Month: February 2023

 Patch your VMware ESXi 

Servers running the popular
virtualization hypervisor VMware ESXi have come under attack from at least one
ransomware group over the past week, likely following scanning activity to
identify hosts with Open Service Location Protocol (OpenSLP) vulnerabilities.

Specifically, threat actors have
been taking advantage of unpatched systems vulnerable to CVE-2020-3992 and CVE-2021-21974 that, when
exploited, can allow remote code execution.

Of the incidents observed thus
far, a ransomware-as-a-service (RaaS) group known as Nevada, appears to
be responsible ― although their ransom note shares many similarities with
Cheerscrypt, a ransomware threat that targeted ESXi in early- to mid-2022.

 

Join us for a new security digital event – Microsoft Secure on March 28, 2023 8:30 AM Pacific Time (UTC-08:00). Registration is now open. Why join Microsoft Secure? By joining our very first Microsoft Secure, you’ll: ·        Be among the first to see what an AI-driven future means for cybersecurity. ·        Gain insights from experts, including Vasu Jakkal, Bret Arsenault, Charlie Bell, Joy Chik, and many more. ·        Get actionable steps from breakout sessions on extended detection and response (XDR), multicloud security, cloud-managed endpoints, Zero Trust, built-in security configurations and more. ·        Connect with your peers and have your product and strategy questions answered by Microsoft experts in a live chat Q&A. Register now to catch our upcoming announcements. Be sure to follow Microsoft Security on LinkedIn, Twitter, and Blog for the latest news and event information. Thank you,

 The initial public draft of NIST Special Publication (SP) 800-201,
NIST Cloud
Computing Forensic Reference Architecture, is now
available for public comment. This document addresses the need to support a
cloud system’s forensic readiness, which is the ability to quickly and
effectively collect digital evidence with minimal investigation costs.

The document presents a reference architecture to help users
understand the forensic challenges that might exist for an organization’s cloud
system based on its architectural capabilities, as well as the mitigation
strategies that might be required. The reference architecture is both a
methodology and an initial implementation that can be used by cloud system
architects, cloud engineers, forensic practitioners, and cloud consumers to
analyze and review their cloud computing architectures for forensic readiness.

The public comment period for this
initial public draft is open through March 31, 2023. See
the publication
details for a copy of the draft and instructions for submitting
comments.

NOTE:
A call for patent claims is included on page ii of this document. For
additional information, see the Information
Technology Laboratory (ITL) Patent Policy–Inclusion of Patents in ITL
Publications.

Read
More

 In August 2021, NIST’s Crypto Publication Review
Board announced the review of NIST Special Publication (SP) 800-38E, Recommendation
for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on
Storage Devices. In response, NIST received public comments.

NIST proposes to update SP 800-38E to
address the editorial suggestions in the public comments. In particular, the
updated publication will mention the security vulnerability that results when
the two AES (sub)keys are improperly generated to be identical, as discussed in
Annex C.I of Implementation
Guidance for FIPS 140-3 and the Cryptographic Module Validation Program.

The updated SP 800-38E would be published without a period of
public comment.

Submit your comments on
this decision proposal by March 10, 2023. See the
full announcement,
which includes NIST’s rationale for this proposal and instructions for
submitting comments.

Read
More

 NIST is extending the public comment due date to February
27, 2023, for the initial working draft (iwd) of NIST Special
Publication (SP) 800-55r2, Performance Measurement Guide for Information
Security. See the publication
details for a copy of the draft and instructions for submitting
comments.

Read
More

 Today, NIST is publishing Federal Information Processing Standard
(FIPS) 186-5, Digital Signature
Standard (DSS), along with NIST Special Publication (SP)
800-186, Recommendations
for Discrete Logarithm-based Cryptography: Elliptic Curve Domain Parameters. 

FIPS 186-5 specifies three techniques for the generation and
verification of digital signatures that can be used for the protection of data:

1. Rivest-Shamir-Adleman (RSA)
   Algorithm
2. Elliptic Curve Digital
   Signature Algorithm (ECDSA)
3. Edwards Curve Digital Signature
   Algorithm (EdDSA)

The Digital Signature Algorithm (DSA), which was specified in
prior versions of FIPS 186, is retained only for the purposes of verifying
existing signatures. 

The companion document, NIST SP 800-186, specifies the set of
recommended elliptic curves. In addition to the previously recommended
Weierstrass curves, there are two newly specified Edwards curves included for
use with the EdDSA algorithm. Edwards curves provide increased
performance, side-channel resistance, and simpler implementation when compared
to traditional curves. While NIST SP 800-186 includes the specifications
for elliptic curves over binary fields, these curves are now deprecated, and the
use of other (prime) curves is strongly recommended.

The algorithms in these standards are not expected to provide
resistance to attacks from a large-scale quantum computer. Digital
signature algorithms that will provide security from quantum computers will be specified
in future NIST publications. For more information, see the Post-Quantum
Cryptography Standardization project.

Read
More

 

If you own a computer, watch the news, or spend virtually any time online these days you have probably heard the term “phishing.” Never in a positive context…and possibly because you have been a victim yourself. Phishing refers to a variety of attacks that are intended to convince you to forfeit sensitive data to an imposter. These attacks can take a number of different forms; from spear-phishing (which targets a specific individual within an organization), to whaling (which goes one step further and targets senior executives or leaders). Furthermore, phishing attacks take place over multiple channels or even across channels; from the more traditional email-based attacks to those using voice – vishing – to those coming via text message – smishing. Regardless of the type or channel, the intent of the attack is the same – to exploit human nature to gain control of sensitive information (citation 1). These attacks typically make use of several techniques including impersonated websites, attacker-in-the-middle, and relay or replay to achieve their desired outcome. Read More

The Microsoft 365 cloud environment benefits from an extensive monitoring and security infrastructure. Using machine learning and human intelligence that looks across worldwide traffic can rapidly detect attacks and allow you to reconfigure almost in real time.   None of the following scenarios apply to my org, and I’m ready to move forward with my migration.