Week of August 5, 2024: BlackSuit Ransomware Advisory and New CISO Appointments

Security leaders watched CISA and the FBI update their joint advisory on BlackSuit ransomware and add two actively exploited vulnerabilities to the KEV catalog, while Bassett Furniture, Key Tronic and Sonic Automotive each filed amended SEC disclosures quantifying the cost of earlier cyber incidents. The week also brought new CISO appointments at Ameris Bank and Robinhood's brokerage unit, alongside fresh CISA guidance on Cisco device hardening and software procurement.

CISO Moves: Ameris Bank, Robinhood, DARPA and CalypsoAI Add Security Leaders

SecurityWeek's industry moves roundup for the week of August 5, 2024, listed several security-leadership changes. Jorge Perez joined Ameris Bank as Corporate Information Security Officer after holding wholesale-banking and payments security roles at Truist Financial. David Schwed was named Chief Information Security Officer of Robinhood's Brokerage division, moving over from cybersecurity firm Halborn. Pieter 'Mudge' Zatko returned to DARPA as Chief Information Officer, a role he previously held between 2010 and 2014. CalypsoAI promoted Donnchadh Casey from chief operating officer to chief executive officer, succeeding founder Neil Serebryany, who remained on the board. (SecurityWeek)

CISA Adds Android Kernel and Apache OFBiz Flaws to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on August 7, 2024, citing evidence of active exploitation. The additions were CVE-2024-36971, an Android Kernel remote code execution vulnerability, and CVE-2024-32113, an Apache OFBiz path traversal vulnerability. Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog vulnerabilities by set due dates, and CISA urged all organizations to prioritize timely remediation of these two flaws as part of routine vulnerability management practice. (CISA)

CISA and FBI Release Secure by Demand Guide for Software Buyers

CISA and the FBI released the Secure by Demand Guide on August 6, 2024, to help organizations evaluate whether software manufacturers prioritize security from the earliest stages of product development. The guide offers a set of questions for procurement teams to ask vendors, including requests for a software bill of materials, vulnerability disclosure policies, and roadmaps to eliminate vulnerability classes. CISA Director Jen Easterly said the guide would help customers use their purchasing power to drive secure-by-design practices industry-wide. The guide complements CISA's earlier Software Acquisition Guide for government enterprise consumers. (CISA)

Bassett Furniture Updates Disclosure on July Cyber Incident

Bassett Furniture Industries filed an amended Form 8-K on August 5, 2024, updating its disclosure of a cybersecurity incident first detected on July 10, 2024. The company said its investigation and remediation efforts remained ongoing but that the threat actor had been ejected from its IT systems. Bassett reported that retail stores, its e-commerce site, manufacturing facilities and distribution centers were operating, and that it had resumed retail order fulfillment and caught up on delayed wholesale shipments. Bassett said it did not expect the incident to be material to its financial condition or results for the fiscal year. (SEC EDGAR (Bassett Furniture Industries, Inc.))

Key Tronic Discloses $2.3 Million Cost From May Cyberattack

Key Tronic Corporation filed a second amendment to its cybersecurity incident disclosure on August 6, 2024, detailing the financial impact of a May 6, 2024 intrusion into its information technology systems. The contract manufacturer said it incurred approximately $2.3 million in additional expenses and was unable to fulfill approximately $15 million of revenue in its fiscal fourth quarter because of the incident. Key Tronic said the threat actor had exfiltrated limited data, including some personally identifiable information, and that notifications to affected parties and regulators were continuing. (SEC EDGAR (Key Tronic Corporation))

Sonic Automotive Quantifies CDK Outage Hit to Q2 Earnings

Sonic Automotive filed an amended Form 8-K on August 5, 2024, quantifying the impact of the cybersecurity incident that CDK Global experienced on June 19, 2024. The dealership group said access to its CDK-provided dealer management and customer relationship management systems had been restored, but operational disruptions continued through July. Sonic Automotive reported GAAP earnings per diluted share of $1.18 for the second quarter and estimated the incident reduced that figure by approximately $0.64, before accounting for any potential insurance recoveries. (SEC EDGAR (Sonic Automotive, Inc.))

CISA Urges Cisco Device Hardening After Smart Install Abuse

CISA published guidance on August 8, 2024, after observing malicious cyber actors acquiring Cisco system configuration files by abusing the legacy Smart Install feature and exploiting weak password types. The agency recommended organizations disable Smart Install and adopt type 8 password protection, which it described as approved by NIST and more secure than other Cisco password types. CISA pointed network defenders to NSA guidance on Smart Install misuse and Cisco password best practices, and reiterated baseline recommendations such as avoiding password reuse and group accounts. (CISA)