For CIRMA Liability-Auto-Property pool members:
All Cyber Liability incidents should be reported immediately to Mark Budzyna, Senior Manager of Special Services and Property Claims at:
Business: 203.946.3722 Cell: 203.804.6902 (For After-Hours Emergencies) Email: mbudzyna@ccm-ct.org
CIRMA places a comprehensive Cyber Insurance program through an A.M. Best A rated carrier for our Liability-Auto-Property (LAP) Pool Members to help protect them in the event of a cyber event. CIRMA LAP Pool Members have access to liability coverage, forensics investigation and breach management services from best-in-class breach responders with experience in computer forensics, data breach notification, credit and ID monitoring, and legal counsel. View the flyer
CIRMA has also developed a number of risk management resources, including regional training programs and E-Learning Center training, Cybersecurity whitepaper, and Cyber Security Resources Best Practices Guide to help our members manage this risk. CIRMA's Cyber News & Alerts service provides IT departments and municipal and school leaders current cyber alerts from MS-ISAC, the Multi State Information Sharing and Analysis Center and U.S. Homeland Security. > Click here to SUBSCRIBE to CIRMA's Cyber News and Alerts Today!
The Cyber Disruption Response Plan will be incorporated as an annex to the State Response Framework, and is a roadmap for state, local, and private sector entities on how and when to report a cyber incident, as well as an outline of emergency response actions to be taken depending on the severity of the disruption and its potential impact on the state and its communities. The CDRP is a companion document to the Cyber Incident Response Plan, which outlines specific technical response actions. The Quick Reference Guide consists of two charts found in the CDRP, and is intended to provide readily available guidance in a fast moving incident. The Communications Flow Matrix outlines the flow of information in situations that are likely to affect public health, safety, or confidence. It is recommended that you add contact information for the key partners to whom you would report a cyber incident, including the CT Intelligence Center, which can be reached at CTIC@ct.gov. The Cyber Security Threat Level Matrix is a summary of the five distinct cyber threat levels, and provides general guidance regarding the communication and anticipated response activities for each of the levels. The CDRP provides more detailed response actions for each threat level. Cyber Security Response PlanCyber Response Quick Response Quick Reference
New Election Security Resources
The Center for Internet Security released A Handbook for Elections Infrastructure Security aimed at providing a tool for both election officials and their technical staff. The handbook is broken into three parts that address the risks to elections infrastructure, the architecture of elections systems, and security best practices and controls. The best practices and controls take into account associated implementation costs and are tiered according to asset class (Device, Process, Software, User), priority (high and medium), and the applicable CIS Control(s). The handbook also provides security best practice examples from state and local organizations, as well as procurement guidance and links to additional security resources. For assistance implementing these recommendations and best practices, CIS provides an Excel worksheet to guide technical staff through the process.
CYBER SECURITY WEBINARS
CIRMA Cyber Webinar Series: PHISHING> Click here to view the WEBINAR According to experts, local public entities are often specifically targeted for cyber-attacks due to the vulnerable and open nature of their operations. Cyber-attacks, data theft, ransomware, spoofing, and phishing incidents are escalating in type, number, and creativity -- with cyber criminals exploiting human nature as much as the technical vulnerabilities of hardware and software systems. The CIRMA Cyber Webinar Series will address each of the most common forms of cyber-attacks affecting Connecticut municipalities, beginning with phishing attacks.
CIRMA Cyber Webinar Series: SOCIAL ENGINEERING> click here to view the WEBINAR Social Engineering is quickly becoming one of the leading forms of manipulation by cyber criminals. Through social engineering cyber criminals take advantage of human interaction to use personal information to gain your trust. With the vulnerability of local public entities due to the open nature of their operations, it is ever so important to be educated on the type of information you put on the web that could end in you being a target for a cyber-attack. This final segment of the CIRMA Cyber Webinar Series will help you to tighten up your personal accounts and bring tips on how to recognizing false communication to help to avoid your networks being compromised.
CYBERSECURITY RESOURCES & BULLETINS
Federal Bureau of Investigation - Public Service Announcement12-15-20 - Transition to Distance Learning Creates Opportunities for Cyber Actors to Disrupt Instruction and Steal Data
U.S. Department of Homeland Security - CISA Cyber + Infrastructure
New Jersey Cybersecurity & Communications Integration Cell (NJCCIC):
Multi-State Information Sharing and Analysis Center (MS-ISAC):
Cybersecurity and Infrastructure Security Agency (CISA):
07-12-22 - Critical Patches Issued for Microsoft Products, July 12, 2022
07-12-22 - Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution, July 12, 2022
06-30-22 - Joint Cybersecurity Advisory: AA22-181A - #StopRansomware: MedusaLocker, June 30, 2022
06-14-22 - Critical Patches Issued for Microsoft Products, June 14, 2022 - PACTH NOW
06-08-22 - People's Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
06-03-22 - Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control
05-18-22 - Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control
05-10-22 - Critical Patches Issued for Microsoft Products, May 10, 2022 - PACTH NOW
04-20-22 - Joint Cybersecurity Advisory: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
04-13-22 - Joint Cybersecurity Advisory: APT Cyber Tools Targeting ICS/SCADA Devices
04-12-22 - Critical Patches Issued for Microsoft Products, April 12, 2022 - PACTH NOW
03-15-22 - Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability
03-08-22 - Critical Patches Issued for Microsoft Products, March 8, 2022 - PATCH NOW
03-03-22 - CISA Adds 95 Known Exploited Vulnerabilities to Catalog
To receive the Green Alerts listed below, please email Jacqueline Smith, Marketing & Creative Design Associate, at jsmith@ccm-ct.org
08-01-22 - Malware IPs and Domains Observed by MS-ISAC
07-25-22 - Malware IPs and Domains Observed by MS-ISAC
07-18-22 - Malware IPs and Domains Observed by MS-ISAC
07-12-22 - Malware IPs and Domains Observed by MS-ISAC
07-06-22 - Malware IPs and Domains Observed by MS-ISAC
06-28-22 - Short Form Analytic Report: Latest QakBot Campaign Infects Multiple SLTTs
06-27-22 - Malware IPs and Domains Observed by MS-ISAC
06-21-22 - Malware IPs and Domains Observed by MS-ISAC
06-13-22 - Malware IPs and Domains Observed by MS-ISAC
06-06-22 - Malware IPs and Domains Observed by MS-ISAC
05-30-22 - Malware IPs and Domains Observed by MS-ISAC
05-23-22 - Malware IPs and Domains Observed by MS-ISAC
05-16-22 - Malware IPs and Domains Observed by MS-ISAC
05-09-22 - Malware IPs and Domains Observed by MS-ISAC
04-25-22 - Malware IPs and Domains Observed by MS-ISAC
04-18-22 - Malware IPs and Domains Observed by MS-ISAC
04-11-22 - Malware IPs and Domains Observed by MS-ISAC
04-03-22 - Malware IPs and Domains Observed by MS-ISAC
03-28-22 - Malware IPs and Domains Observed by MS-ISAC
03-14-22 - Malware IPs and Domains Observed by MS-ISAC
03-07-22 - Malware IPs and Domains Observed by MS-ISAC
CIRMA Cyber Security Whitepaper
Cyber Security - PDF
CIRMA's E-Learning Center Program
How to get started
Visit the CIRMA E-Learning Center to log in and take the courses. CIRMA offers online training courses on a wide variety of topics. If you are not currently registered, please email your contact information to Martin Connelly at mconnelly@ccm-ct.org or call 203-946-3743.
Download The Many Faces of Cybercrimes (pdf)