Author: blogmirnet

The NCCoE Buzz: Steering Toward Mobile Driver’s Licenses

Steering Toward Mobile Driver’s Licenses The NCCoE Buzz: Mobile Security Edition is a recurring email on timely topics in mobile device cybersecurity and privacy from the National Cybersecurity Center of Excellence’s (NCCoE’s) Mobile Device Security project team. Mobile Drivers License Have you ever thought about having your driver’s license on your mobile phone? In the last two decades, mobile devices have revolutionized the way we live, work, and connect with each other across the globe. From communication and information access to productivity and entertainment, the prevalence of mobile devices in our everyday lives is undeniable. As the world rapidly evolves and technology redefines how we interact with our surroundings, a significant innovation that holds the potential to transform our daily lives is the Mobile Driver’s License (mDL). This digital evolution of the traditional physical driver’s license brings numerous benefits and conveniences to drivers but can also present security and privacy challenges that we must address. mDL Definition An mDL is a digital representation of a driver’s license on a mobile device. It contains all the essential information found on a physical driver’s license, including the driver’s name, photo, date of birth, and driving privileges. An mDL also has the capability to be updated in real time. Learn More: mDL Project at the National Cybersecurity Center of Excellence (NCCoE) Experts at the NCCoE are working with industry, government agencies, and academic institutions to research and implement international standards (ISO/IEC 18013-5 and ISO/IEC 18013-7) on mDLs. These standards are being developed to provide improved usability, convenience, and stronger security in digital identity management. The mDL project will define and facilitate one or more reference architectures that protect privacy, provide secure implementation, enable equity, allow widespread adoption, and facilitate ease-of-use by: Building an open-source reference implementation that will retrieve digital driver’s license information from the mobile device Demonstrating different use cases to access the ID stored on the device Developing a practice guide that includes mDL design, architecture, and leading practices If you would like more information on the Digital Identities – mDL project, visit the mDL webpage.   The NCCoE Mobile Device Security Team NIST Cybersecurity and Privacy Program Questions/Comments about this notice: [email protected] NCCoE Website questions: [email protected]

Comment on Proposed Competency Areas

Final reminder to submit comments! Last month, NICE released a new proposed list of NICE Framework Competency Areas for comment. This list includes updates that were made based on feedback received during the comment period for a previously released draft list. Comments on the proposed Competency Areas should be submitted by email to [email protected] by 11:59 pm ET on August 5, 2023. Take Action: Read the Summary of Updates and proposed List of Competency Areas Submit comments to [email protected] Visit the NICE Framework Resource Center
RELATED DOCUMENTS
NICE also recently published NIST Internal Report (NISTIR) 8355, NICE Framework Competencies: Preparing a Job-Ready Cybersecurity Workforce. This publication describes Competency Areas as included in the NICE Framework, providing information on how Competency Areas are defined and how they can be used. Additionally, a Competency Areas Authoring Guide is now available. The publication accompanies the previously released Task Knowledge Skill (TKS) Statements Authoring Guide for Workforce Frameworks. These authoring guides and other materials that support a standard approach to developing workforce frameworks can be found in the Playbook for Workforce Framework, which details workforce framework components and provides developers with supporting resources. 

NIST Requests Public Comments on SP 800-135 Revision 1, Recommendation for Existing Application-Specific Key Derivation Functions

NIST Requests Public Comments on SP 800-135 Revision 1, Recommendation for Existing Application-Specific Key Derivation Functions

NIST is in the process of a periodic review and maintenance of its cryptography standards and guidelines.  

Currently, we are requesting public comments on the following publication:

NIST requests feedback on all aspects of SP 800-135 Rev. 1. 

The public comment period is open through September 27, 2023. Send comments to [email protected] with “Comments on SP 800-135 Rev. 1” in the subject line. 

Comments received in response to this request will be posted on the Crypto Publication Review Project site after the due date. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. See the project site for additional information about the review process. 

Read More

NIST Requests Public Comments on FIPS 202, “SHA-3 Standard,” and SP 800-185, “SHA-3 Derived Functions”

NIST is in the process of a periodic review and maintenance of its cryptography standards and guidelines.  

Currently, we are requesting public comments on the following publication:

NIST requests feedback on all aspects of these publications, including the security and usefulness of the specified functions and their various parameterizations. 

The public comment period is open through October 27, 2023. Send comments to [email protected] with “Comments on FIPS 202″ or “Comments on SP 800-185” in the subject.  

