The National Security Agency has released new guidance urging operators of critical infrastructure to adopt zero-trust security principles in operational technology systems. In its October 8 announcement, the agency identifies risks affecting industrial systems that support energy, water, agriculture, public health and government operations. Unlike conventional corporate networks, operational technology frequently controls physical equipment and processes, making service disruption a potential public-safety issue. The guidance recommends continuous verification of users, devices and communications rather than assuming that activity inside a network is trustworthy. Although primarily directed toward national-security and defense-related systems, the recommendations have broader relevance for infrastructure operators. The release reflects growing concern that cybersecurity failures can extend beyond stolen information to interruptions in services communities depend upon.

Cisco has released security updates addressing 35 vulnerabilities across multiple networking and enterprise products, including more than a dozen classified as critical. According to SecurityWeek's October 8 report, affected products include Meraki, NX-OS, License On-Prem and Application Policy Infrastructure Controller systems. Several vulnerabilities could allow unauthorized access, denial-of-service attacks, privilege escalation or remote code execution, depending on the product and configuration. Some of the most serious weaknesses could be exploited without authentication. Cisco says it is not aware of exploitation of the newly disclosed vulnerabilities in the wild. The disclosures underscore the continuing importance of maintaining enterprise network infrastructure, where a security weakness in a foundational system can create exposure across multiple connected services.

The Defense Manpower Data Center has begun notifying roughly 3 million people that their personal information was exposed after unauthorized users gained access to a file-sharing server holding military personnel records. SecurityWeek reporter Eduard Kovacs reported that the attackers may have had access for about nine months, while the affected server contained unencrypted files that included Social Security numbers and other sensitive military records. The vulnerability was discovered on July 16, but notification letters only began going out in September, creating a long gap between exposure and individual awareness. The breach puts another federal cybersecurity failure inside a familiar pattern: agencies collect highly sensitive information because service members and employees have little choice but to provide it, while the consequences of weak protection fall on the people whose identities are exposed. SecurityWeek details the breach and the Defense Manpower Data Center’s notification here.

Separate breaches at Clover Health Investments and AngMar Management Services affected 138,677 and 126,196 people, respectively, according to October 5 reporting citing federal disclosures. Those counts total 264,873 affected records across the incidents, without establishing that every record represents a different person. The intrusions occurred in July; the current development concerns reporting of their disclosed scope and notifications. Clover previously told securities regulators that social engineering compromised three employee accounts. AngMar’s exposed information included medical and identifying details. The incidents show how access through health-plan employees and healthcare support operations can expose patient information beyond the systems where treatment itself occurs.