Key Takeaways from the Ticketmaster breach and Amazon re:Inforce in Philadelphia

Jun 13, 2024

The Daily Decrypt

00:00 /

In today’s episode, we explore recent major cybersecurity upgrades aimed at safeguarding the American healthcare system, including a new initiative by Microsoft to provide critical cybersecurity resources to rural hospitals. Additionally, we delve into the Ticketmaster-Snowflake data breach perpetrated by ShinyHunters, targeting 560 million users and exposing key vulnerabilities in cloud environments. Lastly, we cover AWS’s new and improved security features announced at the re:Inforce conference, which include added multi-factor authentication options, expanded malware protection for Amazon S3, and updated AI apps governance.

Search Phrases

How Microsoft is protecting rural hospitals from cyberattacks
Cybersecurity initiatives for rural healthcare by Microsoft
ShinyHunters data breach impact on cloud security
Essential measures to prevent cyberattacks in cloud environments
Latest AWS security features from re:Inforce conference
How FIDO2 passkeys enhance cloud environment security
Updated malware protection for AWS S3 buckets
Microsoft and Biden-Harris Administration cybersecurity efforts
Impact of ShinyHunters breach on data security practices
Advanced multi-factor authentication in AWS cloud environments

Major cybersecurity upgrades announced to safeguard American healthcare

https://www.helpnetsecurity.com/2024/06/12/american-healthcare-cybersecurity/

Rising Threats: Cyberattacks on American healthcare systems soared 128% from 2022 to 2023, leading to significant disruptions in hospital operations and payment systems.
- Actionable Insight: Healthcare professionals should stay vigilant and ensure their organizations have updated cybersecurity measures to mitigate risks.
Impact of Recent Attacks: In early 2024, a major cyberattack affected one-third of healthcare claims in the U.S., delaying payments and services.
- Critical Implication: Entry to mid-level cybersecurity professionals should focus on protecting payment systems and ensuring quick recovery plans are in place.
Government Initiatives: The Biden-Harris Administration launched several initiatives to bolster healthcare cybersecurity, including a new gateway website and voluntary performance goals.
- Actionable Insight: Healthcare institutions should leverage these resources to enhance their cybersecurity posture.
Collaboration for Solutions: In May 2024, the White House gathered industry leaders to discuss cybersecurity challenges and promote secure-by-design solutions.
- Engagement Suggestion: Ask listeners how their organizations collaborate with other entities to share threat intelligence and improve security.
ARPA-H UPGRADE Program: The Advanced Research Projects Agency for Health introduced the UPGRADE program, investing over $50 million in tools to defend hospital IT environments.
- Actionable Insight: IT teams should explore participation in this program to access cutting-edge cybersecurity tools and support.
Rural Hospital Support: Cyber disruptions severely impact rural hospitals. Leading tech companies, including Microsoft and Google, committed to providing free or discounted cybersecurity resources to these institutions.
- Critical Implication: Rural hospital IT staff should take advantage of these offers to strengthen their defenses against cyberattacks.
Microsoft’s Cybersecurity Program: Microsoft announced a program offering up to 75% discounts on security products, free cybersecurity assessments, and training for rural hospitals.
- Actionable Insight: Rural healthcare providers should engage with Microsoft’s program to improve their cybersecurity measures and resilience.
Google’s Contributions: Google will offer endpoint security advice and discounted communication tools to rural hospitals, along with a pilot program to tailor security solutions to their needs.
- Engagement Suggestion: Prompt listeners to consider what specific cybersecurity challenges their rural hospitals face and how these new initiatives could assist them.
Continued Efforts: The White House and industry leaders emphasize the importance of private-public partnerships to ensure the security and functionality of healthcare systems nationwide.
- Efficiency Tip: Cybersecurity professionals should stay informed about these partnerships and actively participate to benefit from shared knowledge and resources.

