Infosec quotes - chrome extension logging

Browser extensions are scarey because they can control any website you visit.

“... Chrome extensions have started embedding Yandex Metrica, which records user actions on all the sites they surf ... the script can log various details such as names, credit card numbers, CVV numbers, email addresses, and phone numbers...”

https://www.bleepingcomputer.com/news/security/first-malicious-chrome-extensions-detected-using-session-replay-scripts/

Infosec quotes - microsegmentation is good

With breaches becoming commonplace Microsegmentation is one of the best ways to reduce risk by making it harder for attackers to move laterally.

“... Microsegmentation gives companies greater control over the growing amount of east-west or lateral communication that occurs between servers, bypassing perimeter-focused security tools. If breaches occur, microsegmentation limits potential lateral exploration of networks by hackers...”

https://www-networkworld-com.cdn.ampproject.org/c/s/www.networkworld.com/article/3247672/virtualization/what-is-microsegmentation-how-getting-granular-improves-network-security.amp.html

Infosec quotes - firefox add-ons

Good reason to lock down firefox add-one at your company just like you whitelist your Desktop software.

“... A family of malicious Firefox addons have been discovered being pushed by sites pretending to be a manual update for Firefox...”

https://www.bleepingcomputer.com/news/security/psa-beware-of-sites-pretending-to-be-manual-firefox-updates/

Infosec quotes - no downtime no patch

A sad but common reality. Eventually orgs will have to adapt and find ways to lower risks while still becoming quicker and more agile.

“... Oracle issued updates for this issue earlier this month, but it will take months until the patch lands on affected POS systems. The reason is that POS systems are business critical systems, and sysadmins rarely schedule maintenance and update operations, fearing that an unstable patch might cause further downtime and financial losses to their companies...”

https://www.bleepingcomputer.com/news/security/security-bug-affects-over-300-000-oracle-pos-systems/

Infosec quotes - Siemens vulns

Does your company have a process in place to watch for and apply regular patches from vendors of non traditional systems like these ?

“... Vulnerability could be exploited by an attacker to bypass the authentication mechanism ... Vulnerability could be exploited by an authenticated attacker with a low-privileged account to escalate privileges and perform administrative operations ... Vulnerability could be exploited by an attacker to cause a DoS ...”

http://securityaffairs.co/wordpress/68508/security/siemens-telecontrol-basic-flaws.html

Infosec quotes - dns hijacking

“...There's a simple way to mitigate the threat of DNS hijacking attacks: don't allow arbitrary internal IP addresses on your enterprise network to send DNS queries to arbitrary IP addresses on the Internet...only a subset of your DNS servers actually query DNS servers on the Internet...”

https://www.darkreading.com/attacks-breaches/dns-hijacking-the-silent-threat-thats-putting-your-network-at-risk/a/d-id/1330922?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&utm_source=dlvr.it&utm_medium=linkedin

Infosec quotes - keygen RAT

A good example of why keygens and license crackers aren't just an ethical dilemma for a company , they are straight up a Security risk. 

“...Hacker RAT Malware found in key generator for Burpsuite ...”

https://www.linkedin.com/feed/update/urn:li:activity:6365008020736446465