icon

Articles by tag "security"

10/17/2015 Newsletters

October 11-17 – troubling week for the security

    Digital Edge is committed to providing the highest levels of security within all the IT infrastructure environments under its care. In order to achieve this utmost goal for all of our clients, we continuously maintain vigilance both on the productive side of IT as well as on its destructive side. We thus send out news and security bulletins such as this one from time to time to ensure that our clients are informed and educated on any important developments in IT security and are fully aware of what we are doing to ensure that we and our clients are always at the Cutting and at the Digital Edge of technology. 

    The week may be over but it was very troubling. There are a few events that attracted our attention so the Digital Edge security team wanted to provide our analysis and some suggestions how to stay secure. 

          1. Microsoft has released multiple patching addressing very critical security vulnerabilities. They include fixing for holes allowing user computer take over techniques through multiple attack vectors against Microsoft Office, VB and Java scripts, Windows Shell and Kernel itself. All those attacks can be delivered through phishing emails or through tricking users to open infected web sites. 

          2. At the same time, security agencies are reporting multiple instances of outbreak of Dridex malware outbreak. In short, the malware gets delivered to computers over the same mechanisms mentioned above through vulnerabilities that Microsoft addressed in this week’s patch but the malware concentrates on 3 things: 

                a. Stealing personal information 
                b. Stealing banking credentials to be able to transact on the infected user/computer behalf 
                c. Execute command-and-control (C2C). 

              Besides that, the infected computer can be employed for spam distribution and distributed denial of service (DDOS) attacks 

          3. On October 15, 2015, UltraDNS – large DNS service and content delivery provider went down for 90 minutes. Even though UltraDNS claims that the cause of the outage was an “internal issue in a server on East Coast” many security experts suggest that UltraDNS sustained serious DDOS attack.  

      All Digital Edge managed or co-managed clients will be patched according to individual schedules. 

      Besides that click here to make sure that you are safe and free of Dridex. 

      If you feel that you need assistance from the Digital Edge Security team, please contact Danielle Saladis at dsaladis@DIGITALEDGE.NET

      Please click here for more information.

9/20/2015 White Papers

Log Management Compliance - PCI DSS - Payment Card Industry Data Security Standards

The PCI DSS was created to encourage and enhance cardholder data security and facilitate the extensive adoption of consistent data security measures worldwide. This applies to all organizations that store, process, and/or transmit cardholder data.

9/16/2015 Newsletters

.NET elevation of privileges vulnerability

Digital Edge is committed to providing the highest levels of security within all the IT infrastructure environments under its care. In order to achieve this utmost goal for all of our clients, we continuously maintain vigilance both on the productive side of IT as well as on its destructive side. We thus send out news and security bulletins such as this one from time to time to ensure that our clients are informed and educated on any important developments in IT security and are fully aware of what we are doing to ensure that we and our clients are always at the Cutting and at the Digital Edge of technology. 

  For a while Microsoft didn’t have significant security vulnerabilities that would attract our interest. Last week security advisory however revealed CVE-2015-2504 that requires close attention. 

   As usually Digital Edge warns the community about possible remote execution and privilege elevation vulnerabilities allowing hackers to break through the security perimeters. 

   All Digital Edge managed or co-managed clients will be patched according to individual schedules. 

   If you feel that you need assistance from the Digital Edge Security team please contact Danielle Saladis at dsaladis@DIGITALEDGE.NET

   Please click here for more information.

5/13/2015 Newsletters

VENOM security vulnerability – possible threat to datacenters

  Digital Edge is committed to providing the highest levels of security within all the IT infrastructure environments under its care. In order to achieve this utmost goal for all of our clients, we continuously maintain vigilance both on the productive side of IT as well as on its destructive side. We thus send out news and security bulletins such as this one from time to time to ensure that our clients are informed and educated on any important developments in IT security and are fully aware of what we are doing to ensure that we and our clients are always at the Cutting and at the Digital Edge of technology.

  On Wednesday, May 13, 2015, new vulnerability that has been assigned CVE-2015-3456 was published. News agencies breaking this news stating that datacenters are vulnerable and at risk at their core:

  “A security research firm is warning that a new bug could allow a hacker to take over vast portions of a datacenter -- from within.” ZDNet (May 13, 2015).

   1. Digital Edge does not run vulnerable virtualization platforms.
   2. Digital Edge has small portion of clients running vulnerable platforms. Digital Edge security team will be contacting such clients on individual bases.

  Digital Edge is committed to securing all of its controlled IT infrastructure environments, to advising its IT community about possible vulnerabilities, newly discovered weaknesses and hacks, and to providing security news and events.

  If you feel that you need assistance from the Digital Edge Security team please contact us at support@digitaledge.net

  Click here to read Digital Edge risk assessment for this vulnerability.

