Security and Windows TCO
-
OpenBSD PF-based firewalls suffer differently from denial of service attacks
Suppose, hypothetically, that you have some DNS servers that are exposed to the Internet behind an OpenBSD PF-based firewall. Since you're a sensible person, you have various rate limits set in your DNS servers to prevent or at least mitigate various forms of denial of service attacks. One day, your DNS servers become extremely popular for whatever reason, your rate limits kick in, and your firewall abruptly stops allowing new connections in or out. What on earth happened?
-
Hiding malicious commands in copy-and-pasted text
Notice anything weird about it? Depending on how you selected it, possibly not. Try pasting it into your terminal.
-
Windows TCO
-
2023 toll of data breaches and leaks already tops 2022
Due to litigation (State of Missouri, et al v. U.S. EPA)
By the numbers: Through September, the ITRC tracked 2,116 data compromises — a 17% increase from the 1,802 total compromises tabulated in 2022.
Why it matters: The new data suggests that companies and government regulators' attempts to squash the ransomware attacks and other cyberattacks plaguing organizations have hardly made a dent.
-
[Repeat] Ransomware group starts leaking data allegedly from NJ cardiology consultants group
At this point, it appears that Mulkay has had a reportable HIPAA breach, but Mulkay has not disclosed anything publicly as yet and has not confirmed any breach.
-
[Repeat]CISA Now Flagging Vulnerabilities, Misconfigurations Exploited by Ransomware
As part of its Ransomware Vulnerability Warning Pilot (RVWP) program launched in March, the agency has released two new resources to help organizations identify and eliminate security flaws and weaknesses known to be exploited by ransomware groups.
-
EPA flushes water supply cybersecurity rule after losing legal fight with industry, states
American public water systems could be safe from cybercriminals and spies — we may not actually know until these systems are compromised, now that the Environmental Protection Agency has pulled the plug on a rule requiring US states to conduct cybersecurity evaluations after being sued by Republican states and water industry groups.
This week the EPA sent a memo [PDF] to state drinking water administrators saying it had "chosen to rescind" an earlier cybersecurity rule, and cited a lawsuit as the reason for its decision.
-
Withdrawal of Cybersecurity Memorandum of March 3, 2023 [PDF]
Due to litigation (State of Missouri, et al v. U.S. EPA), the U.S. Environmental Protection Agency (EPA) has chosen to rescind the interpretive memorandum issued on March 3, 2023, Addressing Public Water System Cybersecurity in Sanitary Surveys of an Alternate Process.
-