Infosec quotes - spectre exploit

Jacob Williams says “... I predict that Meltdown is being actively exploited in the wild. It's trivial to leak kernel memory which likely contains sensitive data...”

http://searchsecurity.techtarget.com/news/252434059/Microsoft-rushes-Spectre-patch-to-disable-Intels-broken-update

Infosec quotes - patch Cisco vpn

Patch you Cisco VPN

@gossithedog says “... CVSS 10 unauthenticated remote code execution bug if you run VPN interface to internet with Cisco ASA (aka Cisco Anyconnect). It’s one of the bigger bugs...”

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1 

Infosec quotes - Eric Cole admin rights

Dr Eric Cole said “...users should never login as administrators and never have administrator rights for thier systems...”

Infosec quotes - OneDrive sharing

Allowing Cloud file storage can lead to incidents like this.

“... former employee of Emory Healthcare (EHC) has been found to have obtained the protected health information of 24,000 EHC patients and shared the data to a Microsoft Office 365 OneDrive account, from where it could possibly be downloaded by other people...”

https://www.compliancejunction.com/emory-healthcare-data-breach-impacts-24000-patients/

Infosec quotes - Risks five years old

You should go beyond identifying Risks. You should actually outline remediation and mitigation plans for each Risk found and set some goals/target dates for when they’ll be resolved. Some progress is better than no progress.

“... is still vulnerable to hackers — in part because gaps they identified five years ago remain...”

https://www.databreaches.net/university-of-baltimore-exposed-student-identity-information-for-more-than-three-years-auditors/

Infosec quotes - ceo to HR

Your HR should be aware of these scams as they are soooo common nowadays.

“... someone pretending to be the CEO sent a staff member for employee W2s. The recipient responded, and gave it away, including employee names, Social Security numbers, where they live and how much they make....”

http://www.wsoctv.com/news/local/charlotte-housing-authority-hacked-current-former-employees-impacted/689911291

Infosec quotes - admin rights or toast

@combat_penguin says “...Defenders, if you're not limiting user rights then you're toast...”

https://twitter.com/combat_penguin/status/957285901654200320