Government of the Republic of Trinidad and Tobago
gov.tt

Securing the Nation's Digital Infrastructure

CYBERSECURITY: Protecting your future

The spread of new technologies and data analytics, the digitisation of business and increased digital links between organisations and their employees, is expected to escalate tomorrow’s cyber risk as those behind cyberattacks become more sophisticated in their execution and their endeavours are not diminishing. The solution demands a resilient IT security strategy that includes a …

TTCSIRT-054.101917: TT-CSIRT Advisory – Chrome Security Updates

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could result in arbitrary code execution. These vulnerabilities can be exploited if a user visits, or is redirected to, a specially crafted web page. Details of the vulnerabilities are as follows: a)UXSS with MHTML – (CVE-2017-5124) b)Heap overfin Skia – (CVE-2017-5125) c) …

TTCSIRT-053.101917: TT-CSIRT Advisory – Oracle Security Updates

Oracle has released its Critical Patch Update for October 2017 to address 252 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. Information on these vulnerabilities and how they can be fixed can be found on the Oracle Website at http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Website Attacks Surge

The number of attacks aimed at websites has increased considerably in the past months, according to a new report published on Monday by SiteLock. SiteLock’s Website Security Insider report, which is based on the analysis of more than 6.3 million sites, shows that there were, on average, 63 attack attempts per day on websites in …

Microsoft Patches Office Zero-Day Used to Deliver Malware

Microsoft’s Patch Tuesday updates for October 2017 address a total of 62 vulnerabilities, including a critical Office zero-day flaw that has been exploited in targeted attacks. The actively exploited vulnerability, tracked as CVE-2017-11826 and classified by Microsoft as “important,” is caused by a memory corruption issue. It allows a remote attacker to execute arbitrary code …

TTCSIRT-052.101117: TT-CSIRT Advisory – Microsoft Security Updates

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; …

TTCSIRT-051.101117: TT-CSIRT Advisory – NetGear Security Updates

Multiple vulnerabilities have been discovered in Netgear products, the most severe of which could allow for arbitrary code execution. Netgear is a manufacturer of networked devices such as Network Attached Storage (NAS), routers, switches, cable and DSL modems, and video cameras. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to …

TTCSIRT-050.100617: TT-CSIRT Advisory – Android Security Updates

Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for arbitrary code execution within the context of a privileged process. Details of these vulnerabilities are as follows: a) An elevation of privilege vulnerability in the Framework – (CVE-2017-0806) b) Three arbitrary code execution vulnerabilities in the Media Framework …

TTCSIRT-049.100617: TT-CSIRT Advisory – Apple Security Updates

Apple has released a supplemental security update to address vulnerabilities in macOS High Sierra 10.13: a) A local attacker may gain access to an encrypted APFS volume – if a hint was set in Disk Utility when creating an APFS encrypted volume, the password was stored as the hint. b) A malicious application can extract …

The State Of Industrial Cybersecurity 2017

The need to secure industrial control systems (ICS) from the risk of cyber-attacks cannot be underestimated in a world where human error, online criminal activity and espionage are very real threats to businesses. The potential damage from cybersecurity incidents can be considerable. The consequences of these incidents are often far greater than the associated financial …