj_gUEYu

8

MOD's Stellar Response to Cyber Attack: Lessons for Cyber Resilience Last week, the Ministry of Defence (MOD) faced a significant cyber attack targeting its payroll systems. The swift and effective response by the MOD sets a benchmark for cyber resilience. Quick action, clear communication, and effective measures minimised impact and highlighted the importance of readiness. At Outbreach, we specialise in equipping organisations with the strategies and tools needed to deal with such cyber threats effectively. The MOD's incident underscores the necessity of having a solid incident response plan - something we help businesses build and implement. The incident is a clear reminder of the value of preparedness and the effectiveness of immediate action. To learn how Outbreach can help bolster your cyber defenses, reach out to us. UK Ministry of Defence #CyberSecurity #MOD #IncidentResponse #Outbreach https://lnkd.in/dV6YcfQi

7

🚨 Ministry of Defence Data Breach: Is Our National Security at Risk? 🚨 Sensitive military data exposed in the latest cyberattack on the MoD. This breach highlights the urgent need for stronger cybersecurity measures and accountability for third-party vulnerabilities. Read our deep dive on what this means for national security and how we can avoid future incidents: https://lnkd.in/emgZyKJ7 #CyberSecurity #DataBreach #NationalSecurity #MoD #CyberThreats #InfoSec #GDPR #RiskManagement #MilitaryData #DigitalDefense

2

📢 Our COO Sarah Blundell has written an insightful blog for Operational Technology Security Impact Day with techUK How to navigate the crucial link between cyber security and operational technology. You can read it 👉 https://lnkd.in/d8_Ca5nJ For more info on the day and the rest of the #techUKOTSecurity Hub: https://lnkd.in/dGx8nvz5 #techUKCyber #CyberSecurity #OTCyberSecurity

4

Another great video where we discuss discuss 'the importance of knowing who’s attacking you' with our partners ITPS and SOC Prime. Please get in touch if you would like to know more about how our next-generation SOC can support your business! #SecOps #MSSP #Automation #AI #CyberSecurity

6

New Blog Post is Up! Does your organisation implement a defence in depth strategy? Learn how a layered defence can strengthen your protection. 🔒 #CyberSecurity #PenetrationTesting #RedTeaming #RiskManagement #SecurityStrategy

9

Cyber Security as a Catalyst for Economic Growth 📈 A roundtable discussion took place last month coordinated by #CyBOK under the guidance of The Rt Hon Stephen McPartland MP, in partnership with Innovate UK. The purpose of this event was to support the McPartland Review on Cyber Security and Economic Growth. This review is pivotal in understanding how robust cyber security can be a powerful enabler for economic expansion across various sectors. With the cyber security sector's revenue nearly doubling from £5.7 billion in 2018 to over £10.5 billion in 2023, and 20,000 jobs added, the potential for further growth is immense. The government aims to capitalise on this by making the UK a science and technology superpower, prioritising economic growth through secure digital technologies. This initiative seeks to promote resilience and trust in technology while ensuring that organisations can access the cyber security solutions they need. The insights gathered from a diverse range of stakeholders will inform policy directions and contribute to a prosperous digital economy for all. A skilled cyber security workforce with the requisite knowledge and skills is essential to deliver on this economic potential. CyBOK plays a crucial role in providing the foundational knowledge that empowers professionals to meet the evolving challenges and opportunities in the field. We're looking forward to seeing the outcomes from the roundtable and further contributing to the UK Government's National Cyber Strategy! #CyberSecurity #EconomicGrowth #DigitalInnovation #UKTech

46

🚗💡 MPJ Recruitment Highlights: Tech Tops the Agenda at BIBA Conference As the UK government introduces pioneering laws to protect against IoT hacking threats, the upcoming BIBA Conference in Manchester is set to focus heavily on technology. Brokers and insurers alike are gearing up to tackle fresh data demands and the evolving landscape of technological risks. This is a crucial moment for the industry to align on best practices and innovative solutions. 📌 𝗞𝗲𝘆 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆𝘀: ✅ 𝗡𝗲𝘄 𝗟𝗲𝗴𝗶𝘀𝗹𝗮𝘁𝗶𝗼𝗻: World-first laws to protect consumers and businesses. ✅ 𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝘆 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲: Updates on how insurers are adapting to new technological challenges. ✅ 𝗙𝘂𝘁𝘂𝗿𝗲 𝗣𝗿𝗲𝗽𝗮𝗿𝗲𝗱𝗻𝗲𝘀𝘀: Strategic discussions on navigating future threats. 🔗 Stay informed about the BIBA Conference https://lnkd.in/eDhp4c3U 👥 Let's Connect! What are your thoughts on technology's role in shaping the future of insurance? Share below or reach out to discuss! #BIBAConference #TechInInsurance #CyberSecurity #IoT #UKLegislation #MPJRecruitment

3

It's been a busy week for vulnerabilities!   Our article linked below covers recent vulnerabilities found to be actively exploited. They are categorised based not only on the category of exploitation, but their impact, and versions affected. We've also included any official fix and remediation guidance for the listed vulnerabilities. Read more: https://lnkd.in/eTzXx2eJ #CyberSecurity #CVEs #Vulnerabilities

