" should also really be prepared to change passwords and revoke or reissue certificates with private key components stored on any compromised devices, as well as potentially disabling other embedded systems and network devices which by their very nature could be difficult to patch," Jones says. The ABA has put out materials for members to help them both understand Shellshock and how to communicate with their management, customers and employees about the threat and what the individual institution is doing to counteract it, Johnson says.įor institutions that identify vulnerabilities, they should be treated as suspect and isolated per incident response procedures, says Neira Jones, an independent cybercrime and payments fraud advisor. "There's been a lot of active communication across the industry that has been very helpful to ensure all types of institutions have the same level of information for them to patch their systems." "Institutions are talking to their third parties because it's clear both from a business standpoint and with regulatory concerns that there's a lot of interest in making sure third parties are also patching their systems," Johnson says. The first priority for financial institutions is to understand the threat and where vulnerabilities may exist within their environments, including systems and devices, says Doug Johnson, senior vice president of risk management policy for the American Bankers Association. That assessment should include identifying all servers, systems and appliances that use the vulnerable versions of Bash and follow appropriate patch management practices.īanks relying on third-party service providers should ensure those providers are aware of the vulnerability and are taking appropriate mitigation action, the FFIEC says ( View the FFIEC Shellshock Vulnerability Alert). "Financial institutions and their service providers should assess the risk to their infrastructures and execute mitigation activities with appropriate urgency," the FFIEC says. 26 issued an alert, urging banking institutions to act quickly to address the Shellshock vulnerability. The Federal Financial Institutions Examination Council on Sept. The bug allows attackers to execute shell commands remotely, which would allow them to take control of a system, dump all data stored on the system, as well as launch automated worms that could use the vulnerability to exploit every Bash-using system inside a network. Shellshock potentially makes millions of systems vulnerable to remote takeovers because of a flaw in Bash, a Unix shell (see: Shellshock Bug: How to Respond). See Also: Live Webinar | How to Build a Secure Hybrid Workplace with SASE Similarly, industry associations have ramped up dissemination of alerts related to the bug. Anton Chuvakin, Doug Johnson, Christopher PaidhrinĪs news of the freshly discovered Bash bug known as Shellshock continues to spread, CISOs in all sectors are taking steps to mitigate the risks posed by the vulnerability.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |