WIREDGOV

The UK yesterday joined international allies to call out malicious cyber activity carried out by China.

Criminal charges against Chinese nationals and arrests of Malaysian nationals have been announced by the US Department of Justice (DoJ) following a campaign of attacks targeting governments and businesses.

The Foreign Secretary, Dominic Raab, yesterday said:

“Today we have another example of the Chinese using malicious cyber activity for criminal ends. We condemn the attempted attacks against governments and businesses. This kind of opportunistic and reckless behaviour in cyberspace is wholly unacceptable.

“The UK will continue to counter those conducting such cyber attacks, and work with our allies to hold perpetrators to account.”

A variety of mitigations that would help to defend against the threats outlined in the indictment are available on the NCSC website, including advice on how to;

• Use multi-factor authentication (MFA) or two-factor authentication (2FA) to reduce the impact of password compromises
• Protect your devices and networks by keeping them up to date. Use the latest supported versions, apply security patches promptly, use antivirus and scan regularly to guard against known malware threats.
• Protect the management interfaces of your critical operational systems. In particular, use browse down architecture to prevent attackers easily gaining privileged access to your most vital assets.
• Set up a security monitoring capability so you are collecting the data that will be needed to analyse network intrusions.
• Review and refresh your incident management processes
• Restrict intruders' ability to move freely around your systems and networks. Pay particular attention to potentially vulnerable entry points eg third-party systems with onward access to your core network. During an incident, disable remote access from third-party systems until you are sure they are clean.
• Adding applications to your 'allow list'. If supported by your operating environment, consider putting permitted applications onto your 'allow list'. This will help prevent malicious applications from running.
• Use antivirus. Keep any antivirus software up to date, and consider use of a cloud-backed antivirus product. These provide better threat intelligence and more advanced analysis. Ensure that it is also capable of scanning MS Office macros.
• Further information on mitigating malware: Invest in preventing malware-based attacks across various scenarios.