Australian Federal Police’s Post

It’s interesting that the Crowdstrike fix needs a good old-fashioned human to reboot the machine, but what if it can’t start up? Some machines won’t even boot and need a USB stick to recover. IT folks also have to fetch BitLocker recovery keys and local admin passwords, making things more complicated. Since it involves kernel drivers, it’s not something they can fix centrally. Recovery could take some time. We need to be patient and appreciate the IT teams working hard to bring everything back online. To make matters worse, ASD’s ACSC are warns about opportunistic hacker websites pushing malicious code as a fix. ⚠️💻

This is a big advantage to threat actors now trying to impersonate and enter as healers to the current situation. Super caution is the key for the customers trying to get their systems back in a hurry. Crowdstrike incident is a testimony to the state of QA teams in software development since the advent of AI. While AI can speed up the testing process(and save money) ensuring the quality and accuracy of AI-driven tests is crucial. There is still a need for human oversight to validate AI results, understand the context of issues, and handle complex scenarios that AI might not fully grasp. #AI #Crowdstrike #Cybersecurity #Outage #Supplychain #Criticalinfrastructure #QA

Cyber criminals often take advantage of these situations. Be extra cautious of sites and people claiming to be tech support, especially if you’re working remotely and struggling to contact your actual IT support. Always verify with your employer's official resources and vendor advice, before sharing any info. Stay informed, stay safe.

👩💻IT departments are not the only ones having a busy weekend. 🥷Opportunistic threat actors are salivating at the thought of exploiting vulnerable businesses. Stay vigilant‼️ 🛟 There will be a massive re think of what “IT disruption” and “cyber security” actually means on organisational risk registers. Work to be done ✅ #controlrisks #digitalrisks

While the #CrowdStrike disruption was not a #cybersecurity event, these types of major incidents do create chaos - and chaos provides opportunity for malicious actors. As indicated in this post from the Australian Signals Directorate, there are "a number of malicious websites and unofficial code are being released claiming to help entities recover from the widespread outages caused by the CrowdStrike technical incident. ASD’s ACSC strongly encourages all consumers to source their technical information and updates from official CrowdStrike sources only." A major part of any organization's ability to successfully manage an incident is trust and training. Do the employees of the organization have the training to understand what to do and what not do to in an incident? Do the employees know who to trust and also have enough trust in their own teams to resolve their problems? #resilience #incidentmanagement #cyber https://lnkd.in/g_hEd-XZ

SCAM WARNING- Tech outage Please be aware of any scams or phishing attempts in the coming days, following the global IT outage affecting Crowdstrike. You should only get your technical advice from official Crowdstrike sources and if in doubt, double check. These scams could present themselves as emails, text messages, social media messages or phone calls. Double check any communication that looks like it could be from CrowdStrike or Microsoft, and offer to resolve any tech issues. Please also check in on anyone you know who may be particularly vulnerable or susceptible to scams. Things to look out for: · The email address, social media account or phone number looks suspicious. For example, phone numbers may be from outside Australia, email addresses may have a different suffix, or extra numbers or letters added or be from a non-official address. You shouldn’t receive this support through social media. · The message you receive or person you speak to is vague or doesn’t make sense. In written messages, keep an eye on significant typos. · Emails or messages contain links to unknown websites. On email, hover over any links with your mouse prior to clicking on them. Don’t click on web addresses on text messages that you don't recognise or that look unofficial. · The message instructs you to provide personal information including passwords or financial info. For more information, or to report any scams, please visit Scamwatch.gov.au https://lnkd.in/gtHwvpPx

An important message in relation to the IT outage many institutions are currently grappling with!! For those impacted by both the outage and then installation of malicious code "fixes" it will be important to capture these as separate risk incidents in your risk management information systems. Related, but separate! The first incident is an IT system failure and the second is a cybersecurity incident. Why not group as a single event? The categorisation, causal factor(s) and control failures will be distinctly different and specific to each separate event. Therefore, each incident may require different actions, management expertise and potential remediation timelines! If you're in the Cook Islands and would like to discuss the quality of your incident capture process or incident data in more detail, give me a call!

The agility & speed of fraudsters is terrifying. With firms starting to recover from the global IT outage, criminals have already launched scams. ASD has issued a warning to CrowdStrike users, warning of malicious websites & unofficial code being released & encouraging those impacted to source their technical information & updates from official CrowdStrike sources. #fraud | #scams | #crime | #crowdstrike | #operationalresilience

Be cautious of where you seek help. The ASD has reported multiple websites distributing malicious code under the guise of helping with the CrowdStrike-related Windows outages. Always source technical updates directly from the official vendor. If in doubt, consult a trusted expert to verify the information. This applies to any cyber-attack or outage affecting security products. #Cybersafety #Framesecure #Crowdstrike #ASD #Essential https://lnkd.in/gDvSACmu

As I always say, threat actors are quick to jump on a crisis!!! Please make sure you are following the advice from your CIO/CTO and don’t try and fix things yourself. If you are a small company, only follow the directives from Crowdstrike, like anything in life, there is no such thing as a silver bullet!!!!