DHS Telework Security Guidance; Oracle Patches 405 Bugs

While this guidance is set to expire at the end of 2020, and is U.S. Government focused, it provides an approach to accessing cloud and on-premise services with sufficient visibility to ensure security and compliance requirements are met, irrespective of your industry or having a formal TIC.

Lee Neely

The Trusted Internet Connect 3.0 update is still in draft but added a lot of much-needed flexibility to make it clear how agencies can do remote user access and use cloud services and still stay secure and stay compliant. Between the Managed Trusted Internet Protocol Services (MTIPS) offered by TIC ISPs on the government EIS and other contracts, and the numerous FedRAMP certified cloud-based Security as a Service offerings, government agencies have both guidance and options to make long lasting improvements in both security and productivity for remote work forces.

John Pescatore

This update offers another chance to validate your ability to regression test and patch remotely, including teleworker systems. With the current enhanced remote-work state, regression testing is emphasized as in-person assistance for remediation is more complicated, if not impossible. Postponing updates is sub-optimal as we are seeing increases in malfeasance by those taking advantage of the current situation.

Lee Neely

Travelers should be aware that airports are targets of miscreants and vulnerabilities for the traveler. Airport (WiFi) networks, websites, and (USB 5v) power should be used with caution. Prefer cellular broadband and battery power.

William Hugh Murray

Judicious review of third-party applications, including plugins for your content management site, is prudent. Payment card processing plugins remain a popular target, particularly with the current world crisis. Beyond keeping plugins updated, make sure that your site and servers are also secured to prevent alternate avenues of attack. Remove unused administrative accounts, ensure strong authentication is used on active accounts, uninstall unused plugins.

Lee Neely

This is only one more of many vulnerabilities in WordPress plugins. Most WordPress plugins come without any measure or warranty of quality and should be used only with risk assessment, scrutiny, and maintenance.

William Hugh Murray

Because of the problems Murray and Neely point out, along with the fact that most WordPress users have no IT or cybersecurity expertise, WordPress and its content management system competitors have been the primary vector by which important organizations (including large numbers of city and state agencies and major non-profits) have been compromised.

Alan Paller

Good to see take-downs of malicious web sites and "attacks as a service" sites now, when everyone is much more dependent on online services. Even better to see ISPs turn on "cleaner pipe" services for free during these times.

John Pescatore

Read the VMware security advisory for specifics on applicability of the vulnerability. The fix is to update affected 6.7 installations to 6.7u3f.

Lee Neely

There was once a myth that "cloud makes location obsolete." It has never been true. For many reasons, location of data centers still matters. All the major enterprise-class Software as a Service and Infrastructure as a Service providers have offered data center location selection (not always for free). It is good to see Zoom listening to enterprise needs and following suit. Zoom also continues to release security improvements - important to keep up with them and ratchet up the safety of your use of Zoom.

John Pescatore

Zoom is not the only video teleconference (VTC) service which routes through distributed data centers. While the primary focus for VTCs should be secure meeting configuration, if you are covering information with location or export controls, the region needs to be appropriate to avoid penalties.

Lee Neely

The leakage of video conferencing traffic in the network is a potential risk, but for most applications and environments, this risk does not compare to the risk of improper settings and misuse.

William Hugh Murray

FTP has been broken and a vulnerability for a generation. It is an orphan. There is hardly anything legitimate that is not available via an alternate service. Its inclusion in already porous browsers is one more reason to prefer application-specific clients.

William Hugh Murray