Recently, the Federal Bureau of Investigation (FBI) released Operation Winter Shield. This document outlines critical actions organizations can take to enhance resilience against cyber intrusions, based on FBI recommendations.
Phish-Resistant Authentication:
- Implement phish-resistant methods like FIDO2 security keys for high-impact accounts and critical systems.
- Require number-matching and domain display for authenticator apps, avoiding push-only approvals.
- Eliminate SMS-based multi-factor authentication and disable legacy methods.
Vulnerability Management:
- Maintain a complete asset inventory with defined ownership and criticality.
- Set remediation timelines based on risk, prioritizing critical systems.
- Use authenticated internal scans and document exceptions with compensating controls.
End-of-Life Technology Management:
- Track end-of-life systems with a 12-month forecast and quarterly reviews.
- Replace or isolate EOL assets, applying compensating controls if necessary.
Third-Party Risk Management:
- Maintain a list of third parties with access and enforce strong authentication and least-privilege access.
- Require rapid breach notification and confirm data disposition upon contract changes.
Log Protection and Retention:
- Centralize and secure logs in a SIEM, retaining them for at least 12 months.
- Conduct quarterly reviews to identify gaps in log centralization.
Backup and Recovery:
- Follow the 3-2-1 backup rule, ensuring offline and immutable backups.
- Regularly test restoration processes and define recovery requirements.
Internet-Facing Systems Protection:
- Maintain a list of internet-reachable systems and remove unnecessary exposure.
- Disable direct internet-facing remote desktop access.
Email Security Enhancements:
- Implement DMARC, SPF, and DKIM for email authentication, progressing policies as alignment matures.
- Quarantine high-risk attachments and enable time-of-click link protection.
Administrator Privilege Management:
- Minimize administrator accounts and require just-in-time access from secured devices.
- Monitor privilege changes and remove local admin rights from user devices.
Incident Response Preparedness:
- Maintain a concise incident response playbook and conduct quarterly tabletop exercises with stakeholders.
- Include law enforcement contacts for rapid coordination during incidents.
Link to the full FBI flyer: Operation Winter Shield Ten Actions to Improve Cyber Resilience.pdf
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5207428251321676122
Comments