Approaches to Changing Cybersecurity Culture: Microsoft's Secure Future Initiative Progress Report and Jen Easterly on Responsibility for Quality and Clarity in Cybersecurity

Microsoft is setting the standard (and in many ways the blueprint) for truly building a strong security culture. Remember, culture is the shared attitudes, perceptions and beliefs of your organization. In this case, how invested are people in cybersecurity; do they believe in and prioritize it? Unlike behavior, it takes years to change an organization's culture but it appears Microsoft is committed to making that journey. I highly recommend you take the time to read this report, or if nothing else the summary, as their SFI initiative will be the case studies other organizations will be using for years to come.

Lance Spitzner

Microsoft claims to have dedicated 34,000 full-time engineers to SFI. The report confirms security is a core priority in all employee performance reviews as well as senior executive compensation plans. With luck this prevents recurrence of issues which lead to successful attacks by Chinese and Russian spies.

Lee Neely

Many good initiatives, especially nice to see 'integrating cybersecurity performance into the senior leadership team's compensation plans.' Back in 2003 or so, having product managers' compensation impacted by security performance really seemed to put the walk behind the talk after Bill Gates's 2002 'Security is Job 1' all-company email. Don't be fooled, though, by all the big numbers in the report. For example, having the equivalent of 34,000 full time employees focused on security is still only 15% of Microsoft's headcount. Higher than average, but probably not that high for the world's second-largest software vendor who is obviously one of the top attacker targets.

John Pescatore

Culture is inculcated over decades. Like quality, it is difficult to patch on. Shipping early in hopes of patching in necessary quality later is fundamental to Microsoft's identity. Getting to doing it "right the first time" from there will be a stretch.

William Hugh Murray

Lack of liability by software vendors is part but not all of the cybersecurity problem we definitely do have. Safer trucks and cars still require driver and mechanic training to stay safe. Well-built bridges require maintenance investments, or they fall down or are knocked down by new, larger, heavier freighter ships that were not well maintained. I have to admit, I would like to see 'Patch Tuesday' called 'Windows Defect Day.'

John Pescatore

Finally we are hearing leaders in cybersecurity calling things out as they should be. For too long we have romanticised cybersecurity actors, be they threat actors or defence actors. If we want to be taken seriously by businesspeople, we need to lose the militaristic jargon that is so pervasive in our industry and the trivialising of criminals by giving them cute nicknames - or indeed in the case of one vendor producing action dolls based on threat actor names.

Brian Honan

Patching is an inefficient way to achieve necessary quality. Given the numbers, it is not even effective.

William Hugh Murray

A fair point, shifting responsibility, but we must establish some guardrails else the cost to vendors becomes so large that innovation suffers. As far as the comment about changing the language: meh. Instead, we should be focused on reducing software vulnerabilities and automating software updates.

Curtis Dukes

Expect to see continued initiatives requiring secure software out the gate. Expect CISA to require attestations from software providers that they are following secure-by-design processes as part of qualifying their products for government customer

Lee Neely

Apple has always been zealous about controlling its product ecosystem, and this simply reflects the tension with security vendors. The question becomes: Are Apple's included security applications sufficient where you don't need third-party security tools? Microsoft is attempting to move in a similar direction.

Curtis Dukes

While tempting to deploy a new OS as soon as the production release is ready, you should have a testing process to verify your security settings, endpoint tools, EDR, scanning, etc. are fully functional. While not definitive, changes to the network stack seem to be a common denominator here. Expect an OS update from Apple in the near future which addresses the issue or provides workarounds.

Lee Neely

Interesting to note that LinkedIn did not roll out this feature to their users based in the European Union due to the EU General Data Protection Regulation and the EU AI Act. As an EU citizen it is comforting to know that big tech are legally prevented from abusing and using my personal data without my explicit permission and I do not have to opt out of such data grabs.

