SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Change Healthcare Breach Costs
Change Healthcare parent company UnitedHealth has estimated the costs associated with the ransomware attack to be $872 million. In addition, UnitedHealth provided $6 billion in advance funding and no-interest loans to providers whose operations were disrupted by the breach. Meanwhile, the US House of Representatives Energy and Commerce Committee's Health Subcommittee held a hearing to discuss the circumstances that contributed to the Change healthcare cyberattack and to examine the attacks effect on the healthcare sector.
Editor's Notes
- Slide 1 of 3
Not to excuse Change Healthcare's failure to maintain essential security hygiene levels but the UnitedHealth quarterly report points out that the $872 million charge for bad security decisions is dwarfed by the $7B charge against earnings due to losses on sale of their Brazilian operations and currency losses. The key to getting buy-in for change is not just pointing out incident costs, it is showing how low the cost of avoiding incidents can be.
- Slide 2 of 3
Two concerns for Change Healthcare: 1) the estimate is likely low given the probability of pending lawsuits; and 2) potential regulatory action given vendor consolidation that results in single points of failure in this critical infrastructure sector. Both concerns should be addressed by the board.
- Slide 3 of 3
After tireless work for a decade on grappling with cybersecurity issues in healthcare, it just turns out that if you have billions of dollars in losses in healthcare, people start to pay attention. Who knew that ransomware would force the issue such that your MRI machine running Windows XP is no longer acceptable?
Slide 1 of 0- Slide 1 of 3
Ivanti Releases Fixes for Multiple Vulnerabilities in Avalanche Mobile Device Management System
Ivanti has released updates to address more than two dozen vulnerabilities in Avalanche. Two of the vulnerabilities are critical heap overflow issues that can be exploited to Achieve remote code execution. Avalanche is by admins to deploy software, updates, and otherwise manage large groups of mobile devices. Ivanti urges customers to update to version 6.4.3.
Editor's Notes
- Slide 1 of 3
A detailed write-up of the vulnerability, including an exploit, has been published. Expect that this vulnerability is already widely exploited, and exposed Avalanche systems should be considered compromised at this point.
- Slide 2 of 3
MDMs are a hot target these days, and Ivanti Avalanche (MobileIron) is no exception. The possible exploits also include DOS and executing arbitrary commands as SYSTEM. The CVSS scores on the vulnerabilities range from 4.3 to 9.8, the easy button here is update to 6.4.3. Before you run off and click install on 6.4.3, make sure you have the MSSQL credentials, they are not stored, and you'll need to provide them to the installer.
- Slide 3 of 3
Not only should all applications be considered compromised, all devices managed by them should be considered compromised.
Slide 1 of 0- Slide 1 of 3
International Law Enforcement Operation Shuts Down LabHost Phishing-as-a-Service Platform
An international law enforcement operation has disrupted the LabHost phishing-as-a-service platform. In all, 37 individuals were arrested, including four people in the UK who are believed to be LabHosts operators and developer. LabHost has been operational since 2021; Europol coordinated the year-long takedown operation.
Editor's Notes
- Slide 1 of 2
I know the idea of commoditizing an attack platform seems wild, but that is exactly what this was Phishing-as-a-Service. Don't assume this was a unicorn; this takedown involved law enforcement from nineteen countries, which is amazing by itself, and also gives a sense of what's needed to take down other such services. So, celebrate the takedown, but don't yet pump the brake on user-awareness training or implementing technical measures to help users make good choices.
- Slide 2 of 2
Cyber-crime has changed over the years and now many aspects have been commoditized as part of a global criminal operations. While we celebrate this law enforcement takedown, another service will pop up as the potential pay-out continues to be lucrative. One must ask, would these cybercrime services continue if a ransom payment became illegal?
Slide 1 of 0- Slide 1 of 2
The Rest of the Week's News
Cherry Health Services Discloses Ransomware Attack
Cherry Health Services in Michigan disclosed that its network was the victim of a ransomware attack in December 2023. Cherry Health operates 20 care service facilities in the state. The incident has compromised patient data, including Social Security, patient ID, and health insurance ID numbers, diagnosis and treatment information, prescriptions and financial account information.
Editor's Notes
Cherry Health Services in Michigan disclosed that its network was the victim of a ransomware attack in December 2023. Cherry Health operates 20 care service facilities in the state. The incident has compromised patient data, including Social Security, patient ID, and health insurance ID numbers, diagnosis and treatment information, prescriptions and financial account information.
Octapharma Plasma Centers Shut Down in Wake of Cybersecurity Incident / Telecom Discloses Outage
Octapharma Plasma centers across the US are temporarily closed due to network issues. In a separate story, US telecommunications company Frontier has experienced an outage that has affected their support desk, payment systems, and technical repair ticket operations. The Frontier incident was disclosed in a filing with the US Securities and Exchange Commission (SEC).
Editor's Notes
- Slide 1 of 2
It looks like Octapharma is a victim of the BlackSuit ransomware, deployed after an infiltration of their VMware servers. While Frontier is claiming services are restored, customers are finding they are still offline. Resist the temptation to declare systems are online without validation, as hard as it is to get back on your feet, those still not having service will not appreciate that.
