#CISA boss: Makers of insecure #software are the real cyber villains: www.theregister.com/2024/09/20/cisa_sloppy_vendors_cybercrime_villains

Even calling #security holes "software vulnerabilities" is too lenient, she added. This phrase "really diffuses #responsibility. We should call them 'product defects,'" Easterly said. And instead of automatically blaming victims for failing to #patch their products quickly enough, "why don't we ask: Why does software require so many urgent patches?...

#news #technology #cybersecurity #development #economy #Update #Problem #cyberwar

05.04.2024 Vernichtender CISA Untersuchungsbericht über Microsoft

Microsoft wurde "mächtiger Schlüssel" entwendet

Im letzten Sommer mussten wir über den GAU bei Microsoft berichten, über den bereits im Juni 23 entwendeten Masterkey. Nun hat das Cyber Safety Review Board der US-amerikanischen Cybersecurity and Infrastructure Security Agency (CISA) seinen Untersuchungsbericht über den Verlust des Master Key für Microsoft Azure vorgelegt. Das Urteil lautet, zitiert nach Heise.de:

"Die US-Regierungsbehörde für Cybersecurity wirft Microsoft vielfaches Versagen bei der Cybersicherheit vor und empfiehlt, die Entwicklung neuer Features für die Cloud zurückzustellen, bis substanzielle Sicherheitsverbesserungen gemacht sind."

Wegen der Auswirkungen des Vorfalls muss das Cyber Safety Review Board der CISA den Bericht zu dem Vorfall an den US-Präsidenten vorlegen. Der Abschlussbericht enthält ein vernichtendes Urteil. Erst eine "Kaskade vermeidbarer Fehler" durch Microsoft habe den Angriff überhaupt erst möglich gemacht.

Microsofts Rolle für die US Wirtschaft und Sicherheit verlange, dass das Unternehmen höchste Standards bei Sicherheit, Verantwortlichkeit und Transparenz erfülle. Jedoch habe ein weiterer gravierender Sicherheitsvorfall bei Microsoft, der in diesem Januar bekannt wurde, das Vertrauen des Cyber Safety Review Board in Microsoft weiter untergraben.

Gut, dass wir bereits seit Jahrzehnten diesem Internetgiganten kein Vertrauen entgegen bringen ... und weiterhin auf freie Open Software Programme setzen.

Mehr dazu bei https://www.heise.de/news/Klatsche-fuer-Microsoft-US-Behoerde-wirft-MS-Sicherheitsversagen-vor-9674431.html
Kategorie[21]: Unsere Themen in der Presse Short-Link dieser Seite: a-fsa.de/d/3zU
Link zu dieser Seite: https://www.aktion-freiheitstattangst.org/de/articles/8736-20240405-vernichtender-cisa-untersuchungsbericht-ueber-microsoft.html
Link im Tor-Netzwerk: http://a6pdp5vmmw4zm5tifrc3qo2pyz7mvnk4zzimpesnckvzinubzmioddad.onion/de/articles/8736-20240405-vernichtender-cisa-untersuchungsbericht-ueber-microsoft.html
Tags: #Masterkey #Microsoft #Exchange #AzureCloud #Outlook #Cyberwar #Hacking #Trojaner #Verbraucherdatenschutz #Datenschutz #Datensicherheit #Ergonomie #Datenpannen #Zensur #Transparenz #CISA #Untersuchungsbericht #Anonymisierung #Verhaltensänderung #Verlust

heise online | heise online

#NSA and #CISA Red and Blue Teams Share Top Ten #Cybersecurity Misconfigurations

source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a

1) Default configurations of software and applications
2) Improper separation of user/administrator privilege
3) Insufficient internal network monitoring
4) Lack of network segmentation
5) Poor patch management
6) Bypass of system access controls
7) Weak or misconfigured multifactor authentication (MFA) methods
8) Insufficient access control lists (ACLs) on network shares and services
9) Poor credential hygiene
10) Unrestricted code execution

#usa #internet #security #administrator #configuration #knowledge #knowhow #top10 #network #login

Meanwhile, on a lighter note....
Being facetious.
Truly, a VERY IMPORTANT STORY!!

