| NIST Finalizes Guidelines for Evaluating ‘Differential Privacy’ Guarantees to De-Identify Data How can we glean useful insights from databases containing confidential information while protecting the privacy of the individuals whose data is contained within? Differential privacy, a way of defining privacy in a mathematically rigorous manner, can help strike this balance. Newly updated guidelines from the National Institute of Standards and Technology (NIST) are intended to assist organizations with making the most of differential privacy’s capabilities. Differential privacy, or DP, is a privacy-enhancing technology used in data analytics. In recent years, it has been successfully deployed by large technology corporations and the U.S. Census Bureau. While it is a relatively mature technology, a lack of standards can create challenges for its effective use and adoption. For example, a DP software vendor may offer guarantees that if its software is used, it will be impossible to re-identify an individual whose data appears in the database. NIST’s new guidelines aim to help organizations understand and think more consistently about such claims. Read More |
Category: XP
Microsoft 365 Copilot Training for IT
| Join us at Microsoft 365 Copilot Training for IT to learn how to use Microsoft Copilot to simplify your everyday tasks. During this free event, discover how Copilot can help you enhance efficiency, simplify complex tasks, and optimize technical workflows. You’ll be able to: Use Copilot to summarize the information in a product spec document for a network security product and create a project plan to implement the product. Use Copilot in PowerPoint to create and customize a business presentation based on the product plan that you created for the new network security product. Use Copilot in Word to modify a technical implementation report for a customer who is planning to install your new network security product. Use Copilot in Outlook to draft an email that provides highlights from the technical implementation report that you created for the customer who is installing your new network security product. Join us at an upcoming event: Delivery Language: English Closed Captioning Language: English Event Delivery: Digital | |
| Tuesday, March 11, 2025, 4:00 – 5:00 PM (GMT-05:00) Tuesday, March 25, 2025, 4:00 – 5:00 PM (GMT-05:00) | |
| Monday, April 07, 2025, 12:00 – 1:00 PM (GMT-05:00) Tuesday, April 22, 2025, 10:00 – 11:00 AM (GMT-05:00) | |
| Space is limited. Register for free today. |
CSF 2.0 Webinar Series: Implementing CSF 2.0—The Why, What, and How
Register Today! Take a Deep-Dive into Implementing CSF 2.0— The Why, What, and How
To address the ever-evolving cybersecurity landscape and equip organizations with information and resources to more quickly and effectively manage cybersecurity risk and improve their cybersecurity posture, NIST published a significant update to the NIST Cybersecurity Framework in 2024—CSF 2.0—the first major update to the framework in 10 years. Throughout the last year, organizations of all sizes and sectors have spent time familiarizing themselves with the CSF 2.0 and many are in the process of upgrading their cybersecurity posture informed by CSF 2.0.
In the first event in NIST’s new, multi-part CSF 2.0 webinar series we will highlight:
- Why organizations would want to upgrade and how to foster bidirectional cybersecurity risk communications between leadership and practitioners.
- Practical actions organizations can take to implement the CSF 2.0.
- What resources are available to assist with implementation.
Time will be reserved at the end for audience questions.
Speakers:
- Amy Mahn, International Policy Specialist, Applied Cybersecurity Division, NIST
- Daniel Eliot, Lead for Small Business Engagement, Applied Cybersecurity Division, NIST
- Stephen Quinn, Senior Computer Scientist and CSF Project Lead, Computer Security Division, NIST
Multiple Vulnerabilities in VMware ESXi, Workstation, and Fusion Which Could Allow For Local Code Execution
| This Multi-State Information Sharing and Analysis Center (MS-ISAC) Advisory is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals. |
| Multiple vulnerabilities discovered in VMware ESXi, Workstation, and Fusion could allow for local code execution. VMware ESXi, Workstation, and Fusion are all virtualization products that allow users to run virtual machines (VMs) on their computers. Successful exploitation of these vulnerabilities could allow for local code execution in the context of the administrator account. Threat actors could install programs; view, change, or delete data; or create new accounts with full user rights. |
| Threat Intelligence VMware by Broadcom has information to suggest that exploitations of the vulnerabilities have occurred in the wild. |
| Systems Affected |
| VMware ESXi 8.0, 7.0 VMware Workstation 17.x VMware Fusion 13.x VMware Cloud Foundation 5.x, 4.5x VMware Telco Cloud Platform 5.x, 4.x, 3.x, 2.x VMware Telco Cloud Infrastructure 3.x, 2.x |
| Risk Government: – Large and medium government entities: High – Small government entities: Medium |
| Businesses: – Large and medium business entities: High – Small business entities: Medium |
| Home Users: Low |
| Recommendations |
| Apply appropriate patches provided by VMware to vulnerable systems immediately after appropriate testing. Restrict use of certain websites, block downloads/attachments, block JavaScript, restrict browser extensions, etc. Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. Block execution of code on a system through application control, and/or script blocking. Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries. |
Considerations for Achieving Crypto Agility: NIST Releases CSWP 39 for Public Comment
Advances in computing capabilities, cryptographic research, and cryptanalytic techniques periodically create the need to replace algorithms that no longer provide adequate security for their use cases. For example, the threats posed by future cryptographically-relevant quantum computers (CRQCs) to public-key cryptography are addressed by NIST post-quantum cryptography (PQC) standards. Migrating to PQC in protocols, applications, software, hardware, and infrastructures presents an opportunity to explore capabilities that could allow this cryptographic algorithm migration and future migrations to be easier to achieve by adopting a cryptographic (crypto) agility approach.
