![Cyber Security News & Tips by Glenda R. Snodgrass for The Net Effect](newsletters/images/masthead.png)
April 18, 2023
Good morning, everyone!
This week’s critical vulnerabilities:
Patch All the Things! |
FBI IC3 Annual Internet Crime Report 2022
There are some eye-popping statistics in this report:
- By year: Losses have increased from $2.7 billion in 2018 to $10.3 billion in 2022
- By type: the number of successful phishing attacks has dropped for the first time -- is education actually working?!?!
- By industry: Ransomware is overwhelmingly targeting healthcare and manufacturing (42% of attacks in 2022 were in these two sectors)
- By age: Victims over age 60 lost $3.1 billion in 2022, compared with $1+ billion for ages 30-59. We need to educate our elderly friends and relatives.
Infosec vocabulary lesson
A few weeks ago there was an entertaining thread on LinkedIn where folks were trying to explain some often-misunderstood technical terms in a way that ordinary folks would understand. I thought you might find these interesting and enlightening:
- threat actor = someone who wants to punch you in the face
- threat = the punch that might be thrown
- vulnerability = your inability to defend against the punch
- risk = the likelihood of getting punched in the face
- acceptable risk = your willingness to be punched in the face
Immediately unplug all Nexx devices
I think this one is pretty self-explanatory:
A market-leading garage door controller is so riddled with severe security and privacy vulnerabilities that the researcher who discovered them, Sam Sabetan, is advising anyone using one to immediately disconnect it until they are fixed.
The result: Anyone with a moderate technical background can search Nexx servers for a given email address, device ID, or name and then issue commands to the associated controller. (Nexx controllers for home security alarms are susceptible to a similar class of vulnerabilities.) Commands allow a door to be opened, a device connected to a smart plug to be turned off, or an alarm to be disarmed. Worse still, over the past three months, personnel for Texas-based Nexx haven’t responded to multiple private messages warning of the vulnerabilities.
Remember, if you can access it from anywhere ... it can be accessed from anywhere!
Have a cyber safe week!
![Glenda R. Snodgrass](images/GRS-talking-200.png)
Glenda R. Snodgrass
grs@theneteffect.com
(251) 433-0196 x107
https://www.theneteffect.com
For information security news & tips, follow me!
Security Awareness Training Available Here, There, Everywhere!
Thanks to COVID-19, lots of things went virtual, including my employee Security Awareness Training.
Live training has made a comeback, but many organizations have found virtual training to be useful as well. Wherever you and your employees may be, I can deliver an interesting and informative training session in whatever format you prefer.
Contact me to schedule your employee training sessions. They're fun! ☺