13

𝗠𝗶𝗻𝗶𝘀𝘁𝗿𝘆 𝗼𝗳 𝗗𝗲𝗳𝗲𝗻𝗰𝗲 𝗙𝗮𝗰𝗲𝘀 𝗖𝘆𝗯𝗲𝗿𝗮𝘁𝘁𝗮𝗰𝗸: 𝟮𝟳𝟬,𝟬𝟬𝟬 𝗥𝗲𝗰𝗼𝗿𝗱𝘀 𝗕𝗿𝗲𝗮𝗰𝗵𝗲𝗱 🛡️💻 The UK Ministry of Defence has confronted a significant #cybersecurity breach, with hackers allegedly accessing 270,000 payroll records from Britain’s armed forces. 𝗗𝗮𝘁𝗮 𝗕𝗿𝗲𝗮𝗰𝗵 𝗖𝗿𝗶𝘀𝗶𝘀 🚨📉 A #cyberattack targeted payroll records, including names and bank details of military personnel, reservists, veterans, and even an MP, raising concerns about potential misuse of the compromised #data. 𝗜𝗺𝗺𝗲𝗱𝗶𝗮𝘁𝗲 𝗔𝗰𝘁𝗶𝗼𝗻 🚀🔒 Prime Minister Rishi Sunak reassured the public of swift action, with the affected network offline and support provided to impacted individuals. Alerts will be issued to personnel, offering specialist advice and monitoring services to prevent unauthorised data usage. 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿 𝗨𝗻𝗱𝗲𝗿 𝗦𝗰𝗿𝘂𝘁𝗶𝗻𝘆 🔍🔓 The breached data was managed by private contractor Shared Services Connected Ltd (SSCL), prompting a security review. Investigations are underway to determine any lapses and prevent future incidents, as SSCL serves multiple Government departments. 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 💼🔍 Cybersecurity experts highlight the need for robust defence measures, emphasising the evolving #threatlandscape and the importance of continuous security protocols to safeguard sensitive data. “The challenge is exacerbated by the presence of silos in cybersecurity monitoring, which can lead to gaps in threat detection and response," said Martin Greenfield, CEO of cybersecurity consultancy, Quod Orbis. “When dealing with this level of sensitive information which could potentially cause a huge knock-on effect, it is vital that [businesses] are protected to the highest possible standard,” said Jake Moore, Global Cybersecurity Advisor at software company, ESET. Read more at https://lnkd.in/g33qEwNp #databreach #cyberattack #governmentsecurity #dataprotection #cyberresilience #technews #uk

5

𝗠𝗶𝗻𝗶𝘀𝘁𝗿𝘆 𝗼𝗳 𝗗𝗲𝗳𝗲𝗻𝗰𝗲 𝗙𝗮𝗰𝗲𝘀 𝗖𝘆𝗯𝗲𝗿𝗮𝘁𝘁𝗮𝗰𝗸: 𝟮𝟳𝟬,𝟬𝟬𝟬 𝗥𝗲𝗰𝗼𝗿𝗱𝘀 𝗕𝗿𝗲𝗮𝗰𝗵𝗲𝗱 🛡️💻 The UK Ministry of Defence has confronted a significant #cybersecurity breach, with hackers allegedly accessing 270,000 payroll records from Britain’s armed forces. 𝗗𝗮𝘁𝗮 𝗕𝗿𝗲𝗮𝗰𝗵 𝗖𝗿𝗶𝘀𝗶𝘀 🚨📉 A #cyberattack targeted payroll records, including names and bank details of military personnel, reservists, veterans, and even an MP, raising concerns about potential misuse of the compromised #data. 𝗜𝗺𝗺𝗲𝗱𝗶𝗮𝘁𝗲 𝗔𝗰𝘁𝗶𝗼𝗻 🚀🔒 Prime Minister Rishi Sunak reassured the public of swift action, with the affected network offline and support provided to impacted individuals. Alerts will be issued to personnel, offering specialist advice and monitoring services to prevent unauthorised data usage. 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁𝗼𝗿 𝗨𝗻𝗱𝗲𝗿 𝗦𝗰𝗿𝘂𝘁𝗶𝗻𝘆 🔍🔓 The breached data was managed by private contractor Shared Services Connected Ltd (SSCL), prompting a security review. Investigations are underway to determine any lapses and prevent future incidents, as SSCL serves multiple Government departments. 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 💼🔍 Cybersecurity experts highlight the need for robust defence measures, emphasising the evolving #threatlandscape and the importance of continuous security protocols to safeguard sensitive data. “The challenge is exacerbated by the presence of silos in cybersecurity monitoring, which can lead to gaps in threat detection and response," said Martin Greenfield, CEO of cybersecurity consultancy, Quod Orbis. “When dealing with this level of sensitive information which could potentially cause a huge knock-on effect, it is vital that [businesses] are protected to the highest possible standard,” said Jake Moore, Global Cybersecurity Advisor at software company, ESET. Read more at https://lnkd.in/g33qEwNp #databreach #cyberattack #governmentsecurity #dataprotection #cyberresilience #technews #uk

4

Ransomware gangs are constantly adapting, making it crucial to stay informed. The NSB Cyber Threat Intelligence team specialises in providing insights into the latest tactics and techniques used by these threat actors. By understanding these evolving threats, organisations can better prepare and protect themselves. Engaging with ransomware threats requires up-to-date knowledge and a strategic approach. Our goal is to empower organisations with the information needed to stay ahead of cybercriminals and safeguard their critical systems and data. Explore our Cyber Threat Actor (CTA) Engagement services to learn how we can help you mitigate risks and ensure the resilience of your operations in the face of these evolving challenges. Browse this document to find out more: https://lnkd.in/ewJdw5yG #cybersimplified #defendwithconfidence #nostepsbackward

19