Crypto agility describes the capabilities needed to replace and adapt cryptographic algorithms for protocols, applications, software, hardware, and infrastructures without interrupting the flow of a running system to achieve resiliency. NIST Cybersecurity White Paper (CSWP) 39, Considerations for Achieving Crypto Agility: Strategies and Practices, provides an in-depth survey of current approaches and considerations to achieving crypto agility. It discusses challenges, trade-offs, and some approaches to providing operational mechanisms for achieving crypto agility while maintaining interoperability. It also highlights some critical working areas that require additional discussion.
The public comment period is open through April 30, 2025. See the publication details for a copy of the draft and instructions for submitting comments.
NIST also invites discussions among stakeholders to develop sector- and environment-specific strategies for pursuing crypto agility at a future NIST virtual workshop.
North Korea Responsible for $1.5 Billion Bybit Hack
The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025. FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”
TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.
Read full details HERE
Threat Actors Exploit Trusted Accounting Software
| Individuals and businesses may use trusted accounting software to keep track of finances, generate invoices, and run payroll. Accounting software can also automate bookkeeping, create reports, analyze financial trends, and organize and manage data, making tax season easier. The software is linked to a designated bank account to securely pull transactions automatically and update them regularly. Although accounting software can be convenient, there are potential risks to the security of financial information, such as accounts vulnerable to data breaches, unauthorized access to accounts, and data modification. Threat actors may also phish for credentials or sensitive information, steal funds, and install malware, including ransomware. Since the beginning of 2025 and continuing into tax season, the NJCCIC observed an uptick in threat actors exploiting trusted accounting software through impersonation, phishing emails, account compromises, fraudulent invoices or transactions, and fake manual software patches. |
| The NJCCIC’s email security solution identified multiple phishing and malware campaigns impersonating legitimate businesses related to accounting, tax filing, and payments. Threat actors can sign up for free accounts for legitimate services and target victims from within those services, utilizing email addresses from domains not flagged by typical security tools. In one phishing campaign, threat actors impersonated Intuit QuickBooks, using their branding and the legitimate sender’s domain name. However, the emails are suspicious because they contain phishing links to non-Intuit domain names, unlike official emails that always include links to “intuit.com” addresses. The phishing links prompt a fraudulent Intuit authentication page to harvest user credentials that can be used in account compromises. |
| Additionally, the NJCCIC received multiple reports of unauthorized users logging into QuickBooks Online accounts using the victim’s compromised account credentials. The unauthorized users updated existing and added new vendor accounts with their own Automated Clearing House (ACH) information. They then made payments to these vendor accounts, with some successfully deducted from the victim organization’s bank account and some failing due to insufficient funds to cover the transactions. |
| Threat actors targeted accounting firm employees and impersonated UltraTax CS, Thomson Reuters’ professional tax preparation software. The username in the sender’s email address was misspelled as “subcriptions.” Although UltraTax CS is configured to automatically download and install updates by default, the email recommended manually downloading and installing the supposed software patch. If clicked, potential victims were directed to a malicious link in which threat actors weaponized the legitimate ConnectWise ScreenConnect remote access software to connect to computers and send malicious commands remotely. |
| Recommendations |
| Refrain from responding to unsolicited communications, clicking links, or opening attachments from unknown senders. Exercise caution with communications from known senders. Confirm requests from senders via contact information obtained from verified and official sources. Navigate directly to official and verified websites by typing the legitimate URL into the browser instead of clicking on links in messages and refrain from entering login credentials, personal details, and financial information on websites visited via links delivered in messages. Safeguard your information and accounts, including account credentials and other sensitive information. Use strong, unique passwords for all accounts and enable MFA where available, choosing authentication apps or hardware tokens over SMS text-based codes. Restrict access based on assigned user roles to ensure only authorized users can view or modify financial information. Keep systems up to date and apply patches after appropriate testing. Monitor accounts, set up alerts, review account transactions and activity, and report any suspicious activity, identity theft, or fraud to your financial institution, local police department, the FTC, or the credit reporting bureaus. Report phishing emails and other malicious cyber activity to the FBI’s IC3 and the NJCCIC. |
