Per the notice below, the New York State Department of Financial Services (DFS) has issued a cybersecurity threat alert.
To: All DFS-Regulated Entities
Subject: Cybersecurity Threat Alert – Social Engineering of Institutions’ IT Help Desk Personnel |
|
|
|
| The New York State Department of Financial Services (DFS) alerts all regulated entities to take immediate action to thwart a cybersecurity threat currently being used to gain unauthorized access to information systems. DFS has seen evidence that threat actors are targeting IT help desks and call centers using, among other tactics, voice-altering technology in conjunction with information obtained on the internet about the identities of personnel to convince help desks to reset passwords and divert multi-factor authentication (MFA) to new devices. In light of these risks, DFS-regulated entities must be on high alert for suspicious communications, especially via phone, and implement secure controls to prevent threat actors from easily changing passwords and intercepting SMS text or messaging applications to obtain MFA. IT and help desk personnel in particular must remain cautious of individuals or vendors requesting support related to accessing information systems. Please alert personnel, especially those staffing help desks and call centers, about these potential social engineering attempts and ensure they are especially diligent in authenticating the identity of anyone requesting changes in authentication factors. For further details and best practices, please refer to the U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA) guidelines on avoiding social engineering and phishing attacks: Avoiding Social Engineering and Phishing Attacks | CISA. If others in your organization should receive this cybersecurity information, please forward this e-mail. Additional interested parties may also opt-in to receive "Cybersecurity Updates" from DFS. |
|
|
|
