CIPSecure | Cyber Security and CIP Forum

5 Minute Guide: Securing Ephemeral Ports

What is an ephemeral port?

The word ephemeral can be defined as an object having a short lived, existing for only a short period of time. Given the definition one can assume (Yes, assumption is the mother of all screw ups!) that an ephemeral port is a logical port that is briefly opened then closed once communication ceases. The ephemeral port range allocated by the operating system is 1025 to…

Porn Droid Disabled My Android Phone

The researchers out at ESET have uncovered a nasty ransomware trojan dubbed

Simplocker FBI warning stating illegal internet activity has been found on your device.

Simplocker. Simplocker is an Android application that masquerades as a legitimate Android application.” It was first discovered sometime last year when users who installed were presented with a screen, like the one to the right,…

    http://rcm-na.amazon-adsystem.com/e/cm?t=cipsecure-20&o=1&p=42&l=ur1&category=patiolawngarden&banner=1G7PCQSTN6P1BW4HAS02&f=ifr&linkID=3UPKDSWT5BMBDBPE

  Set of questions used to determine if a critical asset has cyber assets, which in turn, are used to classify Critical Cyber Assets (CCA). The questions are based on the NERC document, Identifying Critical Cyber Assessment.  That document can…

A device that uses digital electronic technology to run pre-configured programming logic to interact with other devices over a communications interface. Programmable devices should also include a processing unit, memory, storage for the programming logic, and a communication interface that is remotely available. The remote communication interface should also allow for the access and modification…

ICS Focused Malware (Update A) http://ics-cert.us-cert.gov//alerts/ICS-ALERT-14-176-02A Information Regarding Detection of Havex This information is courtesy of Daavid and Antti of F-Secure. The link to the entire article is listed below. http://www.f-secure.com/weblog/archives/00002718.html***Havex Searches for ICS/SCADA Systems*** During the past year, we’ve been keeping a close eye on the…

Found an infographic while searching the internet. It looked pretty interesting so I thought I would share it.

  State of IT Security – Courtesy of www.hongkiat.com

  http://rcm-na.amazon-adsystem.com/e/cm?t=cipsecure-20&o=1&p=288&l=ur1&category=audible&banner=0QQ9SFYE5HJRAXQYMYR2&f=ifr&linkID=PIXDMIBUPU2QZG4U

Take for instance the ACL statements and object groups below. Notice that the object groups column contains a set of “hosts” that are organized in a group named an_object_grp. These object groups allow for easy and clean configurations; instead of entering an ACL for each IP address or range for the required service or port.

http://rcm-na.amazon-adsystem.com/e/cm?t=cipsecure-20&o=1&p=26&l=ur1&ca…

Tom Alrich’s Blog: FERC’s Sunshine Meeting Nov. 21: 11/25:   I posted my post on Order 791 last night.  The longest I’ve ever done, which is of course, saying a lot!  Any comments are app…

Give this good read. Tom Aldrich has a lot of useful information related to FERC and NERC internal policy.

<center>http://rcm-na.amazon-adsystem.com/e/cm?t=cipsecure-20&o=1&p=42&l=ur1&category=sports&banner=1WF…

  What is a side channel attack? A side channel attack consist of side channel information. This information, while not part of the encryption scheme, does produce additional inputs and outputs that may reveal sensitive information. The sensitive information gathered from these “side channel attacks” can be used to construct a predictable outcome.

http://rcm-na.amazon-adsystem.com/e/cm?t=cipsec…

BASH Shell Remote Code Execution Vulnerability Overview GNU Bash 4.3 and earlier contains a command injection vulnerability that may allow remote code execution. Description UPDATE: New CVE’s added for incomplete patches. Additional resources added and vendor patch information updated.   CWE-78: OS Command InjectionBash supports exporting of shell functions to other instances of bash using an…

Save Your Sanity and Inbox with Postfix

It seems as if running an email server is a full time job! We all know how hard it is to keep spam, viruses and malware at bay without constantly monitoring what is received by the server. The following guide attempts to address “easy to implement” methods of blocking unwanted malicious email.

Save Your Sanity and Inbox with Postfix

Step 1:  Harden Postfix by following the steps from Linukstricks…

Hotel Cyber Security Hijinx

Whether business or pleasure we have all stayed in a hotel that has WiFi and other great amenities but, did you ever consider the cyber security threats found in your hotel room? My guess is, probably not. Below is a list of common hotel room hacks and ways to protect yourself.

Dark Hotel

This is probably the worst of the worst when it comes to Hotel Cyber Security Hijinx. Dark Hotel was a…

Fake Android Apps in 3rd Party Markets

It comes as no surprise that Android has suffered another rash of malware. This time the malware is located in 3rd party markets where users side load apps circumventing malware checks by Google Play (Yes, I know even Google Play has been subject to malware.). With great openness comes great security concerns.

//rcm-na.amazon-adsystem.com/e/cm?t=cipsecure-20&o=1&p=288&l=ur1&category=ce_smartphone…

Most Common Linux Newbie Mistakes

Many, many, many years when I was a Linux newbie I made these common Linux faux pas. I write this article hoping to educate a Linux newbie and prevent them from making the same mistakes I did when I started out. Read on and enjoy….

#1 Logging in as root

This is one of the biggest mistakes a Linux newbie can make! We all know that the root user reigns supreme over the entire operating system; you…

5 Minute Guide:Making SSH More Secure

Making SSH More Secure

Anyone from a noob to a system administrator knows how important it is to access your Linux box remotely over SSH. It is understood that in order for this remote connectivity to work, the SSH server must face the internet. Given this required configuration scheme, security is of the utmost importance.

This quick 5 minute guide aims to help anybody, including seasoned Linux…

5 Minute Guide: Debian Patch Management

Patching on Debian

We all know that managing patches in Debian Linux can be a nightmare, especially when you have a ton of

An example of a patch available report generated by the Debian patch management solution AptiCron.

software packages to installed. It gets even worse when your *nix box runs a web server or sits on the internet for one reason or another. Enter in AptiCron, a simple yet…

Sudo and Su Configuration Examples

Sudo and SU

As well all know, at least I hope we do, Sudo (aka “Super Do”) and Su (aka Super User/Substitute User) are the utilities in Linux that allow a regular user to acquire elevated permissions to complete common system tasks. Of course, if configured securely, Sudo and Su will only allow a user to complete certain tasks. On the other hand, if sudo and su are configured incorrectly, it…