The Week in Breach News: 05/01/24 – 05/07/24

This week: Dive into big breaches at Kaiser Permanente and JP Morgan, see two hacktivist attacks in Belarus and learn why you should choose a smart security operations center (SOC) that makes the most of the MITRE ATT&CK framework.

---

---

---

Kaiser Permanente

https://www.foxbusiness.com/healthcare/kaiser-permanente-says-data-breach-may-affect-13-4-million-customers

Exploit: Misconfiguration

Kaiser Permanente: Health System

How It Could Affect Your Customers’ Business: Unexpected privacy issues can crop up when technologies evolve, and businesses need to keep an eye on that potential problem.

Kaseya to the Rescue: Learn about the growing list of cybersecurity challenges that organizations face in the Kaseya Security Survey Report 2023. DOWNLOAD IT>>

---

The City of Wichita (KS)

https://www.ksn.com/news/city-of-wichita-faces-ransomware-attack

Exploit: Ransomware

The City of Wichita (KS): Municipal Government

How It Could Affect Your Customers’ Business: Governments and government agencies of all sizes are prime targets for cyber trouble and must plan accordingly.

Kaseya to the Rescue:  Learn how to protect businesses from dark web danger and mitigate cyberattack risk with the insight we share in The IT Professional’s Guide to Dark Web Defense. DOWNLOAD IT>>

---

---

JP Morgan

https://www.investmentnews.com/regulation-and-legislation/news/jp-morgan-data-breach-hits-451000-retirement-plan-members-252872

Exploit: Misconfiguration

JP Morgan: Financial Services Company

How It Could Affect Your Customers’ Business: Third-party data security issues can be just as problematic and expensive for a company to clean up as an internal data security issue.

Kaseya to the Rescue: There are a bewildering array of acronyms used for cybersecurity technologies. This infographic breaks down six of them. DOWNLOAD IT>>

---

Dropbox

https://therecord.media/dropbox-data-breach-notification

Exploit: Hacking

Dropbox: Technology Company

How It Could Affect Your Customers’ Business: Bad actors will seek out any opening to exploit, making penetration testing a must-have to close gaps.

Kaseya to the Rescue:  Our Penetration Testing Buyer’s Guide walks you through the pen testing process to help you find the right pen testing solution for your needs. GET THE GUIDE>>

---

---

---

Belarus – The State Security Committee of the Republic of Belarus

https://therecord.media/belarus-secret-service-website-hacked

Exploit: Hacking (Hacktivism)

The State Security Committee of the Republic of Belarus: Government Agency

How it Could Affect Your Customers’ Business: Hacktivists are a dangerous foe whose capabilities should never be underestimated.

Kaseya to the Rescue:  An endpoint detection and response solution can help businesses stop the spread of cyberattacks fast. This checklist helps you find the right one. DOWNLOAD IT>>   

---

Belarus – Grodno Azot

https://therecord.media/belarus-cyber-partisans-fertilizer-hack-lukashenko

Exploit: Hacking (Hacktivism)

Grodno Azot: Fertilizer Manufacturer

How it Could Affect Your Customers’ Business: Nation-state threat actors and hacktivists often concentrate on key points in a country’s infrastructure or supply chain.

Kaseya to the Rescue: See how Datto EDR’s Ransomware Rollback helps companies reset their systems to where they were before the attack to get right back to work, minimizing downtime. LEARN MORE>> 

---

---

---

Australia – Monash Health 

https://www.cyberdaily.au/security/10511-monash-health-caught-up-in-zircodata-ransomware-data-breach

Exploit: Supply Chain Cyberattack

Monash Health: Health System

How it Could Affect Your Customers’ Business: Healthcare providers often hold very sensitive data that can be used for nefarious purposes like blackmail if it falls into the wrong hands.

Kaseya to the Rescue: Our infographic walks you through exactly how security awareness training prevents the biggest cyber threats that businesses face today. DOWNLOAD IT>>

---

Australia – Firstmac

https://www.cyberdaily.au/security/10487-exclusive-aussie-lender-firstmac-falls-victim-to-embargo-ransomware-gang

Exploit: Ransomware

Firstmac: Mortgage Lender

How it Could Affect Your Customers’ Business: Mitigating email-based cyber risk starts with powerful email security and regular phishing awareness training.

Kaseya to the Rescue: This infographic includes 10 handy tips to help you get the most out of your security awareness training solution and run an effective program. GET INFOGRAPHIC>>

---

---

---

---

---

---

Bad actors are constantly hard at work refining their scams to trick people around the world into falling for their phishing scams. These two new phishing simulation kits can help train employees to be wary of suspicious emails from Canadian banks.

