NCSC (National Cyber Security Centre) - Weekly Threat Report @ncsc #cybersecurity
- ASKET Operations Team
- Jan 31, 2020
- 3 min read
Weekly Threat Report - 31st January 2020
Citrix release patches to fix product vulnerability
Patches which fix a vulnerability in the Citrix Application Delivery Controller (ADC) and Citrix Gateway have been released.
We reported on the security issues earlier this month and also published an alert offering mitigation advice to those affected by the vulnerability. That alert has now been updated to version 2.0 and carries the relevant links to the released fixes.
If security patches are not immediately available ensure you follow the vendor advice on managing the vulnerability until security patches are released. Installing the latest updates and patches when they become available is the best way to protect systems and software from being exploited.
In this particular case, the NCSC also recommends organisations carry out searches across their networks to identify whether exploitation has taken place. For full information and advice read the alert.
Cyber security measures being considered ahead of Japan 2020
Ahead of the 2020 Olympic and Paralympic games, a panel of experts in the Ministry of Internal Affairs and Communications in Japan has proposed a set of emergency measures to strengthen cyber security defences.
There are fears of an increase of cyber attacks coinciding with the global sporting event. Additional measures would include extending cyber security training to local government level and improving the reporting and information sharing around any cyber security incident. There is also a plan for officials to attempt to determine whether items, such as routers, webcams and all Internet of Things (IoT) devices, installed in public facilities and on the country’s transport infrastructure are secure.
Major events are increasingly reliant on digital systems and technology and sporting events, such as the Olympics, should treat cyber security as a priority. The NCSC’s cyber security for major events guidance is a great start for any large event organiser.
UK decision on high risk vendors
This week the government announced that new restrictions should be placed on the use of high risk vendors (HRVs) in the UK’s 5G and gigabit-capable networks.
As part of the Department for Digital, Culture, Media and Sport’s (DCMS) Telecoms Supply Chain Review, the NCSC carried out a technical and security analysis of what is needed to protect the UK’s digital infrastructure.
NCSC has issued guidance to UK Telecoms operators on HRVs. This advice is that HRVs should be:
excluded from all safety related and safety critical networks in Critical National Infrastructure
excluded from security critical ‘core’ functions, the sensitive part of the network
excluded from sensitive geographic locations, such as nuclear sites and military bases
limited to a minority presence of no more than 35% in the periphery of the network, known as the access network, which connect devices and equipment to mobile phone masts
NCSC Technical Director, Dr Ian Levy, has written a blog explaining the work behind the technical and security analysis. We have also published a 5G explainer.
Microsoft issues additional Windows 7 patch
A new update for Windows 7 has been issued by Microsoft, just days after saying it would be providing no more patches for the operating system.
The company reversed their decision after a bug which caused user’s background wallpaper to appear blank if they selected the ‘stretch’ option was discovered.
Using operating systems for which manufacturers are no longer providing support increases their vulnerability to viruses and malware.
The NCSC encourages people to upgrade devices currently running unsupported operating systems, such as Windows 7, allowing them to continue receiving software updates which help protect their devices.
We have guidance available for organisations currently using obsolete platforms and applications.
Microsoft have published a dedicated webpage for user questions, next steps and detailed advice.
Comments