CISA Scolds Microsoft; Ivanti Promises to do Better; xz-utils Backdoor Open Source Community Response; Help Us Improve NewsBites

I think this quote from the CSRB report sums it up: Throughout this review, the Board identified a series of Microsoft operational and strategic decisions that collectively point to a corporate culture that deprioritized both enterprise security investments and rigorous risk management. During this review time frame Microsoft announced their Secure Future Initiative focusing on the required internal culture change is a pre-requisite for that being anything more than a marketing campaign.

John Pescatore

Security culture (or lack thereof) was emphasized in the report at least 12 times. Security is no longer just a technical issue but a people and ultimately cultural issue. Kudos to Microsoft for being so open and cooperative with the CSRB in creating the report.

Lance Spitzner

This was not a single event but a combination of events, from a compromised laptop in an acquired company which wasn't verified prior to connection to the corporate network to those old MFA tokens. Take the issues outlined in the report and see if you have any similar gaps. Don't omit culture from your consideration. Not just secure day one but remaining so always, with verification and incentives if possible.

Lee Neely

This is an excellent report and I encourage you to read it. It highlights to me that Microsoft need to have another Bill Gates Trustworthy Computing moment but focused on Trustworthy Cloud Computing.

Brian Honan

Another CEO admitting a need for a security culture change for focus on making sure their products are secure but this time from a security product vendor. To make sure these culture changes are more than just posters in the lunch room, any security vendor should show results of measurable progress, such as third-party security testing/review of all products. Here's an idea: no security product company should be allowed to use the terms AI or machine learning in their marketing/advertising unless they go at least 12 months without a vulnerability with a CVSS score above 7.

John Pescatore

Real culture change takes time. Even so, kudos to Ivanti publicly stating they'll hit this head on. Which means you need to trust but verify when it comes to your Ivanti products.

Lee Neely

An open letter is merely the first step in changing the culture to that of security accountability. Bill Gates did something similarly in 2012 that ushered in the era of trustworthy computing. What comes after the letter is what matters, and that takes leadership that doesn't prioritize revenue and valuation over basic software security.

Curtis Dukes

As more details emerge on this near miss, it's clear this was a nation-state backed supply chain attack. Why so? The level of sophistication employed, the patience in building the supply chain attack, the use of cryptography to protect the exploit, the social engineering to include use of sock-puppet accounts. Lots of lessons learned here; many that are also applicable to commercial software configuration control processes.

Curtis Dukes

This is an interesting feature that may help with one of the current, fundamental, web application security issues. While there are some "workarounds" that try to fix this issues, a standard approach will make implementation easier.

Johannes Ullrich

Creating cookies and tokens which will only work on the device/browser they were created with seems like it'd already be a thing wouldn't it? While this won't change overnight, having Google behind this proposed standard should provide the needed drive to make that happen sooner than later.

Lee Neely

Using compromised credentials is one of the easiest methods attackers employ for initial access. By binding authentication to the device, it forces the evildoer to be local on the device, where defensive protections can kick in to protect the device and enterprise. One potential stumbling block will be a dependency on use of a TPM for storage. Here's hoping the trial goes well and DBSC becomes mainstream.

Curtis Dukes

One of the interesting side effects of the outage was advice to be nice to the hotel staff as so much isn't working and there is little they can do. I'm going to remember that one next time I run into a systems down situation. As systems are being restored and still offline since last Friday, this has the markings of a ransomware attack. The latest from Omni is that most of their systems are back online. They stop short of a target date for restoring everything. While tricky, it's not a bad idea to let folks know your target date for service restoration to manage expectations as well as increase transparency.

Lee Neely

The $5,000 bounty is Wordfence's largest bounty to date. Given the publicity, unpatched versions will be targeted. Make sure you're updated. Yup, unsafe input handling strikes again. And the maintainers had the patch out in less than a week after being notified. SQLi/input validation has to be table stakes. At this point both the free and paid versions of Wordfence have rules to prevent the exploit.

Lee Neely

Not a lot of deets on the attack. Suffice it to say that state and local government continue to be targets. This is the second such ransomware event for Jackson County, having paid a ransom in 2019. It strengthens the argument not to pay a ransom as it only incentives evildoers to revisit for another payout.

Curtis Dukes

You have heard advice about taking steps to protect folks in high risk locations but not a lot about what that means. And this includes free as well as reduced cost resources, tools and security communities. As an exercise, consider having your team divide up the list from CISA and report out on relevance of each item.

Lee Neely

A very useful guide from CISA. The UK's National Cyber Security Centre (NCSC) also has a very useful and similar guide: https://www.ncsc.gov.uk/collection/defending-democracy

Brian Honan

A helpful library but ultimately, the high-risk communities need the resources and skills to implement the cybersecurity advice. As a part of the security community, we collectively must automate cybersecurity best practices.

Curtis Dukes