Attacks/Breaches

7/7/2017
12:50 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail

NotPetya: How to Prep and Respond if You're Hit

Security pros share practices to prepare and handle advanced malware attacks like NotPetya.
1 of 8

(Image: Lagarto Film via Shutterstock)

(Image: Lagarto Film via Shutterstock)

1 of 8
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
RobEnns
50%
50%
RobEnns,
User Rank: Author
7/13/2017 | 2:56:59 PM
Re: What about replicated COOP scenarios
Very good question, interested in the same.
matt.trevors
50%
50%
matt.trevors,
User Rank: Apprentice
7/12/2017 | 12:13:55 PM
We need to stop confusing end users
We in the security community have a very difficult time conveying the importance of various strategies and tactics to end users when it comes to securing their infrastructure.  I believe it in part is because we aren't promoting a unified message. Instead, we tell them what we "think" are the right things to do.  Instead, why don't you preach about the adoption of existing well-documented strategies and tactics?  For instance, you could have pointed end users to the Center for Internet Security Critical Security Controls (formerly SANS 20) which would include standing up an incident response plan, patching boxes, and backing up high-value assets.  Also, you could have pointed people to NIST 800-61 Computer Security Incident Handling Guide which would give them a good idea of how to stand up incident response capabilities for their organization (planning, detection & analysis, containment, eradication, recovery, and post-incident activities).  Finally, you are dancing around the NIST Cybersecurity Framework which includes functions, categories, and subcategories that describe how to identify, protect, detect, respond, and recover.  

As a community, we need to get better at getting our message across or things are never going to get better.  To do that, we all need to get on the same page and back published standards.  If you don't agree with the standards, most encourage community feedback.
randyfromsd
50%
50%
randyfromsd,
User Rank: Apprentice
7/11/2017 | 4:23:26 PM
Re: What about replicated COOP scenarios
Isolate the backup target from the network - make shares hidden so they aren't easily accessible - restrict user accounts - implement local\offsite backup.
jenshadus
50%
50%
jenshadus,
User Rank: Strategist
7/10/2017 | 8:35:09 AM
What about replicated COOP scenarios
Just curious of how a malware attack would affect an active-active DR scenario.  If the malware can infect a primary target, I would think it would affect the backup environment.  And what would this do to the backup recovery plans?  Sounds like the best bet is to still use tape backup.
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
What Israel's Elite Defense Force Unit 8200 Can Teach Security about Diversity
Lital Asher-Dotan, Senior Director, Security Research and Content, Cybereason,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-17158
PUBLISHED: 2018-05-24
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prag...
CVE-2017-17315
PUBLISHED: 2018-05-24
Huawei DP300 V500R002C00; RP200 V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have a numeric errors vulnerability. An unauthenticated, remote attacker may send specially crafted SCCP m...
CVE-2018-5485
PUBLISHED: 2018-05-24
NetApp OnCommand Unified Manager for Windows versions 7.2 through 7.3 are susceptible to a vulnerability which could lead to a privilege escalation attack.
CVE-2018-5487
PUBLISHED: 2018-05-24
NetApp OnCommand Unified Manager for Linux versions 7.2 through 7.3 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
CVE-2018-7902
PUBLISHED: 2018-05-24
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privile...