• BMO Canada – Restore Your Account
• RBC Royal Bank – Update Your Account Records

See more about these phishing simulation kits in the Release Notes. LEARN MORE>> 

---

---

---

Learn about the cybersecurity dangers ahead

---

Cyberthreats have been coming in fast and furious in the first half of 2024, and the second half of 2024 promises to be just as fast-moving. Be ready for the next cyberthreat with the insight you’ll gain from our webinar Dangers Ahead Emerging Cybersecurity Threats for 2024. In this session you’ll discover:

• Real-world examples of emerging threats and significant attack vectors
• How SOC analysts detect, analyze, and respond to unforeseen incidents
• How a proactive approach to cybersecurity mitigates risks and enhances resilience
• How managed SOCs offer an effective and easy option to strengthen your cybersecurity posture

Ready to elevate your cybersecurity threat knowledge? WATCH NOW>>

Did you miss… The Benefits and Barriers of Having a SOC? DOWNLOAD IT>>

---

---

---

---

Every day, information technology (IT) professionals strive to keep the systems and data they manage secure against a wide range of dangerous cyberthreats. With the increasing prevalence of targeted and persistent threats, IT professionals need to be equipped with tools, resources and intelligence that enable them to stay ahead of adversaries through proactive threat detection. A Security Operations Center (SOC) is an invaluable asset for IT professionals tasked with securing any organization.  

---

---

The role of a SOC  

---

A SOC is a must to defend against cyberthreats. In a SOC, a centralized team of IT security professionals continually monitor and analyze an organization’s security systems and data to uncover, detect, investigate and respond to cybersecurity incidents.  

A SOC offers a multitude of cybersecurity benefits, including:  

Proactive threat detection and prevention: 24/7/365 monitoring and analysis of security events helps identify and respond to potential threats before they can cause damage. 

Improved threat intelligence: SOCs gather and analyze data from various sources to stay ahead of the evolving threat landscape and detect new threats faster. 

Reduced risk of attacks: By proactively identifying and mitigating potential threats, SOCs help to reduce the risk of successful cyberattacks. 

Incident response coordination: SOCs provide a central hub for coordinating responses to security incidents. This helps to streamline the response process and reduce the impact of incidents. 

Increased visibility: SOCs provide a centralized view of an organization’s security posture. This helps to identify and address potential vulnerabilities. 

---

---

 Why choose a managed SOC? 

---

There are two paths for managed service providers (MSPs) and businesses to take to approach gaining access to the benefits of a SOC.  

In-house: Building an in-house SOC is a complex and time-consuming process that requires major upfront investment. The cybersecurity talent shortage also makes it difficult to find the right personnel to staff it. 

Managed SOC: Choosing a managed SOC removes all of the major burdens of establishing a SOC. Partnering with a managed SOC offers access to a seasoned team of IT professionals with the latest technology to hunt, mitigate and respond to threats quickly without a big upfront cost. 

---

---

What is the role of the MITRE ATT&CK framework in a smarter SOC? 

---

MITRE ATT&CK stands for MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). The MITRE ATT&CK framework is a curated knowledge base and model for cyber adversary behavior that reflects the various phases of an adversary’s attack lifecycle and the platforms they are known to target. The MITRE ATT&CK framework offers a structured and comprehensive approach to understanding, assessing and defending against cyberthreats. Unlike the traditional, static catalog of known threat vectors, MITRE ATT&CK is a dynamic framework that adapts to the evolving tactics, techniques and procedures (TTPs) of cyber adversaries. This beacon of strategic guidance is an invaluable resource for cybersecurity professionals and offers a common language for defenders to use when communicating cybersecurity information.  

Here are some benefits of the MITRE ATT&CK framework for defenders: 

• Comprehensive knowledge base: MITRE ATT&CK is the common language the cybersecurity community uses to describe adversarial behaviors. Aligning with it gives IT professionals access to a comprehensive and structured knowledge base that catalogs various TTPs employed by adversaries during different stages of the cyberattack lifecycle. Organizations can use this knowledge base to understand potential threats more comprehensively and enhance their defense strategies. 
• Improved threat detection: ATT&CK helps organizations develop threat detection and response capabilities by mapping out specific techniques that adversaries might use. This mapping assists in creating more effective detection rules, allowing organizations to proactively identify and respond to potential threats more efficiently. 
• Risk assessment and mitigation: By understanding the tactics and techniques employed by adversaries, organizations can better assess their overall cybersecurity risk. This knowledge enables organizations to implement more targeted and effective security measures to mitigate specific threats. 
• Vendor and tool evaluation: Organizations can use the ATT&CK framework to evaluate the efficacy of security tools and solutions. It provides a standardized way to assess how well security products align with real-world threats, aiding in informed decision-making during the selection of cybersecurity tools. 
• Continuous improvement and adaptability: ATT&CK is regularly updated to include new threat intelligence and evolving tactics used by adversaries. This allows organizations to adapt and continuously improve their cybersecurity strategies in response to emerging threats. 

