Microsoft addresses 73 CVEs in its May 2022 Patch Tuesday release, including two zero-day vulnerabilities, one of which was exploited in the wild.

6Critical
66Important
0Moderate
1Low

Microsoft patched 73 CVEs in its May 2022 Patch Tuesday release, with six rated as critical, 66 rated as important and one rated as low.

This month’s update includes patches for:

.NET and Visual Studio
Microsoft Exchange Server
Microsoft Graphics Component
Microsoft Local Security Authority Server (lsasrv)
Microsoft Office
Microsoft Office Excel
Microsoft Office SharePoint
Microsoft Windows ALPC
Remote Desktop Client
Role: Windows Fax Service
Role: Windows Hyper-V
Self-hosted Integration Runtime
Tablet Windows User Interface
Visual Studio
Visual Studio Code
Windows Active Directory
Windows Address Book
Windows Authentication Methods
Windows BitLocker
Windows Cluster Shared Volume (CSV)
Windows Failover Cluster Automation Server
Windows Kerberos
Windows Kernel
Windows LDAP – Lightweight Directory Access Protocol
Windows Media
Windows Network File System
Windows NTFS
Windows Point-to-Point Tunneling Protocol
Windows Print Spooler Components
Windows Push Notifications
Windows Remote Access Connection Manager
Windows Remote Desktop
Windows Remote Procedure Call Runtime
Windows Server Service
Windows Storage Spaces Controller
Windows WLAN Auto Config Service

Remote code execution (RCE) vulnerabilities accounted for 32.9% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 28.8%.

Windows 10 End of Servicing

Today, Windows 10 version 20H2 has reached the end of servicing and will no longer receive security updates. Users are urged to update to more recent versions to ensure they continue receiving important security updates.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains May 2022.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s May 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

Microsoft’s May 2022 Security Updates
Tenable plugins for Microsoft May 2022 Patch Tuesday Security Updates

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More

For many of us, it was the last in-person industry event we attended before COVID. I’m happy to say that CIS will be back at RSA Conference this year.

Read More

The National Intelligence Center reportedly used Pegasus to spy on leaders of the Catalan independence movement

Read More

Information security accreditation and certification body CREST has announced two new partnerships aimed at developing the cybersecurity skills of its members. The first is a partnership with cyber workforce optimization platform Immersive Labs to support the development of defensive and offensive security skills. The second is a collaboration with cybersecurity training and upskilling platform Hack The Box to assist the development of offensive security capabilities. Both will help CREST members prepare for CREST examinations, the company said. The partnerships come as cybersecurity skills and resources challenges continue to impact organizations across the globe.

To read this article in full, please click here

Read More

EU, UK, US and other allies have attributed responsibility for the February attacks on comms firm Viasat to Russia

Read More

The SEC’s proposed rule on cybersecurity promotes transparency and encourages free market forces.

The days of cyber negligence are numbered. While nobody can expect perfect cybersecurity, a vast supermajority of the painful breaches we learn about are the result of known vulnerabilities, lackadaisical security practices and poor cyber hygiene — things that could have been avoided with diligence and care. It’s an attitude that exudes fiduciary negligence and a blatant disregard for shareholders, partners, and customers.

The Securities and Exchange Commission’s proposed rule on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure will trigger dramatic and long-overdue changes in how businesses disclose their cybersecurity policies, procedures, oversight and governance. It will force leaders to treat cybersecurity risk as a business risk — something responsible executives started doing a long time ago — and provide shareholders, customers, partners and the public with essential information needed to make responsible decisions.

The proposed rule requires public companies to disclose their policies and procedures for identifying and managing cybersecurity risks. It also requires disclosure of the oversight role and cybersecurity expertise of public companies’ leadership and board of directors over their cybersecurity risk assessment program. 

Before even reading the comments, I can hear all of those trying to shirk their responsibilities go on and on about the invasiveness of these draconian measures and the ill effects of government interference in corporate affairs and free markets. But free markets cannot work without transparency and informed decision making. Such measures will root out secrecy in the disclosure process and help us all understand which organizations are respecting the duty of care that they owe their customers and stakeholders. 

Cybersecurity breaches damage a company’s financial position. In addition to the costs of remediation and loss of customers, revenue and reputation, there are risks of shareholder lawsuits, customer lawsuits, increases in insurance premiums and increased scrutiny from auditors and regulators, distraction of management, and significant expenses. 

Former NSA Director Keith Alexander called cyber espionage, “the greatest transfer of wealth in history.” Cyber crime costs the US economy over $100 billion per year, and cost estimates of intellectual property theft surpass $250 billion per year. This is a real-world risk, and investors have a right to know whether or not a public company has robust cybersecurity risk assessment practices and policies in place so they can factor that risk into their investment decisions.

Today’s threat landscape is highly dynamic and requires organizations to continuously assess and defend against new tactics, techniques and procedures used by threat actors and cyber criminals. Continuous cyber risk assessments must be a foundational and strategic function. It is to the benefit of companies and shareholders to ensure that adequate cybersecurity controls and defenses are implemented. Requiring greater transparency of cyber risk practices and oversight promotes stronger cybersecurity governance and accountability among corporate leaders and boards and, ultimately, will produce a healthier market equilibrium.

While there are still details to be ironed out, the SEC’s proposed rule is an enormous step in the right direction and I hope the SEC doesn’t get derailed by those advocating for status quo.

Read More

Vulnerability coordination and bug bounty platform HackerOne has announced the launch of Attack Resistance Management (ARM), a new security solution designed to increase customers’ cyber resiliency. Intended to target the root causes of attack resistance gaps, the new solution blends the security expertise of ethical hackers with asset discovery, continuous assessment, and process enhancement, the company said. The release comes as organizations continue to struggle to effectively monitor their attack surface and identify and tackle vulnerabilities.

ARM solution addresses attack resistance gap

The attack resistance gap defines the hidden vulnerabilities within an organization’s attack surface and is caused by incomplete knowledge of digital assets, insufficient testing, and a shortage of the right skills, HackerOne stated in a press release. The firm’s 2022 Attack Resistance Report discovered that nearly half of businesses lack the confidence and means to close security gaps, with almost 20% of participants stating that over half of their attack surface is unknown or not observable.

To read this article in full, please click here

Read More

Cloudflare Workers for Platforms provides a set of tools and an API standard that would allow developers to customize any web application.

Read More

Cloudflare Workers for Platforms provides a set of tools and an API standard that would allow developers to customize any web application.

Read More

Network Detection and Response, or NDR, has morphed from its original role as a traffic monitoring and statistics analysis tool. Today’s NDR solutions offer behavior-based analytics through artificial intelligence, machine learning tools and automated incident response. But how will NDR evolve in the future?

Integration will become the norm

In the near future, we will see far more integration with other security technologies. From one point of view, increasing numbers of data sources will be ingested by the NDR analytical platform, ranging across NGFWs, IDS/IPS, EDR (endpoint detection and response), sandboxes and others. Useful metadata from these devices will be extracted and sent to the NDR analytical center, adding to the depth, breadth and accuracy of NDR threat detection.

To read this article in full, please click here

Read More