Andrew Young

Looking forward to seeing the impact of MITRE EMB3D on #SupplyChainSecurity

3

Lots of conversations about migrating to PQC and how to approach risk assessment and planning last week during RSA Conference. I found the below summary of the latest update to NSA's guidelines very helpful. They lay out an actual timeline and give clarifications for some earlier releases. Give it a read if you can spare two minutes: https://lnkd.in/gZKmjS8P #PQC #cryptoagility #codesigning #supplychain #CBOM #RSAC

32

Today's Adobe security update has patched the in-the-wild zero-day PoC that EXPMON Public (https://pub.expmon.com) detected couple months ago (https://lnkd.in/ghQYYzXR). https://lnkd.in/gqxHHCfe Note: not want to cause confusion - this is not a working exploit, but a good PoC. Users are recommended to update their Adobe Reader ASAP, as we're going to point to the public sample with all the details soon in the next few days.

12

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

Today, Nucleus Security announced our sponsorship of the inaugural EPSS (Exploit Prediction Scoring System) report from Cyentia Institute. This report evaluates EPSS performance over the last few years and drills into questions related to understanding vulnerability exploitation in the wild. I'm adding links to the report and related resources in the comments. #cybersecurity #EPSS #NucleusSecurity #vulnerabilitymanagement

22

3 Comments

CISA published an alert on a supply-chain compromise of the XZ Utils package. Are you vulnerable? Check out this Sumo Logic blog to learn what to do including identifying vulnerable versions of this package in your environment and upgrading as soon as possible. #XZUtils #cybersecurity

3

Today’s session will be super enlightening given the recent SSH based attacks! Scary fact….On average, passwords at Enterprises (at even the largest scale) across their IOT and OT environments haven’t been changed in 7 YEARS!! Frightening!

9