Cyber incident? Get Help
Log In

Coalition | The Coalition Blog.

November Risk Roundup: Live in the now and fix the broken stuff first
Aaron Kraus
The Risk Roundup is our weekly collection of curated content that relates to all things digital risk management. Members of the Coalition team have pulled together their favorite posts from the week that highlight relevant trends in cybersecurity and cyber insurance. Enjoy our TL;DR and useful snippets on topics we’re keeping a close eye on.

It can be a little frustrating to see guidance from CISA that should have already been in place in the private sector, as it feels like a no-brainer. But hey, in this case, “better late than never” rings true over “too little, too late.” Read ahead for our thoughts on CISA’s latest Binding Operational Directive of Known Exploited Vulnerabilities, fixing legacy applications, and ransomware gang forum drama.

1. CISA releases new directive regarding vulnerabilities

Why in the world did it take this long for such obvious guidance? It’s obvious that organizations should prioritize fighting active threats (burning fires) vs. closing potential threats (clearing flammable material that’s not already burning). This directive provides that explicit guidance: high criticality vulnerabilities which are not being actively exploited should not take precedence over vulnerabilities that are actively being exploited. Coming up with one-size-fits-all guidance on the criticality of vulnerabilities is difficult, and while this guidance is binding only on a limited number of organizations (mainly critical infrastructure providers), it is highly recommended as a standard for all organizations’ patch and vulnerability management programs.

View tweet here

2. Babuk exploits vulnerable Microsoft Exchange servers

Legacy, monolithic applications suffer from several issues — one of which is the inability of developers to spot and fix security flaws. The time and complexity involved make it almost infeasible to perform adequate security testing, but attackers don’t have the same constraints. Modern applications are built in a modular fashion (e.g., separate calendar, contact, and mail applications that intercommunicate via APIs) and can offer benefits via reduced code complexity. This makes it easier to perform security testing and hopefully find and fix vulnerabilities before the bad guys do.

View tweet here

3. Ransomware gangs starting drama on cybercrime forums

The drama created by REvil’s decision was entirely predictable. Ransomware has increasingly matured into a complex business with customers, vendors, and an interconnected supply chain. REvil’s actions created a disruption just like a legitimate business might encounter if they could not get support for a vital product from one of their suppliers; given the amounts of money at play, a high-quality, well-supported, and reliable product is essential.

View tweet here

If you enjoyed this post be sure to check our blog weekly; the Risk Roundup runs Friday mornings in addition to more enlightening content we post related to the ever-evolving landscape of digital risk. Follow us on Twitter (@SolveCyberRisk), LinkedIn (Coalition Inc), and Youtube. If you have any suggestions for content that we should be adding to our reading list, let us know!

Coalition’s products are offered with the financial security of Swiss Re Corporate Solutions* legal entities (A.M. Best A+ rating), Lloyd’s of London (A.M. Best A rating), Arch Specialty Insurance Company (A.M. Best A+ rating), and Argo Pro US** (A.M. Best A- rating).
WHAT WE DO
© 2021 Coalition, Inc. | Licensed in all 50 states and D.C. | CA License # 0L76155
*Insurance products may be underwritten by North American Capacity Insurance Company, North American Specialty Insurance Company, or an affiliated company, which are members of Swiss Re Corporate Solutions. **Insurance products may be underwritten by Peleus Insurance Company, Colony Specialty Insurance Company, or an affiliated company, which are members of Argo Group US, Inc.