The National Institute of Standards and Technology’s National Cybersecurity Center of Excellence has released a new draft practice guide to help organizations monitor incoming internet data for evidence of malware and insider threats while using the latest version of the TLS protocol.

NIST said Tuesday the document aims to help companies in finance, healthcare and other industries implement the TLS 1.3 encryption protocol update while maintaining compliance with network monitoring and auditing regulations.

“TLS 1.3 is an important encryption tool that brings increased security and will be able to support post-quantum cryptography,” explained Cherilyn Pascoe, director of the NCCoE.

The document was developed over the past several years at the NCCoE in collaboration with the Internet Engineering Task Force to provide technical methods for auditing incoming internet traffic while using TLS 1.3.

“This collaborative project focuses on ensuring that organizations can use TLS 1.3 to protect their data while meeting requirements for auditing and cybersecurity,” Pascoe said.

Comments on the draft practice guide are due April 1.

The Office of the National Cyber Director published its annual findings about the projects, challenges and ecosystem of open-source software.

The 2023 year-end report evaluates the Biden administration’s Open-Source Software Security Initiative, which is part of the National Cybersecurity Strategy, the White House announced Tuesday.

The document enumerates efforts to engage the open-source software community in the past year, including issuing a request for information on securing the technology’s foundations, sustaining governance and communities within the sector, fostering innovation and strengthening international collaborations.

In a statement, ONCD pledged to work together with software developers and the private sector to “invest in the development of secure software, including memory-safe languages and software development techniques, frameworks, and testing tools.”

The Cybersecurity and Infrastructure Security Agency has released new mitigations to address vulnerabilities in Ivanti’s Connect Secure and Policy Secure platforms and warned that threat actors have developed workarounds to current detection methods.

CISA said Tuesday cyberthreat actors continue to exploit vulnerabilities in Ivanti’s remote access virtual private network devices to capture credentials or drop webshells to enable remote access to compromised enterprise networks.

The agency is urging federal civilian agencies running Ivanti Connect Secure and Policy Secure gateways to perform continuous threat hunting on any systems connected to the devices and monitor authentication, account usage and identity management services.

Agencies must also isolate potentially exposed systems from any enterprise resources as much as possible.

CISA recently released an emergency directive warning against weaknesses in two Ivanti devices that enable malicious threat actors to exfiltrate data and establish persistent system access.

Common behaviors associated with ransomware campaigns will be tackled in the sixth round of MITRE Engenuity‘s ATT&CK Evaluations, a program that seeks to assess the capabilities and performance of enterprise cybersecurity solutions.

MITRE said Tuesday that applications are already being accepted for the latest round of ATT&CK Evals, whose focus on ransomware stems from the malware type’s persistence as “one of the most significant cybercriminal threats across industry verticals,” according to Amy Robertson, the program’s principal cyber threat intelligence analyst.

Due to the Democratic People’s Republic of Korea targeting macOS, the latest Evals round will also tackle Apple‘s laptop and desktop operating system.

“The DPRK has emerged as a formidable cyber threat, and they have progressively been expanding their focus to macOS as they work to evade international sanctions,” Robertson noted.

For his part, ATT&CK Evals General Manager William Booth said he and his organization were thrilled to expand the scope of the program to include macOS, a move that underscores a “commitment to comprehensive, platform-diverse assessments.”

Results of the evaluations will be released in the fourth quarter of 2024. Those interested in undergoing assessment have until April 30 to apply.