The Cyber Tech Cafe Managed Services (MyIT) continue to be an overwhelming success. It’s exciting to see organizations taking a proactive approach when it comes to their IT Infrastructure and it’s incredibly rewarding to hear those organizations comment about how “things just seem to work”.
A new version of our website / blogging software brings a new format to these posts, all the same content you know and love with a fresh coat of paint to hopefully make consumption more enjoyable and pleasing. As always, we welcome comments, feedback, concerns, etc.
- DC770 – Cyber Tech Cafe is a proud supporter and co-sponsor of the DC770 DEF CON group that meets monthly at 7:00pm ET at Jefferson’s restaurant in Cartersville on the first Tuesday of each month. More information is available at https://dc770.org . Our speaker for the November meeting is the world famous TBD.
- Cyber Tech Cafe Holiday Hours – We have set our holiday hours for this coming season. We will be closed on Monday December 24th, and Tuesday December 25th in observance of the Christmas Holiday and also on Tuesday January 1st 2019 for the New Year holiday. For the most up to date information see our Holiday Hours Schedule
- This Month In Tech – In the past 30 days we saw over 500 million records stolen from Marriott Hotels in one of the largest breaches of 2018 against Marriott Hotels, Google shutting down Google+ amid its 2nd breach this year, and Microsoft announcing it will use the Chrome code base as a foundation for a new version of their Edge browser.
Microsoft reported 69 vulnerabilities, 10 of which were classified [by Microsoft] as CRITICAL with the remaining 59 rated important, moderate or low. One particular update is of note in that it has an unusually high CVSS rating of 9.8 (out of a max 10) though the saving grace is that as of now, no known exploits have been seen in the wild. It does appear that Microsoft has been able to calm down and severely reduce the number of issues caused as a direct result of a bugged update (something they have been having trouble with for the past 2 months).
Adobe released only two (2) bulletins this month, both addresses security bypass vulnerabilities, one in Flash Player and the other in Acrobat / Reader.
Like Microsoft, Adobe (for the most part) now releases updates to their products on the second Tuesday of each month. Adobe will also release ‘out of band’ updates if necessary to address critical vulnerabilities in their products. Adobe products include Adobe Reader (for viewing PDF files), Adobe Flash Player (often used to watch videos, for interactive content like games, etc.), Adobe Shockwave and the Adobe Creative Suite (Photoshop, Illustrator, Acrobat, Lightroom, etc.).
Java / Oracle
The latest update for Java is Version 8 Update 191, released on 16 October 2018.
Java is a tool that’s widely used by banks, online service providers and even security companies for SSL VPN connections. Java’s ‘official’ release cycle is approximately quarterly but Oracle is notorious for out of band updates. It’s worth noting again that, if you don’t absolutely need Java on your computer, it’s not a bad idea to remove it altogether.
Sponsored by Piratica
Assume breach. The City of Atlanta didn’t do this and was completely shut down by a ransomware attack for days. Marriott didn’t do this and the personal information on more than 500 million customers was in the wind for a number of years before anyone ever noticed (to be fair, the breach happened to Starwood before Marriott acquired them). Gone are the days when organizations can trust that their [security] controls are 100% (or even 90%, 80%, etc.) effective. In today’s always-on, always-connected environment, we have to assume that our perimeter has been breached, that the wolf is through the door and we’re one second away from an attacker encrypting half of our data and posting the other half to pastebin for all of the world to see. Once that reality is accepted, the next step is to understand what your organization looks like to a threat actor and what opportunities (vulnerabilities) are you making available that could be used against you. Piratica has a proven track record of identifying these vulnerabilities and working with client organizations and their support personnel to develop a mitigation roadmap to avoid being the next successful ransomware or data breach attack.
Piratica is a risk management firm. We work with client organizations to help them identify and understand the risks to their organizations so that those metrics can be incorporated into the organizations overall security strategy. We believe that the first step in any solution is to correctly and completely identify the problem. Additional information is available on our website, Facebook and Twitter or via our free email newsletter (signup available on our website here).
These updates will be automatically reviewed, approved and installed for MyIT Customers. If you would like more information about the Cyber Tech Cafe MyIT services for your business, please let us know. The Cyber Tech Cafe MyIT services are available in three different levels (Bronze, Silver and Gold) and can provide updates only (Bronze), updates and proactive network auditing and monitoring (Silver) or updates, proactive auditing and monitoring and up to 10 hours of priority support at a significantly discounted rate (Gold). Pricing is based on the number of physical locations, servers and workstations that you have.