Agencies shifted to large-scale work from home operations but little thought has been given to how to secure these networks when workers return to the office. It is no secret that the COVID-19 pandemic has been a bonanza for cybercriminals. As millions of government workers shifted to remote work almost overnight, federal IT managers were suddenly charged with securing a vastly expanded network perimeter while fending off increasingly aggressive and innovative bad actors.

For the first time ever, access to sensitive data and applications was almost exclusively driven by external users rather than on-premise demand. Securing this new edge-centric world has been especially challenging as the number of cyberthreats has risen and bad actors take advantage of fears of the pandemic to launch phishing campaigns and spread malware.

Despite these threats, federal agencies have largely managed. But today, over three months after agencies shifted to large-scale work from home operations, scant thought has been given to how to secure these networks when workers return to the office.

A potential disaster looms—and securing these networks will not be a one-time event that IT managers can focus on intensely for a moment in time and then forget about. Instead, as telework and rotating telework arrangements remain prevalent for some time, devices that are found to be malware-free upon returning to the office risk being infected (or re-infected) when they return home, and once again risk bringing malware back into the network.

…

topics

• Coronavirus
• Telework
• Cyber Threats
• Continuous Monitoring

In the run up to the 2020 elections, candidates and election officials alike appear vulnerable to phishing attacks and other cyber threats that could cause havoc in November. According to a new report from cybersecurity firm Area 1 on the email security controls, a handful of election administrators and at least 50 candidates for public office in the 2020 are still using versions of vulnerable Exim mail servers known to have been used by threat actors linked to the Russian military.

In May, the National Security Agency issued an advisory that Russian cyber actors from the GRU Main Center for Special Technologies, known as the Sandworm team, had been exploiting a vulnerability in Exim mail transfer agent software for Unix-based systems since at least August 2019.  A remote code execution allows an unauthenticated remote attacker to send “a specially crafted email to execute commands with root privileges allowing the attacker to install programs, modify data, and create new accounts,” NSA said in its an advisory…

See also WSJ.com [paywall] – Election Officials Are Vulnerable to Email Attacks, Report Shows – Six jurisdictions used software that Russian spies have targeted in cyberattacks.

The Navy’s top cyber official said he expects the department to move “aggressively” towards a zero trust security model to secure government systems while a critical mass of employees continues work from home and log in from personal devices due to the COVID-19 pandemic. Shortly after the virus started spreading across the U.S., the Navy set up an internal collaboration tool called Commercial Virtual Response, according to Chief Information Security Officer Chris Cleary. While operational and classified work was still routed through secure facilities, the tool allowed hundreds of thousands of Navy employees to continue working while under stay-at-home orders by accessing agency information through the cloud on their government, mobile or even personal device.

Zero trust – a model of cybersecurity built on the assumptions that there is no meaningful network perimeter and that access controls should be tightly regulated and monitored even for high-level employees – has been steadily gaining popularity within private and public sector organizations over the past decade. Government auditors say federal agencies still remain tethered to an outdated concept; namely that the best way to protect data is by shifting defensive resources toward the network boundary.

He attributed the problem to a lack of security governance within the c-suite at many agencies, along with an unhealthy emphasis on buying tools without a solid understanding of how they fit into broader strategies. For example, some agencies have turned to machine learning sensors in order to monitor their network activity. However, they often fail to set up the corresponding data feeds that largely power and guide the accuracy of such algorithms.

Some other articles: https://fcw.com/portals/workforce.aspx

Fifteen out of 28 desktop PDF viewer applications are vulnerable to a new attack that lets malicious threat actors modify the content of digitally signed PDF documents.The list of vulnerable applications includes Adobe Acrobat Pro, Adobe Acrobat Reader, Perfect PDF, Foxit Reader, PDFelement, and others, according to new research [PDF] published this week by academics from the Ruhr-University Bochum in Germany.

Academics have named this technique of forging documents a Shadow Attack.

According to the research team three variants of a Shadow Attack exist: