FBI Warning On Zoom Security Issues and More Zoom Info; Microsoft Warns Hospitals of Vulnerabilities in VPN and Gateway Appliances

Today The Citizen Lab released the results of their examination of the security and privacy features in Zoom (https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/: Move Fast & Roll Your Own Crypto: A Quick Look at the Confidentiality of Zoom Meetings) Their findings back up the warnings from the FBI and raised several concerns over how encryption is enabled within the application. However, we need to remember that companies are using Zoom, and other conferencing platforms, to enable them to survive through the COVID19 pandemic and companies need to do a risk assessment that suits them. For many companies the warnings from the FBI and The Citizen Lab will be an acceptable risk for them, while others who may be discussing sensitive data it may not.

Brian Honan

The easy answer is there are more secure alternatives to Zoom and companies should be providing and recommending those. The real answer is that many employees working at home and their families will be using Zoom for the next few months. Security vendor Checkpoint recently put good safe use guidelines for using Zoom at (https://blog.checkpoint.com/2020/03/26/whos-zooming-who-guidelines-on-how-to-use-zoom-safely/: Who's Zooming Who? Guidelines on How to Use Zoom Safely) and SANS has released a secure work at home awareness kit at (https://www.sans.org/security-awareness-training/sans-security-awareness-work-home-deployment-kit: SANS Security Awareness Work-from-Home Deployment Kit) Zoom (see item below) has also pledged to make security job one over the next few months - much needed.

John Pescatore

Disclosing vulnerabilities should be done responsibly, and directly to the affected provider prior to a public blog posting to give them time to respond. Zoom has been working to accelerate addressing security issues discovered. Of late, the patches are released as quickly as 24 hours after issue discovery. These discovered issues have been resolved.

Lee Neely

For reasons of audience convenience, few Zoom meetings employ passwords. However, they are essential for many business applications. Be particularly careful about privileges granted to meeting participants.

William Hugh Murray

Zoom's founder came from Cisco where security is the top priority. He should have made security a top requirement from the start. I hope Zoom's Board of Directors is hearing the message - you can help by giving Zoom feedback about how important security is. Their feedback form is at https://zoom.us/feed

John Pescatore

Credit is due to Zoom for how quickly they responded to the issues raised and how openly they have communicated to their users. There are many lessons here for companies to learn on how they can improve their vulnerability management processes.

Brian Honan

Johannes Ulrich of SANS Internet Storm Center highlighted these vulnerabilities in his part of the SANS "Five Most Dangerous Attack Techniques and How to Prevent Them" keynote panel at the 2020 RSA Conference - you can see it at https://www.sans.org/the-five-most-dangerous-new-attack-techniques: The Five Most Dangerous New Attack Techniques). SANS will present the 2020 Threat Trends report that includes those 5 areas and more, on an April 28th webinar - info at https://www.sans.org/webcasts/top-attacks-threat-report-112665: SANS Top New Attacks and Threat Report.

John Pescatore

Terminate VPNs on the application, not the perimeter and not an on operating system. The additional design, setup, and administration will be more than offset by the reduction in risk.

William Hugh Murray

While some carriers, including AT&T, Verizon, Sprint and T-Mobile, have voluntarily implemented STIR/SHAKEN, sometimes a regulatory requirement is needed to get resources and commitment to implement security measures. Once implemented, carriers need to verify their solution works with other networks. The last step: users need devices which display the "Caller Verified" notification and have the notification enabled for their account.

Lee Neely

STIR/SHAKEN is the first critical step, providing call authentication - raising the bar against spoofing of the calling number. Congress finally acted on that, a good thing. The next step is another chance for the carriers to raise the bar through rapid voluntary action - the addition of better call analytics to detect malicious calls, even if they are coming from an authenticated calling number. Then apply those same major bar raisers to data traffic.

John Pescatore

Judicious use of multi-factor authentication reduces the value of captured credentials. Make sure that all entry points that accept those credentials have the same authentication requirements.

Lee Neely

The lodging industry is obviously hard hit by the travel restrictions to fight the pandemic. This would be a good time for lodging IT operations to upgrade the security of their IT systems, just as they will be upgrading sanitary protections at the facilities.

John Pescatore

Continue to queue up efforts to update services to support TLS 1.2 & 1.3 as regardless of when the support is deprecated, the perception will be a problem with your service rather than their browser.

Lee Neely

Dealing with entities that are trolling domain registries and sending users messages designed to modify their registration is common; attackers are trying to target less savvy associates for success. Additionally, make sure that your registrar accounts use two-factor authentication, your domains are locked, and DNSSEC is enabled. GoDaddy support will help you analyze any unexpected messages if you cannot verify they are genuine on your own.

Lee Neely

Plug-ins are a major source of vulnerability in WordPress use and come with few indicators of quality. They may even put other applications at risk. Minimize and maintain those that you use; consider focused penetration testing of them.

William Hugh Murray

It should not come as too big a surprise that the conclusions and recommendations of the exercise report focus on communications among the organizations rather than on the security and resilience of those organizations.

William Hugh Murray