2.5 Admins 225: Kinetic Response
2.5 Admins
Deep Dive
Why is the FBI recommending the use of encrypted messaging apps instead of SMS?
The FBI warns that Chinese hackers have compromised numerous U.S. telecom networks, making SMS messages vulnerable to interception. Encrypted messaging apps like Signal provide end-to-end encryption, ensuring secure communication.
What are the potential challenges with implementing mandated MFA and encryption in healthcare?
While mandated MFA and encryption are beneficial for healthcare cybersecurity, the implementation could face challenges due to the complexity of the healthcare IT environment and the potential reliance on a limited number of vendors for certified solutions.
What caused QNAP NAS users to be locked out of their devices after a firmware update?
A recent QNAP firmware update caused users to lose access to their NAS devices due to a lack of proper QA testing. The update failed to account for various user configurations and network setups, leading to login issues.
Why is mutual TLS (mTLS) considered more complex than using a VPN for securing self-hosted applications?
mTLS requires setting up a complete CA infrastructure, managing certificates, and ensuring proper revocation policies. In contrast, solutions like WireGuard are simpler to set up and maintain, making them more practical for non-technical users.
What are the risks of relying on off-the-shelf NAS devices like QNAP and Synology?
Off-the-shelf NAS devices often have minimal hardware and software investment, leading to frequent vulnerabilities and poor QA practices. Building your own NAS can provide better performance, reliability, and control over updates.
What is the significance of the U.S. senators proposing mandated MFA and encryption in healthcare?
The proposal highlights the growing concern over healthcare cybersecurity, particularly after recent ransomware attacks that disrupted hospital operations. It aims to improve security standards, though the effectiveness may be limited by the existing IT infrastructure.
Why is SMS considered unreliable for important communications?
SMS was never designed to be secure and has become a target for spammers and scammers. It lacks encryption and is prone to interception, making it unsuitable for sensitive or important communications.
What are the potential geopolitical implications of cyber attacks on critical infrastructure?
Cyber attacks on critical infrastructure, such as healthcare or energy systems, could lead to kinetic responses, where nations engage in physical warfare as a reaction to data breaches. The damage caused by such attacks is increasingly seen as a serious threat.
- FBI and CISA warn against using SMS due to Chinese hacking of US telecom networks
- Recommendation to use encrypted messaging apps like Signal
- SMS unreliability and prevalence of various messaging apps (WhatsApp, Telegram, Signal, Facebook Messenger)
Shownotes Transcript
The US government tells people to use encrypted messaging, mandated MFA in healthcare raises a scary geopolitical question, QNAP bungles a firmware update, and securing access to self hosted applications with mTLS.
Plugs
Support us on patreon and get an ad-free RSS feed with early episodes sometimes
Deploying pNFS file sharing with FreeBSD
News/discussion
FBI Warns iPhone And Android Users—Stop Sending Texts
US senators propose mandated MFA, encryption in healthcare
QNAP firmware update leaves NAS owners locked out of their boxes
Free consulting
We were asked about securing access to self hosted applications with mTLS.
Automox
Check out the brand new Autonomous IT podcast. Listen in as a variety of experts in the IT Operations space discuss the latest Patch Tuesday releases, mitigation tips, and custom automations to help with CVE remediations. Listen now on Spotify, Apple, or wherever you get your podcasts.
1Password
Extended Access Management: Secure every sign-in for every app on every device. Support the show and check it out at 1password.com/25a
See our contact page for ways to get in touch.
