Katie Moussouris

CISA, NSA, FBI, DOE and the EPA released a joint advisory yesterday (AA26-231A) warning of an active threat to Siemens S7 Series PLCs. Not to pick on an individual vendor - similar challenges are going to appear for everyone. A lot of the commentary I am already seeing is focused on attackers using AI to write the exploitation scripts. That is interesting, but it is not the part that should change what you do this week. The attack path is a familiar one. Threat actors are finding Internet-exposed Siemens S7 PLCs (S7-200 through S7-1500, including the F-series safety CPUs), talking S7comm on TCP port 102, and using publicly available libraries like python-snap7 to read and write data blocks and ladder logic. They are disguising those scripts as legitimate monitoring tools. AI has just made it cheaper and faster to produce the scripts. It has not created a new way into the plant. Many organisations I have spoken to since founding NetSeg do not have a clear OT inventory, who can reach those devices, or whether an integrator’s remote access has left something exposed. CISA called that last point out specifically. And if you don't have a good working relationship between OT and Cyber, you won't be able to effectively protect your critical OT systems. You need asset inventory, connectivity (especially the external connections) and continuous monitoring to identify threat IOCs.

5

Insider risk resources are often scarce, and many large organizations, such as Google, tend to address these issues only after well-publicized incidents. -https://lnkd.in/gxyAny7a. Marshall Heilman and the folks from DTEX partnered with the Ponemon Institute to release the "Cost of Insider Risk 2026 Global Report" - https://ponemon.dtex.ai/. This report is the gold standard in providing trends to evaluate and budget for your own Insider Risk program. Share it with your chronically underappreciated Insider Risk folks Key Insights - Total average annual cost of insider security incidents is US$19.5M - Companies with an insider risk management program save themselves from 7 incidents a year, saving on average 8.2 million dollars - Time to Containment is reduced with a commitment to budgeting for Insider Risk, with an average of 67 DAYS to contain, down from 86 in 2023 - They address the rising COST OF SHADOW AI with cost of $10.3M due to negligent insiders

19

In this Root Causes Podcast episode, Jason Soroko and I define Cryptographic Bill of Materials (CBOM), which is more than a list of your cryptography and where it is. A CBOM need also include information about the PQC readiness of environments, availability of updates, and the importance of secrets.  Audio: https://lnkd.in/gJC5y3at Video: https://lnkd.in/gHuXd69B

22

2 Comments

CISA is sounding the alarm over a critical vulnerability in GeoServer that is being actively exploited in the wild, ordering federal agencies to patch immediately. The flaw, tracked as CVE-2025-58360, is an unauthenticated XML External Entity (XXE) vulnerability affecting GeoServer versions 2.26.1 and earlier. When exploited, the bug lets attackers retrieve arbitrary files from vulnerable servers, allowing data theft, denial-of-service attacks, or server-side request forgery (SSRF) that can expose internal systems. GeoServer, an open-source platform for publishing and sharing geospatial data, is widely used across civilian, scientific, and defense-linked federal environments. “GeoServer is widely used across federal agencies that manage land, water, and geoscience data,” said Louis Eichenbaum, federal CTO of ColorTokens, noting that it often runs alongside ArcGIS and remains connected back to enterprise GIS systems, even in otherwise segmented or air-gapped deployments. CISA added CVE-2025-58360 to its Known Exploited Vulnerabilities (KEV) catalog this week, citing active exploitation. Advisories from Wiz and the Canadian Centre for Cyber Security indicate that exploit code has circulated since late November, giving attackers a head start before coordinated patching could happen. https://lnkd.in/gRqEs5Dg

7

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

144

11 Comments

🔬 Team82 has published a new report addressing one of the major challenges in CPS today: understanding precisely what's in your environment. When assets are not accurately identified, risk increases, and visibility decreases. This report details the true effects of these gaps and how Claroty's new CPS Library offers a solution. 📘 Get your copy: https://gag.gl/3isbOQ

12