4/10/2015 Newsletters

Free Advice For Priceless Security

Potential Threat: One of the techniques that hackers use to infiltrate operating systems is known as polymeric downloaders. These are viruses that could download other, more complex viruses, password stealers or remote controlled software. These downloaders typically access systems via emails or zip files. They can also get to your computer in tandem with other programs, mostly together with free game downloads or with illegal software. These downloaders can also traverse when connecting infected USB disks to your computer. Virus authors aim to trick you into executing these downloaders. These tricks could be sophisticated, which sometimes could confuse even sophisticated computer users into executing the underlying viruses and infecting their systems. A more complex infecting technique is called polymorphic downloaders or polymorphic viruses, which allows viruses to traverse undetected.

Digital Edge is committed to the highest of security standards and making sure that its constituents are likewise serious about security which is all about knowledge and behavior. Click here to read about some free techniques for detecting and fighting polymorphic downloaders.

Read more about free virus scanners.

3/13/2015 Newsletters

Microsoft March 2015 Security Update

Microsoft has released updates to address Windows vulnerabilities as part of the Microsoft Security Bulletin Summary for March 2015. These vulnerabilities could allow remote code execution, spoofing, security feature bypass, denial of service, elevation of privilege, or disclosure of information.

Digital Edge encourages users and administrators to review Microsoft Security Bulletin Summary MS15-MAR and apply the necessary updates.

Digital Edge is committed to secure all controlled IT infrastructure environments and to advise the IT community about possible vulnerabilities, newly discovered weaknesses, hacks as well as security news and events.

No action is necessary for fully managed Digital Edge clients because your systems will be patched on regularly scheduled and approved basis

2/10/2015 Newsletters

Security Warning – 2/10/2015 - Microsoft

Digital Edge distributes this notification as an effort to improve the IT community cybersecurity, coordinate cyber information sharing, and proactively manage cyber risks while protecting our clients. 

On February 10, 2015, Microsoft issued new Security Bulletin MS15-011 which is marked critical 

Digital Edge security team analyzed the vulnerabilities and possibilities to exploit. We think that the vulnerability reported in MS15-011 is critical but very hard to exploit. Even though Microsoft does not disclose details about Digital Edge Security Team feels that exploiting of the vulnerability is hard and in most common enterprise settings where infrastructures protected by firewalls and users access network through VPNs almost impossible. 

Digital Edge strives to be a trusted leader in cybersecurity and managed services in complex enterprise IT environments.

1/30/2015 Newsletters

Security Warning

Digital Edge distributes this notification as an effort to improve the IT community cybersecurity, coordinate cyber information sharing, and proactively manage cyber risks while protecting our clients. 

On January 27, 2015, Qualys Security Advisory published new Linux vulnerability repot - CVE-2015-0235. 
The report alerts about Linux glibc library is being vulnerable to a buffer overflow with a risk of potential remote execution and taking over the server. Linux systems that are liable to attack include:

  • Debian 7 (Wheezy), 
  • RHEL 5/6/7
  • CentOS 6/7 
  • Ubuntu 12.04

Even though exploit of such vulnerability is not obvious, Qualys has developed a proof of a concept when a specially crafted email can produce a remote shell to a vulnerable system.

Digital Edge will assess managed systems and work with affected clients individually.  

Digital Edge security team advise all IT professionals to take this vulnerability seriously and contact us for any questions, consultations or help. 

Digital Edge strives to be a trusted leader in cybersecurity and managed services in complex enterprise IT environments.

10/20/2014 Newsletters

Digital Edge Security Advisory

Last month, security community discovered critical security threats that affect multiple platforms, technologies and configurations.

Digital Edge is proactively working with its clients on assessing the effect, planning for remediation, scheduling and execution of patching.

Critical vulnerabilities are:

  1. SSLv3 encryption protocol weakness allowing man-in-the-middle to decrypt secured communication.
  2. 3 critical Microsoft vulnerabilities allowing a hacker to execute malicious code remotely and gain access to data, client computers or client’s servers.
  3. Bash vulnerability allowing a hacker to execute malicious code remotely and gain access to client’s servers.

All affected Digital Edge’s clients will be contacted and required actions will be discussed, scheduled and performed. If you feel that you need an additional help please contact us at: https://www.digitaledge.net/contact/

9/26/2014 Newsletters

Bug in Linux “bash” shell causes “shellshock”

Security Advisory from Digital Edge

On Wednesday, September 24th, a vulnerability in Linux bash shell was discovered. The vulnerability may allow code execution to open door for other attacks causing OS to become fully compromised. In lots of environments this vulnerability is exploitable over the network.

Digital Edge is assessing our internal environment as well as our clients’ environments and will remediate the vulnerability within the next few days. Affected Digital Edge clients will be contacted and protective actions will be discussed.

Digital Edge is committed to secure all controlled IT infrastructure environments and to advise the IT community about possible vulnerabilities, newly discovered weaknesses, hacks as well as security news and events.

If you feel that you need assistance from Digital Edge Security team please contact us at “support@digitaledge.net

Thank you,

Digital Edge

Let's talk: 800-714-5143

Speak to a specialist