Month: May 2023

Join this webinar to learn about the latest Azure Arc capabilities that will help you manage all your Kubernetes clusters and data services wherever they are, including consistent GitOps configurations for your clusters and a new connected mode for your data services. You’ll learn about: Deploying consistent apps through GitOps configurations. Managing and governing all your clusters wherever they are. The benefits of the new directly connected mode for data services.   Manage Kubernetes and Data Services Anywhere with Azure Arc   Tuesday, May 30, 2023 | 1:00 PM – 2:00 PM ET

Manage Kubernetes and Data Services Anywhere with Azure Arc

Register now >

Grow your skills at Security Virtual Training Day: Security, Compliance, and Identity Fundamentals from Microsoft Learn. At this free, introductory event, you’ll gain the security skills and training you need to create impact and take advantage of opportunities to move your career forward. You’ll explore the basics of security, compliance, and identity—including best practices to help protect people and data against cyberthreats for greater peace of mind. You’ll also learn more about identity and access management while exploring compliance management fundamentals. You will have the opportunity to: Learn the fundamentals of security, compliance, and identity. Understand the concepts and capabilities of Microsoft identity and access management solutions, as well as compliance management capabilities. Gain the skills and knowledge to jumpstart your preparation for the certification exam. Join us at an upcoming two-part event: Wednesday, June 7, 2023 | 10:00 AM – 1:45 PM | (GMT-05:00) Eastern Time (US & Canada) Thursday, June 8, 2023 | 10:00 AM – 12:00 PM | (GMT-05:00) Eastern Time (US & Canada) Delivery Language: English Closed Captioning Language(s): English

REGISTER TODAY >

Build skills that help you create new technology possibilities and explore foundational cloud concepts at Azure Virtual Training Day: Fundamentals from Microsoft Learn. Join us for this free training event to expand your knowledge of cloud models and cloud service types. You’ll also review Azure services focused on computing, networking, and storage. You will have the opportunity to: Understand the value of the shared responsibility model between consumers and cloud providers. Identify the tools and services that can help you manage, secure, and stay compliant across your Azure cloud ecosystem and in on-premises, hybrid, and multicloud environments. See how to use Azure services to rapidly expand your cloud footprint while maintaining data security and privacy. Join us at an upcoming two-part event: Thursday, June 1, 2023 | 10:00 AM – 12:45 PM | (GMT-05:00) Eastern Time (US & Canada) Friday, June 2, 2023 | 10:00 AM – 12:45 PM | (GMT-05:00) Eastern Time (US & Canada) Delivery Language: English Closed Captioning Language(s): English

REGISTER TODAY >

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency ( NSA), the US Cyber Command Cyber National Mission Force ( CNMF), the United Kingdom National Cyber Security Centre (NCSC UK), the Canadian Centre for Cyber Security (CCCS), Canada’s Communications Security Establishment ( CSE ), the Australian Cyber Security Centre (ACSC), and the New Zealand National Cyber Security Centre (NCSC NZ) released a Joint Cybersecurity Advisory  providing details on

The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s FSB for long-term intelligence collection on sensitive targets. To conduct operations using this tool, the FSB created a covert peer-to-peer (P2P) network of numerous Snake-infected computers worldwide. Many systems in this P2P network serve as relay nodes which route disguised operational traffic to and from Snake implants on the FSB’s ultimate targets. Snake’s custom communications protocols employ encryption and fragmentation for confidentiality and are designed to hamper detection and collection efforts.

Snake infrastructure has been identified in over 50 countries across North America, South America, Europe, Africa, Asia, and Australia, to include the United States and Russia itself. Although Snake uses infrastructure across all industries, its targeting is purposeful and tactical in nature. Globally, the FSB has used Snake to collect sensitive intelligence from high-priority targets, such as government networks, research facilities, and journalists. As one example, FSB actors used Snake to access and exfiltrate sensitive international relations documents, as well as other diplomatic communications, from a victim in a North Atlantic Treaty Organization (NATO) country. Within the United States, the FSB has victimized industries including education, small businesses, and media organizations, as well as critical infrastructure sectors including government facilities, financial services, critical manufacturing, and communications.

This Joint Cybersecurity Advisory provides background on Snake’s attribution to the FSB and detailed technical descriptions of the implant’s host architecture and network communications. This CSA also addresses a recent Snake variant that has not yet been widely disclosed. The technical information and mitigation recommendations in this Joint Cybersecurity Advisory are provided to assist network defenders in detecting Snake and associated activity. For more information on FSB and Russian state-sponsored cyber activity, please see the joint advisory Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure and CISA’s Russia Cyber Threat Overview and Advisories webpage.

Today, NIST has published an update of Federal Information Processing Standards Publication (FIPS) 197, Advanced Encryption Standard (AES). This update makes no technical changes to the algorithm specified in the standard, which was originally published in 2001.

However, this update includes extensive editorial improvements to the original version, including the following:

• The front matter is modernized (e.g., a foreword and abstract are added).
• Terms and symbols are defined more comprehensively and consistently.
• Formatting/typesetting is improved in a variety of ways.
• Unnecessary formalism is removed.
• Diagrams for the three key schedules are included.
• Some references were updated, and additional references are provided.

The changes are documented in greater detail in Appendix D of the updated FIPS. NIST originally proposed to update FIPS 197 in this manner on December 19, 2022.  The proposal included the release of a draft of the FIPS update for public comment, as well as a summary of the determination that no technical revisions were necessary. No public comments were received on the proposal nor the draft.

Previously, NIST had posted an initial call for comments on FIPS 197 on May 10, 2021, and received three sets of public comments. More details about this review are available from NIST’s Crypto Publication Review Project site.

Read More

In January 2023, NIST’s Crypto Publication Review Board initiated a review process for NIST Special Publication (SP) 800-132, Recommendation for Password-Based Key Derivation – Part 1: Storage Applications (December 2010). In March 2023, NIST proposed revising SP 800-132, in response to the public comments received.

NIST has decided to revise SP 800-132. See the full announcement for more details, links to comments received, and ways to monitor future developments.

Read More

Taken from Google introduces new cybersecurity career certificate (blog.google)

Our new Certificate builds on our existing Google Career Certificates in Data Analytics, Digital Marketing & E-commerce, IT Support, Project Management and UX Design. The Google Cybersecurity Certificate will teach learners how to identify common risks, threats and vulnerabilities, as well as the techniques to mitigate them. The program will prepare people for entry-level cybersecurity roles by providing hands-on experience with industry standard tools including Python, Linux and an array of security tools, including Security Information and Event Management (SIEM) programs. The certificate will also help prepare learners for the CompTIA Security+ exam, the industry-leading certification for cybersecurity roles. Learners will earn a dual credential when they complete both, improving their hireability.

To help bridge the opportunity gap and bring more diverse talent to cybersecurity, Google.org grantees like NPower and Hiring our Heroes, as well as nonprofits like Cyversity, Raices Cyber and Women in CyberSecurity (WiCyS), will offer the Google Cybersecurity Certificate. They’ll also provide learners with support such as professional coaching, interview prep and job placement assistance.

On June 6, 2023, from 1:00 – 2:00 PM EDT, NIST will host a webinar to provide an overview of the significant changes in NIST Special Publication (SP) 800-171, Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. 

This revision to NIST SP 800-171 represents over one year of data collection, technical analyses, customer interaction, redesign, and development of the security requirements and supporting information for the protection of Controlled Unclassified Information (CUI). 

Please join us in an author-led discussion of the changes proposed, the drivers behind the changes, and the critical areas where more input is needed. Space is limited, so register today! The webinar will be recorded and posted online after the event.

Please direct questions and comments to [email protected].

Read More

Today, NIST has published an update of Federal Information Processing Standards Publication (FIPS) 197, Advanced Encryption Standard (AES). This update makes no technical changes to the algorithm specified in the standard, which was originally published in 2001.

However, this update includes extensive editorial improvements to the original version, including the following:

• The front matter is modernized (e.g., a foreword and abstract are added).
• Terms and symbols are defined more comprehensively and consistently.
• Formatting/typesetting is improved in a variety of ways.
• Unnecessary formalism is removed.
• Diagrams for the three key schedules are included.
• Some references were updated, and additional references are provided.

The changes are documented in greater detail in Appendix D of the updated FIPS. NIST originally proposed to update FIPS 197 in this manner on December 19, 2022.  The proposal included the release of a draft of the FIPS update for public comment, as well as a summary of the determination that no technical revisions were necessary. No public comments were received on the proposal nor the draft.

Previously, NIST had posted an initial call for comments on FIPS 197 on May 10, 2021, and received three sets of public comments. More details about this review are available from NIST’s Crypto Publication Review Project site.

Read More

NIST Internal Report (IR) 8450, Overview and Considerations of Access Control Based on Attribute Encryption, is now available for public review and comment.

Access control based on attribute encryption addresses an issue with traditional public-key encryption (PKE) wherein keys need to dynamically change whenever access policies and/or attributes change, which could cause inefficient system performance.

Access control based on attribute encryption supports fine-grained access control for encrypted data and is a cryptographic scheme that goes beyond the all-or-nothing approach of public-key encryption. This document reviews the interplay between cryptography and the access control of attribute-based encryption, including the fundamental theories on which the scheme is based; the various main algorithms of IBE, CP-ABE, and KP-ABE; and considerations for deploying access control systems based on encryption.

The public comment period is open through June 23, 2023. See the publication details for a copy of the draft and instructions for submitting comments.

NOTE: A call for patent claims is included on page ii of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.

Read More