Week of January 1, 2024: CISA Flags Exploited Flaws, Orrick Breach Grows to 638,000

The week of January 1, 2024 opened with CISA adding two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog and issuing new ICS and Juniper Secure Analytics advisories, while law firm Orrick disclosed that a 2023 breach had grown to affect nearly 638,000 individuals. Security vendors also moved to consolidate capabilities, with SonicWall acquiring Banyan Security and SentinelOne agreeing to acquire PingSafe, as Judy Security named Christopher Leach its new Chief Information Security Officer.

CISA Adds Chromium and Excel-Parsing Flaws to Known Exploited Vulnerabilities Catalog

On January 2, 2024, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2023-7024, a heap buffer overflow in Google Chromium's WebRTC component, and CVE-2023-7101, a remote code execution flaw in the Spreadsheet::ParseExcel Perl module. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog entries by a set deadline, and CISA urged all organizations to prioritize these fixes as part of routine vulnerability management to reduce exposure to active attacks exploiting the two flaws. (CISA)

CISA Issues Three ICS Advisories Covering Rockwell, Mitsubishi and Unitronics Products

On January 4, 2024, CISA published three Industrial Control Systems advisories addressing Rockwell Automation FactoryTalk Activation, Mitsubishi Electric Factory Automation products, and an updated advisory for Unitronics Vision and Samba series devices. The agency said the advisories provide information on current security issues, vulnerabilities, and exploits affecting ICS environments and encouraged asset owners and administrators to review the technical details and apply the recommended mitigations to reduce risk to operational technology networks running the affected equipment. (CISA)

Juniper Patches Multiple Vulnerabilities in Juniper Secure Analytics

Juniper released a security advisory on January 2, 2024 addressing multiple vulnerabilities in Juniper Secure Analytics. CISA said a cyber threat actor could exploit one of the flaws to take control of an affected system, and it directed users and administrators to review Juniper advisory JSA75636 and apply the necessary updates. The advisory added to a string of January patch notices covering network and security monitoring products used across enterprise environments. (CISA)

Orrick Law Firm Breach Disclosure Grows to Nearly 638,000 Affected Individuals

An updated data breach disclosure filed with Maine's attorney general showed that a cyberattack against law firm Orrick, Herrington & Sutcliffe affected almost 638,000 people, more than four times the roughly 153,000 individuals reported in an earlier July filing. The firm said a threat actor accessed and stole data between February 28 and March 13, including names, Social Security numbers, driver's license and passport numbers, financial account details, and health information, though Orrick stated it was not aware of any misuse of the affected data. (Cybersecurity Dive)

SonicWall Acquires Banyan Security to Expand Zero Trust and SSE Offerings

SonicWall announced on January 3, 2024 that it had acquired Banyan Security, a security service edge provider offering Zero Trust Network Access technology. The company said the deal extends its portfolio with cloud-based secure access service edge capabilities trusted by Fortune 100 companies and small businesses alike, following SonicWall's earlier acquisition of managed-services firm Solutions Granted. The move signaled continued consolidation among vendors serving organizations shifting from legacy firewall architectures toward cloud-delivered security models. (Help Net Security)

SentinelOne to Acquire Cloud Security Startup PingSafe

SentinelOne announced on January 4, 2024 that it had agreed to acquire PingSafe, a cloud native application protection platform provider, in a deal combining cash and stock expected to close in SentinelOne's first fiscal quarter of 2025. The company said integrating PingSafe's CNAPP technology with its Singularity Platform would give customers a single system covering cloud workload protection, posture management, and secrets scanning, reducing reliance on multiple point solutions across multi-cloud environments. (Help Net Security)

Judy Security Names Christopher Leach as Chief Information Security Officer

Judy Security announced on January 3, 2024 that it had appointed Christopher Leach as its new Chief Information Security Officer. Leach previously served as CISO for Bank One, which was later acquired by JPMorgan Chase & Co., and held senior security roles at Hewlett Packard, Hewlett Packard Enterprise, and ACS/Xerox, along with risk leadership positions at JPMorgan Chase and First Horizon National Bank. In his new role, Leach is responsible for protecting the SMB-focused cybersecurity provider's team members and customers. (Newswire)