Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

October 2022

Cloud Security Posture Management

Arctic Wolf Cloud Security Posture Management security operations identify cloud resources at risk and provide guidance on hardening their posture, simplifying cloud security. Arctic Wolf Cloud Security Posture Management was built to make sure nothing gets missed; to give you greater context into your cloud platforms, identify gaps, and deliver posture hardening recommendations to keep your information safe.

Arctic Wolf Managed Risk

Arctic Wolf Managed Risk enables you to discover, benchmark, and harden your security across your networks, endpoints, and cloud environments. At the core of Arctic Wolf Managed Risk is our Concierge Security Team, providing you with personal security experts who deliver a quantified, real-time understanding of your cyber risk. From technical vulnerabilities like software defects and system misconfigurations, to unsafe practices like reusing passwords, our Concierge Security Team helps focus your team’s efforts to quickly improve your security posture and reduce risk.

What Security Teams Want from MDR Providers

As security teams struggle to scale security programs to meet both attack surface and threat landscape growth and complexity, many are engaging managed detection and response (MDR) providers to accelerate their operating models. With no end in sight for the cybersecurity skills shortage, MDR services can bring immediate expert resources online, together with proven, best-of-breed processes and tools that can help security teams gain control and set themselves up for future security program success.

Critical Remote Code Execution Vulnerability in VMware Cloud Foundation NSX-V: CVE-2021-39144

On Tuesday, October 25th 2022, VMware disclosed a critical remote code execution vulnerability (CVE-2021-39144, CVSS 9.8) in VMware Cloud Foundation NSX-V versions 3.x and older. A threat actor could perform remote code execution in the context of ‘root’ on the appliance due to an unauthenticated endpoint that leverages XStream for input serialization.

How to Secure Funding from the Infrastructure Investment and Jobs Act: The Deadline Is Approaching

The Infrastructure Investment and Jobs Act (IIJA) includes cybersecurity and will to hand out millions to state and local governments to help them improve their security posture and ward off future cyber threats. Getting your entity’s share of the $185 million (for calendar year 2022), however, is more complicated than emailing the federal government or asking your state for some cash. With a deadline of Nov.

What Is the SHIELD Act And How Do You Achieve Compliance?

On the internet, we’re all Hansel and Gretel. But the trail of breadcrumbs we leave behind when searching, posting on social media or shopping online aren’t designed to help us find our way back home. Instead, they’re designed to help the companies we interact with provide a richer, more customized and useful online experience.

Why You Need To Update Your Software | Cybersecurity Awareness Month

Have you ever watched a scary movie where a young couple comes home to find the front door cracked open or windows thrown wide, curtains billowing in the autumn evening breeze? As the couple approaches the house, the tense music swells and we grip our armrests, struck by the terrifying realization that anyone — or anything — could be awaiting them inside.

Why Auto Dealers Are Prime Targets for Ransomware Attacks

It’s no secret that cyber attacks — especially ransomware attacks — are increasing across industries and organizations. Attack methods are evolving and rapid digitization, along with the rise of cloud computing and a remote workforce, are creating new threat vectors and exposing new vulnerabilities. One industry that has become a major target for attacks is the automotive industry.

CVE-2022-40684: Widespread Exploitation of Critical Fortinet Authentication Bypass Vulnerability

Previously published blog post: Recently, Arctic Wolf observed threat actors begin exploiting CVE-2022-40684, a critical remote authentication bypass vulnerability impacting FortiOS, FortiProxy, and FortiSwitchManager.

Critical Remote Code Execution & Authentication Bypass Vulnerabilities in Aruba EdgeConnect Enterprise Orchestrator

On Tuesday, October 11th, 2022, Aruba disclosed three critical vulnerabilities impacting EdgeConnect Enterprise Orchestrator. The vulnerabilities, CVE-2022-37913, CVE-2022-37914, CVE-2022-37915, are remote code execution and authentication bypass vulnerabilities that could enable remote threat actors to compromise a host. In order for a threat actor to exploit these vulnerabilities, WAN access would need to be available for the CLI and/or web-based management interfaces.

