CISO Liability Insurance, A Seriously Dangerous Menu Hack, and more Security News

This podcast discusses several recent cybersecurity news stories, including a new CISO liability insurance policy, a Chinese attack on US telecommunication companies, Russian spies leveraging Wi-Fi networks for lateral movement, and vulnerabilities exploited in Palo Alto Networks' Expedition and other firewall products. The podcast emphasizes the growing threat landscape and the importance of proactive security measures, urging listeners to remain vigilant and implement security best practices to mitigate risks.

CISO Liability Insurance

• 00:00:27 Crumb & Forster introduced a new insurance policy specifically for CISOs, offering personal liability coverage for legal defense costs, SEC disclosure issues, and potential security breaches. This is a significant development given the increasing risk and responsibility of CISOs, who often lack the same liability protections as other C-suite executives. The insurance policy attempts to address a gap in the market for CISOs facing potential personal liability.

Chinese Telecom Compromise

• 00:00:59 The FBI and CISA revealed that Chinese attackers compromised multiple US telecommunications companies, stealing customer call records and data, including unencrypted communications. This incident raises concerns about the security of communications, particularly for government employees and those in sensitive industries. The incident also highlights the outdated and potentially insecure infrastructure underlying the telecommunications industry.

Russian Spy Wi-Fi Hack

• 00:07:43 Russian spies exploited a vulnerability in Wi-Fi networks to laterally move between networks of three different organizations. They utilized a compromised computer within one network to connect to another company's Wi-Fi, ultimately reaching their intended target through a series of hops between networks. This incident demonstrates the risk of overlooking basic network security, particularly in a world increasingly reliant on Wi-Fi for connectivity.

Palo Alto Firewall Vulnerabilities

• 00:12:47 Palo Alto Networks' Expedition product, used for firewall configuration conversion, was found to be vulnerable to exploitation, allowing attackers to execute arbitrary OS commands and access sensitive data. This vulnerability highlights the importance of extending security considerations to less commonly scrutinized tools and processes, including configuration management and migration tools. Other vulnerabilities in Palo Alto's Panos firewalls are also under active exploit, prompting security teams to prioritize patching for these critical vulnerabilities.

Fake Gov Email Scams

• 00:16:54 The FBI warned about threat actors stealing .gov email addresses and using them to impersonate government agencies to conduct fake emergency data requests. The scammers are leveraging the inherent trust placed in government emails to trick private companies into releasing sensitive data. This underscores the need for increased scrutiny of seemingly legitimate requests for sensitive information, even those originating from .gov domains, emphasizing careful verification and escalation of such requests.