Snipping/Cropping Tools Expose Data; CISA Tool Useful for Securing Microsoft Services; Reminder to Check Your Supply Chain Security Processes

I’m sure similar issues will now be found with lots of image, video and audio editing tools and applications. This bug points out there really is a developer mindset (“I can easily just move the IEND chunk to crop this data file” without thinking “and I need to delete the cropped data, too”) vs. a good tester methodology of “I wonder if I can still find any of the ‘cropped’ data.” This is why we see so much success from managed bug bounty programs even after 20 years of secure development life cycles and developer training.

John Pescatore

Practitioner's note: To demonstrate this in Windows, hit <Win><Shift>s to snag part of the screen. In the Snipping Tool itself, save that screen grab, and look at the size of the file. Now, in the Snipping Tool, use the Crop tool to cut off the bottom half of the image. Save it again with the same file name. The file size has not changed! Much of the original data is still present in the cropped file. You can mitigate this specific case by saving the cropped image with a new name (or wait for a patch).

Christopher Elgee

Redaction has to be done right. Tools like the snipping tool, or your photo editor on your smartphone make it easier, but aren't necessarily comprehensive. Recall when it was learned a popular PDF editor used layers for redaction, but if you selected the text or exported the text, the redacted information was available? This time it's about understanding what meta-data is in an image. As the researcher noted, a small, redacted, thumbnail sized image was still 5MB. While we have been advising co-workers to make a new image or document which contains the resulting image, you're probably going to have to show them what meta data remains on a redacted photo (such as the full photo in the embedded thumbnail), to make it real.

Lee Neely

applications take advantage of open-source libraries. A flaw in one or more of those libraries can lead to a vulnerable application. A SBOM will at least list the software libraries used by the application, helping to identify and close cross-platform vulnerabilities.

Curtis Dukes

Credential compromise continues to be a viable attack vector, and while I have stated the number one protection is implementing strong MFA, there is a lot more you need to do to provide comprehensive coverage, to include: actively managing accounts/identity as well as securing systems, only allowing the access needed when needed, revoking it as soon as that need expires. This guidance does a good job of laying out the threat and tying the actions to the risks you're mitigating. Review the “:actions to take now” checklists and consider where you are against those items; don't just read Appendix I – you'll want to read the rest to get your ideas flowing.

Lee Neely

Given the proliferation of many different platforms and applications not just on organisations’ internal networks but also in the cloud and with third party vendors, this guidance framework is a very timely and welcome resource. As a large number of breaches can be related to the abuse of accounts and authentication mechanisms I strongly recommend the majority those response for cybersecurity in their organization read the guidance.

Brian Honan

Identity and Access Management (IAM) underpins access for every IT enterprise. It is a core component in building a zero-trust architecture. Creating a best-practices guide for administrators is a good thing. For the ‘Cliff Notes’ version, see Controls 5 and 6 from the CIS Critical Security Controls.

Curtis Dukes

As someone very interested in the IAM space, I am happy to see general guidance for companies. This is a very good thing and dovetails nicely with the large number of installations we see using Azure AD.

Moses Frost