Calculate the Cost of A Data Breach

The worst-case scenario happens: Your organization suffers a data breach. It’s going to take time to clean it up, the business’ reputation may take a hit, and there’s the major issue of cost. How much does cleanup cost? What if it’s a ransomware attack where your organization must pay the ransom? What other specialists will you have to hire—and how much will you need to pay them?

Five Cybersecurity Scams Where Seniors Are Especially Vulnerable

The FBI’s 2021 Elder Fraud Report leads off with a staggering, sobering statistic: adults 60 and over were swindled out of $1.7 billion dollars last year. That’s with a B. Even worse, that marks an increase of 74% year-over-year. Clearly seniors are an attractive target for cybercriminals. Here are five of their favorite ways to target our elders, and what can be done to stop them.

CVE-2022-40684: Critical Remote Authentication Bypass Vulnerability in FortiOS & FortiProxy

Late Thursday, October 6, 2022, Fortinet disclosed a critical remote authentication bypass vulnerability —CVE-2022-40684— impacting FortiOS and FortiProxy. The vulnerability could allow a remote unauthenticated threat actor to obtain access to the administrative interface and perform operations via specially crafted HTTP or HTTPS requests.

Threat Intelligence 101

You can’t protect your system if you don’t know where the vulnerabilities lie or what aspects of your security architecture are being targeted by threats. Intelligence is everything in security — it’s how CISO’s make large-scale operational decisions, how IT teams prioritize projects, and how responders restore and remediate a system during and after an incident.

Cybersecurity Awareness Month: Why You Need To Use Strong Passwords

To kids, their Halloween candy stash might as well be a treasure chest. It is their most valuable possession and must remain hidden from pirates … or at least siblings dressed up like pirates. I grew up in a big family. With many kids in the house sharing the same love for Reese’s Peanut Butter Cups, I knew the value of my candy. I knew how important it was to keep it secure. I’d count the pieces multiple times a day.

Updated Guidance for Microsoft Exchange Zero-Day Vulnerabilities Exploited in the Wild

On Wednesday, October 5, 2022, Microsoft published updated mitigation guidance for two zero-day vulnerabilities in Microsoft Exchange Server: CVE-2022-41040 (SSRF vulnerability) and CVE-2022-41082 (RCE vulnerability). Arctic Wolf covered initial assessments on this blog post. Organizations that run Microsoft Exchange on-prem or in a hybrid model should complete both Microsoft provided mitigations to reduce the potential for successful exploitation.

Additional Updated Guidance for Microsoft Exchange Zero-Day Vulnerabilities Exploited in the Wild

Late Wednesday, October 5, 2022, Microsoft published additional updated mitigation guidance for the two zero-day vulnerabilities in Microsoft Exchange Server that were exploited in the wild: CVE-2022-41040 (SSRF vulnerability) and CVE-2022-41082 (RCE vulnerability).

What Is Cybersecurity Awareness Month (NCSAM)?

Observed each October, National Cybersecurity Awareness Month (NCSAM) was first launched in a collaborative effort between the National Cyber Security Alliance (NCSA) and the U.S. Department of Homeland Security. Today, it continues to be an important collaboration between government and industry in the months up to and throughout October. Each year focuses on core themes to raise awareness about cybersecurity issues and explain what resources can help.

The Top Cyber Attacks of September 2022

Maybe it’s the changing of the seasons, the start of a new school year, or just something in the air, but September’s cybersecurity landscape was marked with high-energy hacks that seem to have served as twisted amusements for their perpetrators. This month’s round-up is full of criminals who weren’t content just to collect a ransom or sell some private data. These hackers wanted to scorch the earth and hurt their victims with an extra layer of malice and humiliation.