AUSCERT Week in Review for 18th September 2020

Greetings,

What a week it was!

We took on uncharted territory this year by hosting our 19th annual conference, AUSCERT 2020 – virtually. While it mimicked an in-person event in so many ways (think: tech glitches and hiccups), our team is so very proud to have been able to deliver the conference nevertheless. We trust that you enjoyed your delegate experience and don’t forget to save the dates for next year as we look forward to seeing everyone SOAR with cyber.

We would like to take this opportunity to congratulate our 2020 Australian Information Security Awards winners again:

• Member Organisation of the Year: Federation University

• Member Individual of the Year: Rachael Leighton from the Department of Premier and Cabinet, Victorian Government

• Information Security Excellence Winner: Michelle Price from AustCyber

Congratulations on their very deserving awards and we hope to continue working together in fostering our cyber and information security community. Members, don’t forget that we are extending the closing date of the AUSCERT Security Bulletins survey (member portal login required) to the close of business today. Every completed survey will go in the draw to win Nintendo Switch Lite console, valued at AU$299.

Until next week, have a restful weekend everyone.

…

New privacy resource: When do Australian Government agencies need to conduct a privacy impact assessment?
Date: 2020-09-14
Author: Office of the Australian Information Commissioner (OAIC)

The Office of the Australian Information Commissioner (OAIC) has released a privacy resource to assist Australian Government agencies to determine when they need to conduct a privacy impact assessment.

Govt systems to be classed critical infrastructure under cyber reforms
Date: 2020-09-14
Author: IT News

Select federal government systems and networks will be classified critical infrastructure alongside nationally significant private sector systems, Home Affairs boss Mike Pezzullo has revealed.
Pending the passage of amendments to the Act and the co-design of sector-specific standards, the government expects the new cyber security obligations to come into effect in mid-2021.

Office 365 will let users view their quarantined phishing messages
Date: 2020-09-11
Author: Bleeping Computer

Microsoft is planning to allow Office 365 users to view and request the release of phishing messages automatically quarantined by the Exchange Online Protection (EOP) filtering stack.
This new capability is designed to make it possible for end-users to reclaim e-mails that have been accidentally marked as phishing or spam messages by Office 365 EOP.

Attacked by ransomware? Five steps to recovery
Date: 2020-09-15
Author: Help Net Security

Ransomware has been noted by many as the most threatening cybersecurity risk for organizations, and it’s easy to see why: in 2019, more than 50 percent of all businesses were hit by a ransomware attack – costing an estimated $11.5 billion. In the last month alone, major consumer corporations, including Canon, Garmin, Konica Minolta and Carnival, have fallen victim to major ransomware attacks, resulting in the payment of millions of dollars in exchange for file access.
While there is a lot of discussion about preventing ransomware from affecting your business, the best practices for recovering from an attack are a little harder to pin down.

Govt elevates consent in proposed public data sharing laws
Date: 2020-09-17
Author: ITNEWS

Federal government agencies will need to seek consent before releasing personal information to other governments and the private sector if it feasible to do so under proposed public sector data sharing laws.
An exposure draft of the Data Availability and Transparency Bill, published this week, reveals a change to the Office of National Data Commissioner (ONDC) policy position that embeds consent within one of five data sharing principles.

ESB-2020.3181 – iOS & iPadOS: Multiple vulnerabilities

Apple releases updates to address issues in iOS & iPadOS

ESB-2020.3165 – McAfee Email Gateway: Multiple vulnerabilities

Email Gateway update fixes path traversal vulnerability

ESB-2020.3128 – McAfee Agent: Multiple vulnerabilities

McAfee Agent update fixes four vulnerabilities in Windows and MacOs

ESB-2020.3175 – Drupal: Multiple vulnerabilities

Updates released to fix the multiple vulnerabilities identified in Drupal Core

ESB-2020.3151 – mysql:8.0: Multiple vulnerabilities

An update for the mysql:8.0 module is released for Red Hat Enterprise Linux 8

Stay safe, stay patched and have a good weekend!

The AUSCERT team