Comments received in response to this request will be posted on the Crypto Publication Review Project site after the due date. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. See the project site for additional information about the review process. 

Read More

Microsoft Security Virtual Training Day: Security, Compliance, and Identity Fundamentals

Grow your skills at Security Virtual Training Day: Security, Compliance, and Identity Fundamentals from Microsoft Learn. At this free, introductory event, you’ll gain the security skills and training you need to create impact and take advantage of opportunities to move your career forward. You’ll explore the basics of security, compliance, and identity—including best practices to help protect people and data against cyberthreats for greater peace of mind. You’ll also learn more about identity and access management while exploring compliance management fundamentals. You will have the opportunity to: Learn the fundamentals of security, compliance, and identity. Understand the concepts and capabilities of Microsoft identity and access management solutions, as well as compliance management capabilities. Gain the skills and knowledge to jumpstart your preparation for the certification exam. Join us at an upcoming two-part event:
Wednesday, August 30, 2023 | 9:00 AM – 12:40 PM (GMT-08:00) Pacific Time (US & Canada)
Thursday, August 31, 2023 | 9:00 AM – 11:10 AM (GMT-08:00) Pacific Time (US & Canada)

Delivery Language: English
Closed Captioning Language(s): English
 
REGISTER TODAY >

Microsoft Security Virtual Training Day: Defend Against Threats and Secure Cloud Environments

Grow your skills at Security Virtual Training Day: Defend Against Threats and Secure Cloud Environments from Microsoft Learn. At this free event, you’ll learn to perform advanced hunting, detections, and investigations, and remediate security alerts with Microsoft Defender and Microsoft Sentinel. Using automated extended detection and response (XDR) in Microsoft Defender and unified cloud-native security information and event management (SIEM) through Microsoft Sentinel, you’ll learn to confidently perform investigations and remediations to help defend against threats. You will have the opportunity to: Learn how to investigate, respond to, and hunt for threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender. Use Microsoft Defender for Cloud to perform cloud security posture management and to help protect cloud workloads. Understand ways to help protect people and data against cyberthreats with Microsoft technologies. Join us at an upcoming two-part event:
Tuesday, August 22, 2023 | 2:00 PM – 4:45 PM | (GMT-05:00) Eastern Time (US & Canada)
Wednesday, August 23, 2023 | 2:00 PM – 4:00 PM | (GMT-05:00) Eastern Time (US & Canada)

Delivery Language: English
Closed Captioning Language(s): English
 
REGISTER TODAY >

Apple Releases Security Updates for Multiple Products

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device.

CISA encourages users and administrators to review the following advisories and apply the necessary updates.

Become a Microsoft Purview Data Lifecycle and Records Management Ninja

What is Data Lifecycle Management and Records Management?

Microsoft Purview Data Lifecycle Management and Microsoft Purview Records Management help to govern your Microsoft 365 data for compliance or regulatory requirements.

Microsoft Purview Data Lifecycle Management manages risk and liability by only keeping what you need and deleting what you don’t across your entire digital estate, whereas Records Management manages high value content following the specialized workflows required to meet legal, business, or regulatory recordkeeping obligations.

Getting Started

Microsoft Purview Data Lifecycle and Records Management retains and deletes data. It manages content where users collaborate to prevent productivity loss and reduce risks with defensible disposal and rich audit trails. Learn about how to get started below.

Solution Guide

Do you need some inspiration? Check out these customer success stories.

Which license and permissions do I need for Data Lifecycle and Records Management?

Trials and setup guide

 

Retain and delete your data

How long to retain data and when to delete them is important, as keeping data longer or shorter than your business, legal, or regulatory requirements can cause you to be noncompliant. With Microsoft Purview Data Lifecycle and Records Management, you can apply retention policies and retention labels to locations across Microsoft 365 to keep your data compliant.

 

Other uses for retention labels

Other than applying retention and deletion to content with retention labels, you can also use retention labels to:

 

Use file plan to create and manage your retention labels

After you’ve decided to use retention labels to help you keep or delete files and emails in Microsoft 365, you might have realized that you have many and possibly hundreds of retention labels to create and publish.

Learn about how to use the file plan to bulk create and manage your retention labels.

 

Other ways to create and manage your retention labels

Although the recommended method to create retention labels at scale is by using the file plan from the Microsoft Purview compliance portal, you can also choose to use PowerShell and Graph API.

