Faith-Based Daily Awareness Post 28 August 2024

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.

Blended Threats: Security Companies Targeted by Ransomware Actors.

Members who are on FB-ISAO cybersecurity alerts list will be familiar with the daily ransomware data leak site reports. We encourage members to review those lists, not just for potential references to their own organizations (we’ve seen multiple FBOs recently), but also to potential vendors the organization may work with. Today, a Delaware-based security vendor Security Instrument appeared as victim of Cactus ransomware group. Their website indicates they work with houses of worship.

Analyst Comments:

Beyond conducting thorough vendor risk assessments before entering into business relationships, organizations should constantly be mindful of what data another entity have about your organization. While an attack to a security vendor could potentially halt services like remote video monitoring and access control, sensitive data such as floor plans, guard schedules, and video camera coverage of a facility could also be at risk. If security vendors are impacted, members will want to do an audit of information accessed and determine if risk assessments or security plans/resources need to be updated.