Forcepoint on RBI Cybersecurity Policy for Urban  Cooperative Banks 

October 8, 2020

By

Brijesh Miglani

Security Consultant

Forcepoint

NEW DELHI, India – October 8, 2020

“This is a great step forward by RBI to strengthen the cybersecurity infrastructure of urban cooperative banks (UCBs) and will help enhance the security posture of UCBs in having mature cyber security practices against emerging cybersecurity threats. The most significant part of the new Technology Vision document is the fact that UCBs will now have to appoint Chief Information Security Officers (CISOs) and that boards will become responsible for cybersecurity.

The Cyber Security Framework for UCBs talks about setting up of a Cyber Security Operation Center (C-SOC). The SOC provides a setup for multiple technologies for better incident management, predictive and behavior analysis, and automation to help banks detect attacks at an early stage. This will help protect UCBs from cybersecurity breaches, particularly given that UCBs hold multiple data related to personally identifiable information (PII) and payment card industry (PCI).

To address these real-world hacks and breaches, UCBs should adopt a behaviour-based data protection approach that focuses on data and user behavior analytics. The risk-adaptive protection analyses human behaviour to look for indicators of behaviours to identify risk. By focusing on individual users’ interaction with data, security teams can better understand, organize, manage and mitigate risk as it occurs. The ultimate goal is to prevent the accidental or malicious use of organisations’ data, while combatting threats from phishing attacks, compromised credentials and other potential vulnerabilities.


Tenable Advises Enterprises to Patch ZeroLogon and HP Device Manager Vulnerabilities

October 8, 2020

According to a tweet from Microsoft’s Security Intelligence team, they’ve observed that a nation-state actor has been leveraging CVE-2020-1472, a critical elevation of privilege vulnerability in Netlogon. Researchers named this vulnerability “Zerologon” because of how the exploit abuses the initialisation vectors within the logon process, which are set to zeros rather than being randomly generated.

Please find below a comment from Rody Quinlan, Security Response Manager at Tenable:

Given the large availability of working proof of concepts (PoCs), and overall impact from exploitation, it’s unsurprising that known groups are looking to take advantage of this Netlogon vulnerability, dubbed Zerologon. Exploitation, if successful, allows the complete takeover of the Windows domain – that’s the virtual equivalent of the keys to the kingdom.

A quick search on GitHub reveals that there are currently at least 40 repositories containing PoC code relating to this flaw. There are also working exploit scripts that defenders and attackers alike can utilize to exploit this vulnerability.

This is going to be one of the more favourable vulnerabilities this year for malicious parties and it’s imperative that organizations either patch or take remediative action immediately to prevent systems from being compromised.”

 

HP recently published a security bulletin to address multiple vulnerabilities in HP Device Manager, software that’s used to manage HP Thin Clients remotely. The three vulnerabilities disclosed to HP by security researcher Nick Bloor warned that a combination of these vulnerabilities could allow an attacker to gain remote command execution on the vulnerable system through the HP Device Manager.

Please find below a comment from Satnam Narang, Staff Research Engineer at Tenable. A full analysis of the vulnerabilities is available here.

HP Device Manager is a popular software solution used to manage HP Thin Clients remotely. The three vulnerabilities disclosed in HP’s recent security bulletin by themselves are notable.

However, a pair of the flaws, CVE-2020-6926 and CVE-2020-6927, when combined could allow an attacker to gain remote command execution on the vulnerable system through the HP Device Manager.

HP has so far released patches for the 5.0.x branch of HP Device Manager, so organizations using this particular branch release should upgrade to 5.0.4 as soon as possible. If an organization is using a previous version of HP Device Manager, there are mitigation steps in HP’s security bulletin that can be taken to protect against these attacks until a patch becomes available.”


%d bloggers like this: