August 2024 – Page 2 – My information Resource (blog.mir.net)

Microsoft 365 Virtual Training Day: Fundamentals

Build the skills you need to create new opportunities and accelerate your understanding of Microsoft Cloud technologies at a free Microsoft 365 Virtual Training Day from Microsoft Learn. Join us at Microsoft 365 Fundamentals to learn how to simplify the adoption of cloud services while supporting strong security, compliance, privacy, and trust. Also, discover how applications such as Microsoft Teams and Microsoft Viva help improve productivity, facilitate collaboration, and optimize communications. After completing this training, you’ll be eligible to take the Microsoft 365 Fundamentals certification exam at 50% off the exam price. You will have the opportunity to: Find out how the productivity, collaboration, and endpoint management capabilities of Microsoft 365 empower people to stay connected and get more done across hybrid environments. Discover how Microsoft 365 security, compliance, and identity solutions help secure an entire digital estate, simplify compliance, and reduce risk. Explore the pricing models, licensing, and billing options available to meet the needs of your organization. Join us at an upcoming two-part Microsoft 365 Fundamentals event: Delivery Language: English Closed Captioning Language(s): English

September 05, 2024 \| 12:00 PM – 3:30 PM \| (GMT-05:00) Eastern Time (US & Canada) September 06, 2024 \| 12:00 PM – 4:00 PM \| (GMT-05:00) Eastern Time (US & Canada) September 16, 2024 \| 12:00 PM – 3:30 PM \| (GMT-05:00) Eastern Time (US & Canada) September 17, 2024 \| 12:00 PM – 4:00 PM \| (GMT-05:00) Eastern Time (US & Canada)
September 26, 2024 \| 12:00 PM – 3:30 PM \| (GMT-05:00) Eastern Time (US & Canada) September 27, 2024 \| 12:00 PM – 4:00 PM \| (GMT-05:00) Eastern Time (US & Canada)


Visit the Microsoft Virtual Training Days website to learn more about other event opportunities.

NIST to Revise Special Publication 800-135 Rev. 1 | Recommendation for Existing Application-Specific Key Derivation Functions

In July 2023, NIST’s Crypto Publication Review Board initiated a review process for NIST Special Publication (SP) 800-135 Revision 1, Recommendation for Existing Application-Specific Key Derivation Functions (2011) and received public comments.

In May 2024 NIST proposed revising SP 800-135 Rev. 1. No public comments were received in response to that proposal.

NIST has decided to revise SP 800-135 Rev. 1. See the full announcement for more details, links to comments received, and ways to monitor future developments.

Announcing NIST Symposium on Unleashing AI Innovation, Enabling Trust

NIST will convene a hybrid symposium on September 24-25, 2024, in Washington, D.C., to discuss recent efforts by the NIST AI Innovation Lab (NAIIL) to help unleash artificial intelligence (AI) innovations in ways which enable trust.

Participants will learn about recent and ongoing efforts, and contribute to NIST’s vision for the work ahead, including opportunities to expand its collaborations with the AI community. Responsible for a variety of NIST’s AI efforts and headquartered within the agency’s Information Technology Laboratory, NAIIL advances AI measurement methods and guidelines, including their incorporation into international standards.

The 1.5 day event will take place at The George Washington University in Washington, D.C. Limited in-person and unlimited remote participation is available. The symposium will feature discussions about the most recent developments and next steps in key issues relating to AI innovation and trust. Sessions will build on NIST’s past, ongoing, and planned efforts.

For more information and to register: https://www.nist.gov/news-events/events/2024/09/unleashing-ai-innovation-enabling-trustRegister Now

Implementation Challenges in Privacy-Preserving Federated Learning

In this post, we talk with Dr. Xiaowei Huang, Dr. Yi Dong, Dr. Mat Weldon, and Dr. Michael Fenton, who were winners in the UK-US Privacy-Enhancing Technologies (PETs) Prize Challenges. We discuss implementation challenges of privacy-preserving federated learning (PPFL) – specifically, the areas of threat modeling and real world deployments.

In research on PPFL, the protections of a PPFL system are usually encoded in a threat model that defines what kinds of attackers the system can defend against. Some systems assume that attackers will eavesdrop on the system’s operation but won’t be able to affect its operation (a so-called honest but curious attacker), while others assume that attackers may modify or break the system’s operation (an active or fully malicious attacker). Weaker attackers are generally…

Read the Blog

Microsoft Security Virtual Training Day: Defend Against Threats with Extended Detection and Response

Build the skills you need to create new opportunities and accelerate your understanding of Microsoft Cloud technologies at a free Microsoft Security Virtual Training Day from Microsoft Learn. Join us at Defend Against Threats with Extended Detection and Response to learn how to better protect apps and data in Microsoft 365 Defender, Microsoft Defender for Endpoint, and Microsoft Sentinel. You’ll get an in-depth view into attack disruption, incidents and alerts, and best practices for investigation and incident management. You will have the opportunity to: Learn how to investigate, respond to, and hunt for threats using Microsoft Defender and Microsoft Sentinel. Understand how integrating Microsoft 365 Defender and Microsoft Sentinel enhances security and response time. Discover how to help mitigate threats across your entire infrastructure with Microsoft Security tools and solutions. Join us at an upcoming Defend Against Threats with Extended Detection and Response event:

September 17, 2024 | 12:00 PM – 3:15 PM | (GMT-05:00) Eastern Time (US & Canada)

Delivery Language: English
Closed Captioning Language(s): English

REGISTER TODAY >

NIST Releases Second Public Draft of Digital Identity Guidelines for Final Review

When we need to show proof of identity, we might reach for our driver’s license — or perhaps, sooner than many of us imagine, we may opt for a digital credential stored on a smartphone. To ensure we can use both novel and time-tested methods to prove our identities securely when accessing essential services, the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has updated its draft digital identity guidance.

The draft Digital Identity Guidelines (NIST Special Publication [SP] 800-63 Revision 4 and its companion publications SPs 800-63A, 800-63B and 800-63C) have been updated to reflect the robust feedback that NIST received in 2023 as part of a four-month-long comment period and yearlong period of external engagement.

The 2024 NY Metro Joint Cyber Security Conference

September 26^th (Conference & Workshop)
@ Microsoft Technology Center – 11 Times Square, NYC

The 2024 NY Metro Joint Cyber Security Conference will be held on September 26^th, celebrating our 11th year featuring keynotes, panels and sessions aimed at educating everyone on the various aspects of information security and technology. Workshops featuring in-depth extended classroom-style educational courses to expand your knowledge and foster security discussions will take place virtually post-conference.
As co-chair of this event I invite you to join us. I will be speaking at the event
Conference link is InfoSecurity.NYC (nymjcsc.org)
Workshop links should go to https://infosecurity.nyc/workshop.htm

InfoSecurity.NYC: Who We Are
The New York Metro Joint Cyber Security Conference is a collaborative event cooperatively developed, organized and sponsored by the leading information security industry organizations and chapters.

Driven by the collaboration between members of this coalition, the strength of organizational membership, the provision of desirable CPE credits and the concurrence of National Cyber Security Awareness Month, the NYMJCSC was — once again — well-attended by members of the information technology, information security, audit, academic, and business communities.

You can register here

For the Conference https://infosecurity-nyc-2024.eventbrite.com

For the Workshops: 2024 NY Metro Joint Cyber Security Workshops Tickets, Fri, Sep 27, 2024 at 8:30 AM | Eventbrite

iVerify Discovers Android Vulnerability Impacting Millions of Pixel Devices Around the World

Verify discovered an Android package, “Showcase.apk,” with excessive system privileges, including remote code execution and remote package installation capabilities, on a very large percentage of Pixel devices shipped worldwide since September 2017
The application downloads a configuration file over an unsecure connection and can be manipulated to execute code at the system level
The application retrieves the configuration file from a single US-based, AWS-hosted domain over unsecured HTTP, which leaves the configuration vulnerable and can makes the device vulnerable
The app vulnerability leaves millions of Android Pixel devices susceptible to man-in-the-middle (MITM) attacks, giving cybercriminals the ability to inject malicious code and dangerous spyware
Cybercriminals can use vulnerabilities in the app’s infrastructure to execute code or shell commands with system privileges on Android devices to take over devices to perpetrate cybercrime and breaches
Removal of the app is not possible through a user’s standard uninstallation process, and at this time, Google has not offered a patch for the vulnerability
It appears that Showcase.apk is preinstalled in Pixel firmware and included in Google’s OTA image for Pixel devices
The app is not enabled by default, but there might be multiple methods to enable it. The iVerify research team investigated one method requiring physical access

Read the Full Details Here

Open for Public Comment | NIST Publication on Implementing Zero Trust Architecture

The NIST National Cybersecurity Center of Excellence (NCCoE) has released the fourth version of our preliminary draft practice guide, Implementing a Zero Trust Architecture (NIST SP 1800-35), for public comment. This publication outlines results and best practices from the NCCoE effort to work with 24 vendors to demonstrate end-to-end zero trust architectures.

As an enterprise’s data and resources have become distributed across on-premises and multiple cloud environments, protecting them has become increasingly challenging. Many users need options to access information across the globe, at all hours, across devices. The NCCoE is addressing these unique challenges by collaborating with industry participants to demonstrate 17 sample zero trust architecture implementations (applied to a conventional, general-purpose enterprise IT infrastructure).

Detailed technical information for each sample implementation can serve as a valuable resource for technology implementers by providing models they can replicate. The lessons learned from the implementations and integrations can help organizations save time and resources.

Starting with this release, we are introducing our traditional NIST SP 1800-35 document in two formats; one “High-Level Document in PDF Format” and one “Full Document in Web Format.”

The document in PDF format is meant to serve as introductory reading with insight into the project effort (since it provides a high-level summary of project goals, reference architecture, various ZTA implementations, and findings).

The web format document provides in-depth details about technologies leveraged, their integrations and configurations, and the use cases and scenarios demonstrated. It also contains information on the implemented security capabilities and their mappings to the NIST Cybersecurity Framework (CSF) versions 1.1 and 2.0, NIST SP 800-53r5, and security measures outlined in “EO-Critical Software” under Executive Order 14028.

We Want to Hear from You!

We welcome your input and look forward to your comments by September 30, 2024. We also invite you to join our mailing list to receive news and updates about this project.

Month: August 2024