Week of July 24, 2023: The SEC adopts its cyber disclosure rules, and an Ivanti zero-day hits Norway

What mattered to security leaders in the week of July 24, 2023? On Wednesday, July 26 the US Securities and Exchange Commission adopted the rules that created the Item 1.05 Form 8-K for material cybersecurity incidents and annual disclosure of cyber risk management and governance. In the same days, an Ivanti mobile device management zero-day was used against 12 Norwegian government ministries.

The SEC adopts cybersecurity incident and governance disclosure rules

The SEC's new rules require public companies to report any cybersecurity incident they determine to be material under a new Item 1.05 of Form 8-K, generally within four business days of that determination, and to describe their cyber risk management, strategy and governance each year in the Form 10-K. Disclosure can be delayed only if the US Attorney General finds that immediate disclosure would pose a substantial risk to national security or public safety. Annual disclosures start with fiscal years ending on or after December 15, 2023. For CISOs, the practical effect was a materiality decision that has to be made quickly, together with counsel and finance. (US Securities and Exchange Commission)

Ivanti EPMM zero-day used against 12 Norwegian ministries

Norway's National Security Authority confirmed on Tuesday, July 25 that a zero-day in Ivanti Endpoint Manager Mobile (formerly MobileIron Core), CVE-2023-35078, had been exploited in an attack on the ICT platform shared by 12 government ministries. The government had disclosed the attack on Monday without naming the platform. The Norwegian authorities said the vulnerability had been fixed, and on July 25 CISA added it to its Known Exploited Vulnerabilities catalog. Mobile device management servers hold the keys to every enrolled phone, which makes them high-value targets that deserve perimeter-grade patching. (Help Net Security, CISA)

CISA publishes analysis of the Barracuda ESG backdoors

On July 28 CISA released malware analysis reports on the backdoors found in the Barracuda Email Security Gateway intrusions, with indicators of compromise and YARA rules. The families it described included SUBMARINE, which executes a base64 string hidden in a file name on the Linux shell, SEASPRAY, which hooks incoming email attachments and launches WHIRLPOOL, and SALTWATER, which can run any shell command with the privileges of its calling process. The alert was updated again on September 7, 2023. (CISA)

Cl0p's MOVEit victim count passes 420

The number of known victims of the Cl0p extortion group's Memorial Day attack on internet-facing MOVEit Transfer servers passed 420, according to KonBriefing Research, as cited by Help Net Security on July 24. The group had begun publishing company-specific leak sites on the open web to pressure large victims into paying. Emsisoft noted that one affected organization, the National Student Clearinghouse, works with more than 3,500 US schools, showing how far downstream a single file transfer compromise can reach. (Help Net Security)

Australian and US agencies warn developers about IDOR flaws

On July 27 the Australian Cyber Security Centre, CISA and the NSA issued a joint advisory on insecure direct object reference (IDOR) vulnerabilities, access control flaws that let an attacker read, change or delete other users' data simply by putting another valid user's identifier into a request to a website or API. It was addressed both to software makers and to organizations that run web applications, which makes it useful ammunition for secure-by-design requirements in procurement. (ACSC, CISA and NSA)

IBM puts the average breach at $4.45 million

IBM's 2023 Cost of a Data Breach Report, released July 24, put the global average cost of a breach at $4.45 million, the highest in the report's history and 15% higher than three years earlier. Detection and escalation costs rose 42% over the same period. Breached organizations were more likely to pass costs on to consumers (57%) than to raise security spending (51%), and organizations making extensive use of AI and automation had breach lifecycles 108 days shorter. (Help Net Security)

Thales agrees to buy Imperva for $3.6 billion

Thales reached an agreement with Thoma Bravo to acquire all of Imperva at an enterprise value of $3.6 billion, giving Thales an entry into application security alongside data security. Thales said its combined cybersecurity business would generate more than €2.4 billion in revenue. (Help Net Security)