- Slide 2 of 2
Chainalysis pegged global ransomware payouts at $1.1B in 2023. While neither company has confirmed that it was a ransomware attack, safe money is on just that. No time like the present for every CSO/CRO/CISO/CIO to revisit their disaster recovery plans with a focus on vulnerability and configuration management processes. The bad guys will continue to target companies, as the potential payout is just too great.
Slide 1 of 0- Slide 1 of 2
French Hospital Cyberattack
Cannes Hospital Center Simone Veil (CHC-SV) was the target of a ransomware attack earlier this week. All computers were taken offline, although the telephone system remains functional. The incident has forced staff to use pen and paper for record-keeping, and has cancelled 30 percent of non-urgent surgeries and postponed many non-urgent consultations.
Editor's Notes
They have chosen to scale services way back after taking so many systems offline. We all talk about failing back to manual mechanisms; make sure you're also having a conversation about capacity while in that manual mode. Make sure you capture what services cannot operate in that mode. Then practice (and document) those manual operations; you don't want to figure this out when the chips are down.
Cisco Talos: Brute Force Attacks on the Rise
Researchers from Cisco Talos are actively monitoring a global increase in brute-force attacks against a variety of targets, including Virtual Private Network (VPN) services, web application authentication interfaces and SSH services since at least March 18, 2024. If successful, the attacks could result in unauthorized network access, account lockout, or denial-of-service conditions. Cisco Talos has provided a list of indicators of compromise (IoCs) in their GitHub repository.
Editor's Notes
- Slide 1 of 3
These attackers are pulling every trick in the book to anonymize or obfuscate their origin, and they are not targeting specific organizations. Don't review the blog from Talos and relax when your technology is not listed. Instead make sure that your Internet-facing services are on current, supported, updated software and hardware and that you're following security best practices. Make sure you're only exposing necessary services to the Internet. Beyond making sure that you've got MFA enabled, particularly on Internet facing services, make sure that your account (and MFA) reset services are sufficiently resistant to social engineering.
- Slide 2 of 3
It turns out that weak passwords are still a problem. I really do blame VPN software vendors for making the problem very difficult to solve. It's very easy to create a VPN login with a username and password, but it is extremely difficult to add any other types of authentication to it. If the industry can fix that problem, then we may see these attacks dwindle.
- Slide 3 of 3
For an attack to be efficient, not only must it be cheaper than the value of success, it must also be cheaper than all the alternatives. To date so called social engineering has been the most efficient attack. Has anything changed?
Slide 1 of 0- Slide 1 of 3
Kubernetes Environments Infected via OpenMetadata Vulnerabilities
Researchers from Microsoft have discovered a cryptomining operation that exploited several vulnerabilities in OpenMetadata to infect Kubernetes environments. The five vulnerabilities in OpenMetadata version prior to 1.3.1 were initially disclosed in mid-March; all can be exploited to achieve remote code execution.
Editor's Notes
- Slide 1 of 2
In addition to updating to the latest version of OpenMetadata, make sure that you are not using default credentials and strong authentication. Make sure to leverage available container security products. Don't set yourself up for the conversation about why available security capabilities were not used or turned off.
- Slide 2 of 2
The Microsoft team is again coming in with these pretty interesting attacks happening in Kubernetes. Like Kubeflow, this is another one where it's just easier to open up the dashboard than concern myself with authentication. This means attackers will run and take advantage once they realize what you have done.
Slide 1 of 0- Slide 1 of 2
UN Agency Investigating Ransomware Attack
The United National Development Program (UNDP) is investigating a cyber incident that affected its IT infrastructure in Copenhagen, Denmark. In late March, UNDP received a threat intelligence notification that a data-extortion actor had stolen data which included certain human resources and procurement information.
Editor's Notes
They pilfered data could include DOB, SSNs, bank account and passport details as well as information relating to current and former staff and their families. UNDP has isolated the affected server and is communicating with those affected by the breach.
Five Eyes AI Guidance
Intelligence agencies from the Five Eyes countries (Australia, Canada, New Zealand, the UK, and the US) have jointly published an AI guidance document, Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems. The document notes that ÒThese best practices are most applicable to organizations deploying and operating externally developed AI systems on premises or in private cloud environments, especially those in high-threat, high-value environments. They are not applicable for organizations who are not deploying AI systems themselves and instead are leveraging AI systems deployed by others.
Editor's Notes
- Slide 1 of 3
We are all getting smarter on AI, particularly with LLMs, and starting in a private cloud or on-premises deployment is a low-risk option you should be leveraging. These guidelines are the droids you've been looking for. Make sure the deployment environment is sufficiently hardened, current, and only connected to what it needs. Protect your model, make sure users are trained, and cross-check with humans while you're all learning. Monitor it as you would any other high value system, and double (triple?) check the risks around decisions to integrate AI into your automation solutions.
- Slide 2 of 3
Prefer curated, application specific, training data. Test thoroughly and continuously. Build in governance and transparency from the ground up. Caution users that they are responsible for all the properties of any results.
- Slide 3 of 3
While the guidelines are specific to AI systems, the security best practices contained therein are applicable to any application deployment. The same cybersecurity guidance (CIS Critical Security Controls, ISO 27001, NIST CSF, etc.) used to protect your environment today is still applicable. The only difference when it comes to AI systems is an increased focused on data integrity.
Slide 1 of 0- Slide 1 of 3