Lessons from the Ticketmaster-Snowflake Breach

https://thehackernews.com/2024/06/lessons-from-ticketmaster-snowflake.html

ShinyHunters Breach: Last week, hacker group ShinyHunters allegedly stole 1.3 terabytes of data from 560 million Ticketmaster users. The breach could expose massive amounts of personal data and has sparked significant concern.
- Listener Question: How can we ensure our data is safe with such large-scale breaches happening?
- Actionable Insight: Regularly update passwords and enable multi-factor authentication (MFA) on all accounts.
Live Nation Confirms Breach: Live Nation confirmed the breach in an SEC filing, stating unauthorized activity occurred in a third-party cloud database. An investigation is ongoing, and law enforcement is involved.
- Listener Question: What steps should companies take immediately after discovering a breach?
- Actionable Insight: Initiate a comprehensive investigation, notify affected parties, and work with law enforcement.
Santander Also Affected: ShinyHunters claim to have data from Santander, affecting millions of customers and employees in Chile, Spain, and Uruguay. The breach involved a third-party provider.
- Listener Question: Should we be worried about third-party services?
- Actionable Insight: Ensure third-party services adhere to stringent security protocols and regularly review their security measures.
Snowflake Connection: Both Ticketmaster and Santander used Snowflake for their cloud databases. Snowflake warned of increased cyber threats targeting customer accounts, urging users to review logs for unusual activity.
- Listener Question: What can companies do to safeguard their cloud data?
- Actionable Insight: Enforce MFA, set network policies to limit access, and regularly rotate credentials.
Snowflake’s Response: Snowflake’s CISO clarified their system wasn’t breached; single-factor authentication vulnerabilities were exploited. They recommend MFA and network policy rules for enhanced security.
Mitiga’s Research: Mitiga found the attacks exploited environments without two-factor authentication, primarily using commercial VPN IPs to execute attacks.
- Listener Question: How can we protect against these types of attacks?
- Actionable Insight: Implement and enforce MFA, utilize corporate SSO, and regularly monitor for unusual login activity.
Cloud Security Challenges: Modern cloud environments limit some security controls. Ensure platforms offer APIs for privileged identity management and integrate with corporate security.
- Listener Question: What should we look for in a cloud service provider?
- Actionable Insight: Choose providers that support MFA, SSO, password rotation, and centralized logging.
Non-Human Identities: Protecting non-human identities like service accounts is challenging but necessary. Snowflake provides guidance on securing these accounts.
- Listener Question: How do we secure non-human identities?
- Actionable Insight: Use strong, unique passwords and rotate credentials frequently for service accounts.
Cost of Cyber Attacks: Cybercriminals aim to maximize profit through mass, automated attacks like credential stuffing. Simple security measures can make these attacks less feasible.
- Listener Question: What simple measures can we take to protect against cyber attacks?
- Actionable Insight: Implement SSO, MFA, and regular password rotation to increase the cost and complexity for attackers.

Remember, these insights are not just theoretical—they can help you strengthen your organization’s security posture today!`

AWS unveils new and improved security features

https://www.helpnetsecurity.com/2024/06/12/aws-security-features/

Key Information and Actionable Insights

Multi-Factor Authentication (MFA) Upgrades:
- New Option: AWS introduces support for FIDO2 passkeys as an additional MFA method.
- Security Assurance: FIDO2 security keys offer the highest level of security, ideal for environments with stringent regulatory requirements (FIPS-certified devices).
- Considerations: Evaluate passkey providers’ security models, especially for access and recovery.
Enhanced Access Management:
- IAM Access Analyzer Update: Now assists in identifying and removing unused roles, access keys, and passwords.
- Permissions Management: Helps set, verify, and refine unused permissions to maintain a streamlined and secure access environment.
Malware Protection for Amazon S3:
- GuardDuty Expansion: Now detects malicious file uploads in S3 buckets.
- Configuration Options: Teams can set up post-scan actions like object tagging or use Amazon EventBridge to manage malware isolation processes.
AI Apps Governance:
- Audit Manager Update: New AI best practice framework simplifies evidence collection and ongoing compliance audits.
- Standard Controls: Includes 110 pre-configured controls organized under domains such as accuracy, fairness, privacy, resilience, responsibility, safety, security, and sustainability.
Additional Improvements:
- Log Analysis: Simplified through natural language queries that produce SQL queries (currently in preview).
- Network Services Integration: Streamlined process for incorporating firewalls, IDS/IPS, and other network services into customers’ WANs.