 

Trigger retention based on an event

Many times, retention is triggered not based the age of the content, but when a specific event occurs, such as when an employee departs, a contract expires, or when a project closes, learn about how to use event triggered retention to manage content across your organization related to the same employee, contract, or project.

 

Record retention label vs. Regulatory retention label

You can use retention labels to mark items as a record, or a regulatory record.

The difference between retention labels, and retention labels that mark an item as a record or regulatory record, are explained below:

By using retention labels to mark items as a record, you can implement a single and consistent strategy for managing immutable files across your Microsoft 365 environment.

 

Automatically apply a retention label to retain or delete content

One of the most powerful features of retention labels is the ability to apply them automatically to content that matches specified conditions. In this case, people in your organization don’t need to apply the retention labels, Microsoft 365 does the work for them.

You can automatically apply a retention label using:

Before you auto-apply your retention label to content, you can also use simulation mode for Data Lifecycle and Records Management to simulate the results as if the auto-labeling policy had applied your selected label, using the conditions that you defined. You can then refine your conditions for accuracy if needed and rerun the simulation.

 

Targeted retention to users, groups, and sites using adaptive scopes

Have you always wanted to apply retention dynamically based on common attributes and properties, rather than choosing specific users, groups, and sites and having to manually update them they change over time? Then adaptive scope is what you are looking for!

 

Scope the administration of Data Lifecycle Management

Microsoft Purview Data lifecycle management supports administrative units that have been configured in Azure Active Directory.

 

Customize what happens at the end of the retention period

When you configure a retention label to retain items for a specific period, you can specify what action to take at the end of that retention period.

You can choose from the built-in actions of permanently deleting the item, relabeling the item to a different retention label, deactivating the label, starting a disposition review, or running a Power Automate flow.

Review and manage the disposition of your records

Disposition review ensures that the correct retention has been applied to the content, and to identify if there are reasons to suspend the deletion due to litigation or that the content should be archived and retained instead.

 

Running a Power Automate flow at the end of the retention period

If you choose to run a Power Automate flow at the end of the retention period, you can customize notifications and approval processes.

 

Monitoring your retention labels and activities

After you have deployed your retention policies and retention labels, you can use the built in content explorer and activity explorer to monitor and understand retention activities.

 

When to use retention policies and retention labels instead of older features

If you need to proactively retain or delete content in Microsoft 365 for data lifecycle management, we recommend that you use Microsoft 365 retention policies and retention labels instead of the following older features.

 

Integration with Microsoft Syntex

Microsoft Syntex is a set of AI-powered cloud content management services. Microsoft Syntex puts content to work – optimizing your business processes and managing your content better. With Microsoft Syntex, you can apply retention labels to the documents that your models identify.

What’s next?

Now that you know about Data Lifecycle and Records Management, take the SC-400 exam to become a certified Microsoft Information Protection Administrator.

Additional Resources

Want more Microsoft Purview ninja training?

Updated macOS Security Guidance and Resources: NIST SP 800-219 Revision 1

NIST has released the final version of Special Publication (SP) 800-219 Revision 1, Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP). It provides resources that system administrators, security professionals, security policy authors, information security officers, and auditors can leverage to secure and assess macOS desktop and laptop system security in an automated way.

This publication introduces the mSCP, describes use cases for leveraging the mSCP content, and introduces a new feature of the mSCP that allows organizations to customize security rules more easily. The publication also gives an overview of the resources available on the project’s GitHub site, which provides practical, actionable recommendations in the form of secure baselines and associated rules and is continuously updated to support each new release of macOS.

Read More

CISA Releases Cybersecurity Advisory on Threat Actors Exploiting Citrix CVE-2023-3519

The Cybersecurity and Infrastructure Security Agency (CISA) released a Cybersecurity Advisory (CSA), Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells, to warn organizations about threat actors exploiting CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell on a critical infrastructure organization’s NetScaler ADC appliance. The webshell enabled the actors to perform discovery on the victim’s active directory (AD) and collect and exfiltrate AD data. The actors attempted to move laterally to a domain controller but network-segmentation controls for the appliance blocked movement. 

This CSA details tactics, techniques, and procedures (TTPs) shared with CISA by the victim.

If activity is detected, CISA strongly urges all critical infrastructure organizations follow the recommendations found within this advisory, such as prioritizing patching known exploited vulnerabilities like Citrix CVE-2023-3519.