Brian Honan

The AI data collection was disclosed in LinkedIn's updated terms of service. Most of us missed it. This change means that for the European Economic Area, UK & Switzerland the setting is now off by default, but for the rest of us the AI setting is on. Go to Settings, Data Privacy, Data for Generative AI Improvement, to toggle it on or off. Also consider the setting for Social, economic and workplace research. If you're going to feed your GenAI user data, consider an opt-in model to avoid some privacy concerns.

Lee Neely

LinkedIn took a half-step in the right direction. Opt-in vs. opt-out should be the default configuration when it comes to user selection. But, alas, vendors know that most users don't read the fine print and rarely opt out.

Curtis Dukes

A reasonable next step for Telegram. The key is that a valid court order must be presented. Perhaps the change in terms was brought on by recent legal challenges with the CEO, but we'll never really know. In any event, bad actors have been put on notice.

Curtis Dukes

It took a long time, and arguably the arrest of Telegram's CEO to make this happen. It still would not make me trust Telegram as a secure messaging platform.

Brian Honan

Telegram has been in the hotseat lately for complicity in the distribution of illegal activities. This, coupled with the activity from the Germany on crypto exchanges, highlight law enforcement's increased awareness of illegal use of services, hopefully putting folks on notice that such activities will be discovered.

Lee Neely

In short, the flaw exists in the current and all previous versions of the tinydhcp server. As the code isn't supported, there isn't a wait for new version option, the "workaround" is to use a different dhcp server.

Lee Neely

Sadly when it comes to IoT devices, replacing vulnerable services will not be a straightforward task, especially for consumer devices. I predict we are going to see lots of vulnerable devices connected to the Internet over the coming years as many devices won't have their vulnerable services updated until the physical device is itself replaced. Make sure to factor these IoT devices into your corporate vulnerability management program to determine how you reduce your attack surface.

Brian Honan

Apache HugeGraph-Server is a core component of the Apache HugeGraph project, designed to handle large scale graph data with high performance and scalability. It is used for risk analysis, transaction pattern analysis, and fraud detection. CVE-2024-27348, improper access control, CVSS score 9.8, is fixed in version 1.3.0, and while compatible with Java 8, you need Java 11 to get all the security features. Next you need to enable user authentication (off by default) as well as the Whitelist-IP/port function to improve security of the RESTful-API.

Lee Neely

While the change from Kaspersky to UltraAV was completely transparent, and, as promised, required no user intervention, the promised migration date was after September 29th. Some users report UltraAV is configured to reinstall after a reboot after being uninstalled. The action of making the change prior to the announced date coupled with the action of uninstalling/installing security software without active user consent, triggered by Kaspersky, is not a good start to customer's relationship with the Pango Group. This may be a good time to assess your future endpoint protection selection if you are a newly installed UltraAV user.

Lee Neely

This is the same Necro trojan from five years ago that affected about 100 million devices. The malware uses a reflection attack to create a separate instance of the WebView factory, with privileges which are normally disallowed. The malware was in two Google Play apps: Wutu Camera app versions 6.3.2.148 - 6.3.6.148, the latest is now clean, and Max Browser, which has been removed form Google Play. IOC's as well as a detailed writeup are available in the blog published on Kaspersky's Securelist site.

Lee Neely

I was opposed to economic protectionism when Europeans used it against our computer industry in the sixties, and I continue to oppose it now. "World Peace through World Trade" works.

William Hugh Murray

This is supply chain security. If approved, software bans don't go into effect for a year to give manufacturers time to verify they are not tied to the PRC or Russia. The hardware ban, which affects things like sensors, Wi-Fi, cellular, Bluetooth, and satellite connectivity, has a longer lead time allowing manufacturers implement other solutions. US-based autonomous vehicles are exempted, but Chineese robotaxi services, such as Nullmax, Pony.ai and WeRide would be affected.

Lee Neely

More enforcement of Know Your Customer laws and regulations are needed.

John Pescatore

"Know your customer" has always been fundamental to sound banking. While necessary for effective anti-laundering enforcement, it did not originate with it. It is also necessary for sound lending and resisting fraud.

William Hugh Murray

Historically Crypto Exchanges have been tricky to regulate. Hopefully Germany can raise the bar.

Lee Neely