Account Compromises
| According to 2024 statistics, the United States is one of the top countries for account compromises or account takeovers (ATOs). Microsoft and Amazon are among the top five domain sources for these attacks. The percentages of targeted and impacted industries are relatively prevalent across the board. The NJCCIC continues to receive reports of compromised accounts for New Jersey residents, businesses, and local governments. These reported compromised accounts include email accounts, social media platforms, bank accounts, cryptocurrency wallets, and utility companies. |
| One of the ways threat actors compromise accounts is by using information from data breaches to target potential victims via social engineering tactics. Threat actors convince their targets to take action, divulge sensitive information, or inadvertently install malware to gain unauthorized access to legitimate user accounts. Besides phishing campaigns, threat actors increasingly exploit mobile devices and their apps in mishing attacks to compromise accounts, infiltrate networks, and steal data. Mobile platforms contain unique features and vulnerabilities, including text messages, voice calls, and QR codes. Mishing is a growing threat to individuals and organizations, as evident in recent SMiShing, vishing, and quishing campaigns. The prevalence of mishing is due to increased mobile usage, the expanded attack surface of remote work on personal devices, extensive access to sensitive information, and little or no security protections. |
| Once an account is compromised, threat actors impersonate the victim to conduct further malicious activity, such as changing account information, sending communications on their behalf, transferring funds, installing malware, exfiltrating data, and more. On average, threat actors can move from initial compromise to privilege escalation to lateral movement in approximately less than an hour, and the objectives of their full targeted attack can take four hours and 29 minutes. These timeframes are concerning as users or administrators take longer to identify and remediate. |
NIST CSF 2.0 Profile for Semiconductor Manufacturing
The NIST National Cybersecurity Center of Excellence (NCCoE), along with the SEMI Semiconductor Manufacturing Cybersecurity Consortium, has released Draft NIST Internal Report (NIST IR) 8546, Cybersecurity Framework (CSF) 2.0 Semiconductor Manufacturing Community Profile for public comment until 11:59 PM ET on Monday, April 14, 2025.
About the Draft
Draft NIST Internal Report (IR) 8546, Cybersecurity Framework 2.0 Semiconductor Manufacturing Community Profile, provides a voluntary, risk-based approach for managing cybersecurity activities and reducing cybersecurity risk to semiconductor manufacturing. The semiconductor manufacturing environment is a complex ecosystem of device makers, equipment OEMs, suppliers and solution providers. This Profile focuses on desired cybersecurity outcomes and can be used as a guideline to improve the current cybersecurity posture of the semiconductor manufacturing ecosystem.
“NIST, in collaboration with industry leaders and government agencies, has developed and is releasing a comprehensive Framework designed to safeguard semiconductor manufacturing from emerging threats and vulnerabilities,” said Sanjay Rekhi, group leader of the Security Components and Mechanisms Group at NIST. “This initiative is part of a broader, multi-year effort to strengthen the security of critical infrastructure, with a particular focus on the security of semiconductors and their supply chain.”
Comment Now!
NCCoE Cybersecurity and AI Workshop
Event Date: April 3, 2025
Event Time: 9:00 AM – 5:00 PM EST
Event Location: Virtual and at the National Cybersecurity Center of Excellence (NCCoE)
Recent advancements in Artificial Intelligence (AI) technology bring great opportunities and challenges to organizations, including how AI can affect their cybersecurity capabilities and risks. The potential positive and negative impacts of AI need to be understood and managed.
NIST is proposing the creation of a NIST Cybersecurity Framework (CSF) Profile (Cyber AI Profile), in collaboration with the cybersecurity and AI communities, to focus on three sources of risk that impact an organization’s operational risk: Cybersecurity of AI Systems, AI-enabled Cyber Attacks, and AI-enabled Cyber Defense.
To inform these discussions, join our upcoming workshop where we will explore ideas discussed in the newly released Cybersecurity and AI Workshop Concept Paper* through a variety of hybrid presentations and panel discussions and in-person only working sessions.
Registration for in-person attendance closes on March 27, 2025.
Due to space limitation, registration is limited to the first 150 registrants on a first come, first served basis.
There is no registration needed to attend virtually. Please see the link to the event page and watch the stream on April 3, 2025: https://www.nccoe.nist.gov/get-involved/attend-events/cyber-and-ai-workshop
We look forward to your participation at this event.
*Please provide any feedback using the form found on our project page before 11:59 p.m. EDT on Friday, March 14, 2025, to inform workshop topics.