Mike Walz Wants to go on the offense with China, Rip & Replace Approved with NDAA, Clop Threatens 66 Cleo Attack Victims

Good morning, Security Gang, and Merry Christmas!

Today’s episode of the CyberHub Podcast was a special one, featuring only four critical stories with an in-depth analysis of an interview with incoming National Security Advisor Mike Walz.

If you’re listening while shopping or traveling, thank you for tuning in! Grab a coffee, settle in, and let’s dive into the cybersecurity stories shaping our world.

Key Highlights and Stories

Mike Walz on Space and Cybersecurity

James shared insights from a Ben Shapiro Sunday Special interview featuring Mike Walz, the incoming National Security Advisor under President Trump. Walz emphasized two key domains: space and cybersecurity.

• Space: Walz underlined the strategic importance of space, citing the pivotal role SpaceX has played in bolstering U.S. dominance. He warned of China’s capability to disrupt critical satellite infrastructure, which could cripple industries ranging from agriculture to global finance.

• Cyber: Walz criticized the U.S.’s defensive cybersecurity posture, advocating for a doctrine shift to offensive strategies akin to Cold War-era mutual deterrence policies. He referenced the Volt Typhoon incident as a wake-up call for adopting a more aggressive approach to safeguarding critical infrastructure.

James highlighted Walz’ understanding of cybersecurity challenges and speculated on potential structural changes, such as creating a dedicated Cyber Force, akin to the Space Force, and consolidating federal cybersecurity responsibilities under CISA.

National Defense Authorization Act (NDAA) and Cybersecurity Funding

President Joe Biden signed the NDAA, which allocates $3 billion to help telecom firms remove insecure equipment, a direct response to the Salt Typhoon breach. The bill also calls for an independent study on establishing a U.S. Cyber Force.

• This marks a regulatory and strategic shift in 2025, aligning with Walls’ push for a dedicated cybersecurity branch.

Marriott and Starwood Settlements

After eight years, the FTC reached a resolution with Marriott and Starwood over three major data breaches affecting 344 million customers. The settlement requires Marriott to:

• Implement comprehensive InfoSec measures, including encryption, MFA, and incident response plans.

• Minimize personal data retention and enhance logging and monitoring.

• Conduct independent audits for 20 years and promptly report breaches.

The hotel chain also faces $52 million in fines. James criticized the delayed resolution and questioned the practical impact of the consent order.

Clop Ransomware Group’s Holiday Extortion

The Clop ransomware group escalated attacks ahead of the holidays, targeting Clio customers. They released partial lists of 66 companies refusing to negotiate and threatened full disclosures within 48 hours.

• James emphasized the importance of shifting from traditional "security onion" models to securing business processes to counter such targeted attacks effectively.

Adobe ColdFusion Vulnerability

Adobe issued a patch for a ColdFusion path traversal vulnerability (CVE-2024-53961). Exploits allow arbitrary file system access if specific packages are installed. James urged immediate patching to prevent potential breaches.

James signed off with heartfelt holiday wishes, encouraging listeners to take time away from devices to create meaningful memories. He also previewed exciting plans for 2025, including new podcast content, community-building initiatives, and cybersecurity knowledge-sharing resources.

Action List for Cybersecurity Professionals

1. Strategize for Offensive Cyber: Review and prepare for potential doctrine shifts emphasizing offensive cybersecurity tactics.

2. Adopt Space-Cyber Integration: Recognize space infrastructure as a critical cybersecurity frontier.

3. Utilize NDAA Funding: If in telecom, leverage allocated resources to replace insecure equipment.

4. Enhance Compliance: For businesses, ensure compliance with data protection and InfoSec best practices, learning from Marriott’s settlement.

5. Patch Vulnerabilities: Immediately address Adobe ColdFusion vulnerabilities to mitigate risks.

6. Prepare for Ransomware Risks: Focus on securing business processes and adopting proactive measures against ransomware.

Final Note: Merry Christmas and Happy Hanukkah to all! Let’s look forward to a transformative 2025 for cybersecurity. Stay safe, stay vigilant, and thank you for supporting the CyberHub Podcast. 🎄

✅ Story Links:

https://www.dailywire.com/episode/mike-waltz-member-exclusive

https://therecord.media/fcc-rip-and-replace-china-tech-tops-ndaa

https://www.securityweek.com/adobe-patches-coldfusion-flaw-at-high-risk-of-exploitation/

https://www.bleepingcomputer.com/news/security/ftc-orders-marriott-and-starwood-to-implement-strict-data-security/

https://www.bleepingcomputer.com/news/security/clop-ransomware-threatens-66-cleo-attack-victims-with-data-leak/

🔔 Subscribe now for the latest insights from industry leaders, in-depth analyses, and real-world strategies to secure your digital world. https://www.youtube.com/@TheCyberHubPodcast/?sub_confirmation=1

✅ Important Links to Follow:

👉Website:

👉Listen here: https://linktr.ee/cyberhubpodcast

✅ Stay Connected With Us.

👉Facebook: https://www.facebook.com/CyberHubpodcast/

👉LinkedIn: https://www.linkedin.com/company/cyberhubpodcast/

👉Twitter (X): https://twitter.com/cyberhubpodcast

👉Instagram: https://www.instagram.com/cyberhubpodcast

✅ For Business Inquiries: info@cyberhubpodcast.com

=============================

✅ About The CyberHub Podcast.

The Hub of the Infosec Community.

Our mission is to provide substantive and quality content that’s more than headlines or sales pitches. We want to be a valuable source to assist those cybersecurity practitioners in their mission to keep their organizations secure.

Tune in to our podcast Monday through Thursday at 9AM EST for the latest news.