---

---

5 ways to make a SOC smarter with MITRE ATT&CK

---

In the dynamic realm of cybersecurity, adaptability is key. A smart SOC using the MITRE ATT&CK framework has access to a global knowledge base of the latest threats and challenges.  

Here are a few ways MITRE ATT&CK alignment can be utilized to make a smarter SOC: 

1. Map security controls to ATT&CK: Identify which security controls are effective against the TTPs listed in the ATT&CK framework to identify any gaps in security coverage. Finding gaps makes it easy to make the right investments in new security controls. 
2. Use ATT&CK-based, threat-hunting techniques: Utilize ATT&CK-based, threat-hunting techniques to proactively search for hidden threats in an organization’s environment. This includes using ATT&CK knowledge to identify suspicious activity and indicators of compromise. 
3. Develop ATT&CK-based playbooks: Create playbooks for responding to specific ATT&CK-based threats. These playbooks should outline the steps that SOC analysts should take to identify, contain and eradicate threats. 
4. Continuing education for SOC analysts: Providing SOC analysts with access to ATT&CK resources equips them with the tools they need to constantly improve their threat detection, hunting and response capabilities.  
5. Continuously monitor and improve: Smart reports give analysts actionable data that enables them to take proactive security steps, like closing security gaps, reviewing security controls and updating incident response playbooks. 

---

---

RocketCyber and MITRE ATT&CK are the perfect set up for security success 

---

RocketCyber is built to align seamlessly with the MITRE ATT&CK framework, with a plethora of integrations that make it ideal for support across the kill chain, including: 

• Recognizance
• Resource Development
• Initial Access
• Execution
• Persistence
• Privilege Escalation
• Defense Evasion
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Command and Control
• Exfiltration 
• Impact 

RocketCyber features unmatched threat detection and response capabilities, offering a wide array of benefits at an affordable price.

Real-time threat detection and response: Bad actors are always looking for vulnerabilities, so our managed SOC operates 24/7/365 to monitor and respond to threats no matter when they take place. 

PSA (professional services automation) ticketing: Our SOC analysts investigate each alert, triage the data and produce a PSA ticket that includes all of the relevant remedy details so you can focus on your operations without hiring security engineers. 

Breach detection: Detect adversaries that evade traditional cyber defenses, such as firewalls and AV. RocketCyber identifies attacker TTPs and aligns with MITRE ATT&CK, producing a forensic timeline of chronological events to deter intruders before a breach occurs 

Comprehensive monitoring: RocketCyber’s threat-monitoring platform detects malicious and suspicious activity across three critical attack vectors: endpoint, network and Cloud. 
 
Automatic malware detection and termination: At no extra cost, every deployment comes with an automatic malware detection and termination app built directly into RocketCyber’s cloud platform. 
 
Schedule a demo of RocketCyber Managed SOC today! BOOK IT>>

---

---

---

It’s Time to Play Cybersecurity Jeopardy!

May 16, 2024 | 1 PM ET / 10 AM PT

Spring is in the air, and it’s time to challenge your cybersecurity knowledge in another exciting installment of Cybersecurity Jeopardy! Hosted by Miles Walker, Channel Development Manager, you’ll see top industry experts battling it out for the title of Cybersecurity Jeopardy Champion. And the excitement doesn’t stop there — you get to participate too! Test your skills by answering questions live and stand a chance to win fantastic prizes. REGISTER NOW>>

May 16 – Kaseya+Datto Connect Local Melbourne REGISTER NOW>>

May 16 – Kaseya+Datto Connect Local New York (Security and Compliance Series) REGISTER NOW>>

May 30 – Kaseya+Datto Connect Local Sydney REGISTER NOW>>

June 11 -13: Kaseya DattoCon Europe (Dublin) REGISTER NOW>>

June 18:  Kaseya+Datto Connect Local Toronto (Security and Compliance Series) REGISTER NOW>>

October 28 – 30: Kaseya DattoCon (Miami) REGISTER NOW>>

---

---

---

---

---