Ivanti threat thursday deck october v2

Editor's Notes

• #4: This happened at the end of September, but was such a major breach – deserves to be reviewed. Also have some other healthcare hits we can discuss. Huge hit - https://www.bleepingcomputer.com/news/security/uhs-hospitals-hit-by-reported-country-wide-ryuk-ransomware-attack/  https://healthitsecurity.com/news/3-weeks-after-ransomware-attack-all-400-uhs-systems-back-online Three weeks to recovery. 46 Hospitals hit in Other data point -Blackbaud Breach:    https://www.beckershospitalreview.com/cybersecurity/19-more-health-systems-identified-in-blackbaud-security-breach-bringing-total-to-46.html 
• #5: Clinical Trials: https://www.nytimes.com/2020/10/03/technology/clinical-trials-ransomware-attack-drugmakers.html?&web_view=true  Suspected Ryuk https://www.cpomagazine.com/cyber-security/ransomware-attack-on-a-major-health-tech-firm-slows-down-several-covid-19-clinical-trials/ Nation state activities targeting theft of COVID research according to FBI and DHS warnings. Chinese and other nation state sponsored threat actors have been targeting American coronavirus research\intellectual property https://www.biospace.com/article/clinical-trial-software-company-eresearchtechnology-hit-by-ransomware-attack/
• #6: ransomware operation known as SunCrypt, who infiltrates a network, steals unencrypted files, and then encrypts all of the data. New Jersey Hospital Pays: https://www.bleepingcomputer.com/news/security/new-jersey-hospital-paid-ransomware-gang-670k-to-prevent-data-leak/  Strange pile not exactly the same but in terms of payments you might want to mention: Robin Hood cyber criminals https://www.computerweekly.com/news/252490872/Charities-warned-over-Robin-Hood-cyber-criminals  
• #7: https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments1 Date: October 1, 2020 The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) is issuing this advisory to highlight the sanctions risks associated with ransomware payments related to malicious cyber-enabled activities. Demand for ransomware payments has increased during the COVID-19 pandemic as cyber actors target online systems that U.S. persons rely on to continue conducting business. Companies that facilitate ransomware payments to cyber actors on behalf of victims, including financial institutions, cyber insurance firms, and companies involved in digital forensics and incident response, not only encourage future ransomware payment demands but also may risk violating OFAC regulations. This advisory describes these sanctions risks and provides information for contacting relevant U.S. government agencies, including OFAC, if there is a reason to believe the cyber actor demanding ransomware payment may be sanctioned or otherwise have a sanctions nexus.2 Background on Ransomware Attacks Ransomware is a form of malicious software (“
• #8: Dickey’s BBQ: https://krebsonsecurity.com/2020/10/breach-at-dickeys-bbq-smokes-3m-cards/  Good old fashioned credit card swiping.
• #9: How do you prioritize risk? Why is vulnerability management still difficult? What has changed? Trends. Intro of Patch Intelligence Adam Jones case study Short demo? And quick conversation amongst the trio (Phil/Chris/Adam)  
• #11: Downtime calculation example taken from: https://bullwall.com/solutions/rc/cost-of-downtime/dollars/ using 5000 employees at 25% impact, 75% dependency on IT, $50 avg employee cost, 15 days downtime, and 8 hours to restore each user to operation. Cost in this example came out to $1 million Patch the wrong priorities first, be breached next. Prioritizing patches: your most important line of defense as threats grow If you have the wrong priorities your efforts are in vain. 
• #12: How the experience has changed with your group. Different song sheets, often not the same – short circuits the conversation…. Execution from Phil! And Adam gets it finished! Patching vs. configuration changes – in web servers etc – where Patch Intell shines. CVE – click it, look it up, remediate it. What patch? I don’t know Patch Intell short circuits the risk data – exploited in the wild – notes added to a patch to install – make everything goes faster. Patching and config mnmgt most important things that can be done. Key it off – the old days (vulnerability scans) spreadsheets Coming it at us from two different directions – sounds like Research – hours and hours of work – see the scan, who logged into it, with Patch Intell
• #13: Ivanti Neurons for Patch Intelligence helps you achieve faster SLAs for your vulnerability remediation efforts via supervised and unsupervised machine learning algorithms. Easily research, prioritize, and receive better insights for your patch management program in one central location. Benefit from patch reliability data that automatically delivers actionable intelligence pulled from thousands of public and crowdsourced sentiment data. This information provides improved patch reliability so you can act on threats faster and reduce your time to patch. You also receive a more accurate picture of your threat landscape through prioritized risk-based metrics and feature-rich dashboards that monitor compliance.