Actu
Comment - CISA: Chinese state hackers are exploiting F5, Citrix, Pulse Secure, and Exchange bugs
September 2020 by Thycotic
Following the news that The Cybersecurity and Infrastructure Security Agency (CISA) published a security advisory warning of a wave of attacks carried out by hacking groups affiliated with China’s Ministry of State Security (MSS), Terence Jackson, Chief Information Security & Privacy Officer at Thycotic, comments:
“I think the main takeaway from this alert from CISA is “ If critical vulnerabilities remain unpatched, cyber threat actors can carry out attacks without the need to develop custom malware and exploits or use previously unknown vulnerabilities to target a network.” A recent Check Point security report stated that 80% of the observed ransomware attacks in the first half of 2020 used vulnerabilities reported and registered in 2017 and earlier, according to the Check Point report, and more than 20% of the attacks used vulnerabilities that are at least seven years old. Patch management is one of the fundamentals of security , but it is difficult and we at large are still receiving a failing grade. Patch management, enforcing MFA and least privilege are key to preventing cyber-attacks in the public and private sectors.”
