October is National Cybersecurity Awareness Month, an annual campaign to raise awareness about cybersecurity. Building resilience in critical infrastructure is crucial to national security. The essential infrastructure systems that support our daily lives—such as electricity, financial institutions, and transportation—must be protected from cyber threats.

NCCIC encourages users and administrators to review the following:

• Your Part in Protecting Critical Infrastructure,
• Critical Infrastructure Cyber Community Voluntary Program webpage, and
• Critical Infrastructure Sectors.

This product is provided subject to this Notification and this Privacy & Use policy.

The Federal Trade Commission (FTC) has released an announcement promoting the first International Charity Fraud Awareness Week (ICFAW). FTC, the National Association of State Charities Officials, and state and international partners coordinated this effort to raise awareness about donating wisely to charities. ICFAW will feature resources and tips on various topics—including giving after natural disasters, telemarketing solicitations, privacy, and online giving—hosted on FTC’s Twitter and Facebook accounts.

NCCIC encourages consumers to review FTC’s announcement and the following resources for more information:

• Make Your Donations  Count video
• Charity Scams article
• Avoiding Social Engineering and Phishing Attacks tip

This product is provided subject to this Notification and this Privacy & Use policy.

The United Kingdom's (UK) National Cyber Security Centre (NCSC) has released its Annual Review for 2018, which provides a snapshot of their work from September 1, 2017, to August 31, 2018. NCSC provides enhanced services to protect the UK against cybersecurity threats.

NCCIC encourages users and administrators to review NCSC’s 2018 Annual Review for more information.

This product is provided subject to this Notification and this Privacy & Use policy.

libssh has released security updates addressing a vulnerability affecting libssh versions 0.6 and above. A remote attacker could exploit this vulnerability to take control of an affected system.

NCCIC encourages users and administrators to review the libssh Security Release for additional information and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Microsoft has released a security update to address a vulnerability in the Yammer desktop application. A remote attacker could exploit this vulnerability to take control of an affected system.

NCCIC encourages users and administrators to review the Microsoft Security Advisory and apply the necessary update.

This product is provided subject to this Notification and this Privacy & Use policy.

Drupal has released security updates addressing multiple vulnerabilities in Drupal 7.x and 8.x. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review Drupal's Security Advisory and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Cisco has released security updates to address multiple vulnerabilities affecting Cisco products. An attacker could exploit one of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review the Cisco Security Advisories and Alerts webpage and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

The Federal Bureau of Investigation (FBI) has released an article on building a digital defense against phishing scams targeting electronically deposited paychecks. In these schemes, scammers use phishing emails to direct employees to fraudulent websites and collect their work credentials. Scammers then use victims’ credentials to replace legitimate direct deposit information with their own account details.

NCCIC encourages users to review the FBI Article and NCCIC Tip on Avoiding Social Engineering and Phishing Attacks for more information. If you believe you have been a victim of these scams, report it to the FBI’s Internet Crime Complaint Center at www.ic3.gov.

This product is provided subject to this Notification and this Privacy & Use policy.

VMware has released security updates to address a vulnerability in ESXi, Workstation, and Fusion. An attacker could exploit this vulnerability to take control of an affected system.

NCCIC encourages users and administrators to review VMware Security Advisory VMSA-2018-0026 and apply the necessary updates.

This product is provided subject to this Notification and this Privacy & Use policy.

Google has released Chrome version 70.0.3538.67 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system.

NCCIC encourages users and administrators to review the Chrome Releases page and apply the necessary update.

This product is provided subject to this Notification and this Privacy & Use policy.