"Here we go. New unnamed state 🤔 hackers are infecting U.S. critical infrastructure"

Reports to/from CISA agency... with urgent request that full report be read by CEO's, etc. Not only Ukraine and U.S.....

#cybersecurity #Russia #hacking #infrastructure #CISA #cyberwar

#CISA 'forgets' to mention #Windows when it's badly affected http://techrights.org/wiki/index.php/Microsoft_and_the_NSA

#CISA Compiles Free Cybersecurity Services and Tools for Network Defenders | CISA ⚓ https://us-cert.cisa.gov/ncas/current-activity/2022/02/18/cisa-compiles-free-cybersecurity-services-and-tools-network ䷉ #nsa #backdoors http://techrights.org/2021/10/29/microsoft-national-security-threat/

#CISA Adds 15 Known Exploited Vulnerabilities to Catalog https://us-cert.cisa.gov/ncas/current-activity/2022/02/10/cisa-adds-15-known-exploited-vulnerabilities-catalog #microsoft dominates the list http://techrights.org/2021/10/29/microsoft-national-security-threat/

CISA Adds Eight Known Exploited Vulnerabilities to Catalog | #CISA ⚓ https://us-cert.cisa.gov/ncas/current-activity/2022/01/28/cisa-adds-eight-known-exploited-vulnerabilities-catalog

Highly misleading headline and misdirection, suggestive of #Microsoft controlling #CISA and using it to deflect blame https://us-cert.cisa.gov/ncas/current-activity/2022/01/16/microsoft-warns-destructive-malware-targeting-ukrainian http://techrights.org/wiki/index.php/Microsoft_and_the_NSA

If #CISA and #NSA were serious about security, they would advise people to abandon #Microsoft for the back doors https://us-cert.cisa.gov/ncas/current-activity/2022/01/11/microsoft-releases-january-2022-security-updates see http://techrights.org/wiki/index.php/Microsoft_and_the_NSA

#Mozilla Releases Security Updates for Firefox, #Firefox ESR, and Thunderbird | CISA ⚓ https://www.cisa.gov/uscert/ncas/current-activity/2022/01/11/mozilla-releases-security-updates-firefox-firefox-esr-and ䷉ #cisa | more in http://schestowitz.com/2022/01/11/#latest

CISA Adds Thirteen Known Exploited Vulnerabilities to Catalog | CISA ⚓ https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog ䷉ #cisa | more in http://schestowitz.com/2021/12/10/#latest

#ProprietarySoftware " #CISA encourages users and administrators to review the SonicWall security advisory and apply the necessary firmware updates as soon as possible." https://us-cert.cisa.gov/ncas/current-activity/2021/12/08/sonicwall-releases-security-advisory-sma-100-series-appliances

#CISA on #microsoft being a threat again... to #nationalsecurity https://us-cert.cisa.gov/ncas/current-activity/2021/11/09/security-researchers-reveal-activity-targeting-manageengine see http://techrights.org/2021/10/29/microsoft-national-security-threat/

#BrakTooth Proof of Concept Tool Demonstrates #Bluetooth Vulnerabilities | #CISA ⚓ https://us-cert.cisa.gov/ncas/current-activity/2021/11/04/braktooth-proof-concept-tool-demonstrates-bluetooth

#CISA orders federal agencies to fix hundreds of exploited #security flaws https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-fix-hundreds-of-exploited-security-flaws/ http://techrights.org/wiki/index.php/Microsoft_and_the_NSA

CISA orders federal agencies to fix hundreds of exploited security flaws

CISA has issued this year's first binding operational directive (BOD) ordering federal civilian agencies to mitigate security vulnerabilities exploited in the wild within an aggressive timeline.

"According to a report from #CISA last week, there were three ransomware attacks against water treatment plants last year." https://www.schneier.com/blog/archives/2021/10/ransomware-attacks-against-water-treatment-plants.html #microsoft #windows for sure. http://techrights.org/2021/05/02/ransomware-task-force/