Microsoft cites a recently commissioned study on firmware security investments compiled by Security Signals. It shows that over 80 percent of businesses have experienced a firmware attack within the past two years. Keep Reading
Wales called cybersecurity investments in the American Rescue Act, including an extra $650 million for CISA, "an important down payment on the cybersecurity capabilities," but "we are not stopping there." Keep Reading
The CSA places the malicious cyber actor activity observed in the current Microsoft Exchange Server compromise into the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) framework. Keep Reading
Cloud, data analytics and managed services provider, TiG, has announced the strategic acquisition of ThirdSpace, a provider of Microsoft Identity and Cyber Security solutions. Keep Reading
Federal civilian departments and agencies running Microsoft Exchange on-premises products told to update or disconnect the products from their networks until updated with the Microsoft patch released yesterday. Keep Reading
Microsoft is a Strategic Alliance Partner within GDIT’s technology partner program, enabling GDIT to deliver a wide range of solutions on Azure, including cloud computing, storage, analytics and machine learning. Keep Reading
A remote attacker can exploit this vulnerability to take control of an affected system. This vulnerability was detected in exploits in the wild. Keep Reading
CISA has also seen this APT actor utilizing additional credentials and Application Programming Interface (API) access to cloud resources of private and public sector organizations. Keep Reading
Microsoft had previously said it was among thousands of companies that discovered malware on its systems after downloading a routine software update from the IT company SolarWinds containing a possible "backdoor" for hackers to gain access to sensitive company data. Keep Reading
Re-establishing trust in the organization’s on-premises and cloud environments with minimal business impact requires in-depth investigation and an understanding of potential methods of persistence. Keep Reading
CISA has created a free tool for detecting unusual and potentially malicious activity that threatens users and applications in an Azure/Microsoft O365 environment. Keep Reading
While many victims were government agencies, companies that contract with governments or think tanks and information and technology companies were also frequently hit, Microsoft found. Keep Reading
Vietnamese government-backed hackers have been recently spotted deploying cryptocurrency-mining malware alongside their regular cyber-espionage toolkits, Microsoft said on Monday. Keep Reading
The Central Intelligence Agency has awarded its long-awaited Commercial Cloud Enterprise, or C2E, contract to five companies—Amazon Web Services, Microsoft, Google, Oracle and IBM. Keep Reading
The group, known as Phosphorus (or APT35), sent spoofed emails masquerading as organizers of the Munich Security Conference, one of the main global security and policy conferences attended by heads of state, and the Think 20 Summit in Saudi Arabia. Keep Reading
An attacker could exploit this vulnerability to take control of an affected system. Applying patches from Microsoft’s October 2020 Security Advisory for CVE-2020-16952 can prevent exploitation of this vulnerability. Keep Reading
Microsoft has released security updates to address remote code execution vulnerabilities affecting Windows Codecs Library and Visual Studio Code. An attacker could exploit these vulnerabilities to take control of an affected system. Keep Reading
New subsidiary Intact Defense will spearhead and facilitate the delivery of its 100% Microsoft cloud technology solutions to the Federal Government and Department of Defense. Keep Reading
ForgeRock announced it joined the Microsoft Intelligent Security Association (MISA), an ecosystem of independent software vendors that have integrated their solutions to better defend against a world of increasing threats. Keep Reading
An unauthenticated attacker with network access to a domain controller could exploit this vulnerability to compromise all Active Directory identity services. Keep Reading