Every week there’s a new headline that’s supposed to change everything. I went back through the last few weeks of incidents and… honestly, nothing new happened. Every one of them comes back to something on the boring list.
Even the scariest one sounds new until you read it. CrowdStrike tied attacks on at least nine major South Korean banks to one 26-year-old amateur using AI chatbots. Investigators pieced together who he allegedly was partly because he didn’t secure his own systems. “The models are interchangeable,” per CrowdStrike’s Adam Meyers (Washington Post, via Slashdot). AI lowered the bar for attackers but it didn’t change what stops them.
Perhaps a better framing is that the attackers got cheaper, so the cheap defenses matter more. My list, with a recent receipt for each:
#1: Patch your front door first. Ivanti patched two more Connect Secure zero-days that have been chained in attacks since at least Oct 1. Volexity says the attacker deployed no malware, re-exploited for every command, and tampered with logs to get past Ivanti’s own Integrity Checker. Shadowserver sees 5,000+ exposed instances, and CISA has flagged 38 Ivanti vulns as exploited since Nov 2021 (BleepingComputer). This is the whole point of the Zero Trust talk I gave at WBA… your edge devices are not a trust boundary.
Do this Monday: list every VPN, firewall and gateway facing the internet, and give each one a named patch owner with a 72-hour (or less) SLA for anything on CISA’s KEV list. Past that window, assume breach!
#2: Know what you own. GitLab patched a max-severity RCE on Oct 12 and CISA confirmed exploitation. Three weeks later Shadowserver still tracks 1,000+ unpatched exposed servers (BleepingComputer). You can’t patch the server the dev team stood up and forgot about.
Do this Monday: compare an external scan of your IP space against your asset list and chase every mismatch. Continuously manage your attack surface.
#3: Notice when the alarms go quiet. Attackers took control of cooling units at up to 700 French supermarkets, and they disabled the alarm systems before changing the thermostats. Danfoss said it found the flaws last year and had “long recommended” updates. A second wave has since hit stores in Sweden, Belgium and Luxembourg (The Guardian). Banks don’t have freezer aisles, but we do have HVAC, cameras, ATMs and alarm panels that a vendor maintains. “The alarms went silent” would make a great tabletop inject.
Do this Monday: ask every vendor with remote access what’s patched, who can log in, and who gets paged if the alerts stop.
#4: Use MFA that can’t be phished. Microsoft is retiring SMS and voice authentication for Entra ID workforce tenants starting Feb 1, 2027, because they’re “vulnerable to phishing and SIM-swap attacks.” It recommends passkeys, and admins can find affected users with its SMS/Voice Policy Scanner script (BleepingComputer). As I’ve said before, somebody’s going to click. Plan for it.
Do this Monday: run the scanner, count who’s still on SMS or voice, and set a passkey date well before Feb 1.
#5: Know what you trust. Private keys for eight eMudhra intermediate CAs were compromised. Apple started blocking them Oct 19, but command-line tools on macOS like curl and git check /etc/ssl/cert.pem and can still accept those certs until a future update (Apple). “Trusted” is a list someone else wrote, and you inherit it, but you should still understand it.
Do this Monday: find where your tools keep their own CA bundles (macOS cert.pem, Java, Python, appliances) and name someone to watch for distrust notices.
None of this is new. That’s the point… the attackers are counting on the boring list staying boring.
Let me know what’s on your boring list.
