Five Key Considerations for Improving IT Supply Chain Security
Many organizations do not maintain a comprehensive and current inventory of products, capabilities and services obtained from third-party IT providers. With the prevalence of cloud services, open-source software and multitiered service providers, organizations can easily lose track of what equipment, software and services have been acquired from various vendors. It is critical for an organization to be able toto identify the applications, services, solutions, infrastructure and data they rely on for day-to-day operations. A configuration management database (CMDB) is often the ideal repository for the storage of technical details of all third-party IT products and capabilities operating within the organization. IT personnel can then use the CMDB to identify if and where an organization is vulnerable to an exposure if third-party vulnerabilities are made evident. The CMDB should also include dependency data on the business processes with which the products and services interact. This information will enable the organization to make any risk-based decisions regarding protective and remedial actions needed to mitigate the risk posed by identified vulnerabilities.
Click here to read moreOrganizations Warned of Attacks Exploiting Recently Patched Windows Vulnerability
The US Cybersecurity and Infrastructure Security Agency (CISA) reported that a newly patched Windows Print Spooler vulnerability has been exploited in attacks. The vulnerability, which is tracked as CVE-2022-22718, was addressed by Microsoft with its February 2022 Patch Tuesday update. However, according to Microsoft, CVE-2022-22718 can be exploited by a local attacker to escalate privileges without t any user interaction. CISA noted that the vulnerability to its Known Exploited Vulnerabilities Catalog, which includes almost 650 exploited flaws. CISA advises all organizations to prioritize the patching of the vulnerabilities included in this catalog. Many IT professionals consider CISA s catalog to be a Must Patch list. An IT asset management solution can provide IT management with detailed information on the patch status of each device in the network.
Click here to read moreMicrosoft Patches 128 Windows Flaws, New Zero-Day Reported by NSA
According to tracking data from Zero Day Initiative (ZDI), Microsoft patched 128 new Windows vulnerabilities in April of this year. The April patches cover serious vulnerabilities in Microsoft Defender, Microsoft Dynamics, Exchange Server, Microsoft Office, SharePoint Server, Windows Hyper-V, DNS Server, Windows App Store, and Windows Print Spooler Components. ZDI researchers are urging Windows administrators to prioritize the zero-day update along with a handful of critical bugs that could result in worm attacks. These include CVE-2022-26809 (CVSS 9.8), a vulnerability that can enable an attacker to execute code at high privileges on an affected system. An IT asset management solution can provide IT management with detailed information on unpatched or vulnerable systems.
Click here to read moreShadow IT Is Evolving as Businesses Sanction More Apps
According to Gartner, with the growth of Software-as-a service (SaaS), shadow IT in the traditional sense, is on the decline. This trend has because IT has either sanctioned a group of useful SaaS tools that it does not provide directly, or business units are requesting IT's clearance to use a new service. Lane Severson, senior research director at Gartner, noted that "It's clear that we are moving away from shadow IT in the classic sense and moving into the era of business-led IT where workers are making decisions about what apps they want to use to get their job done. But they are working with IT to make sure those apps are sanctioned. They aren't just buying random cloud applications and expensing them as much as they were pre-COVID[-19]." Rob Zahn, CIO at AAA of Ohio concurred, stating that The idea of business-led IT has some validity to it. During the pandemic, everyone was asking for IT's help. Because of that, the incidents of people using unsanctioned apps actually went down in his organization
Click here to read moreCIOs Tout Guardrails as Prevention For Shadow IT Woes
Business unit technology acquisition frees CIOs from technology minutiae, creating more time to focus on strategy. However, compliance gaps and security and vulnerability concerns persist. Sheila Jordan, chief digital technology officer at Honeywell, noted that every SaaS software application the business unit acquires can have implications for the business if no one oversees the data flow. One approach is to place guardrails around the use of technology, prioritizing the key priorities credo while protecting the company's assets. Successful shadow IT deployments operate in an environment with centralized governance. Business unit technology acquisitions are inevitable, but technology leaders can use governance to reduce risk. On effective governance tool is a fully functional IT asset management tool, which can identify unauthorized ort on-standard software acquisitions.
Click here to read more7 Old Attack Vectors Cybercriminals Still Use
Targeting old, identified vulnerabilities is a common practice used by attackers. Known vulnerabilities can be exploited for years if they are not patched, Forrester analyst Allie Mellen noted that, A classic example of this is the exploit EternalBlue. Despite patches being released for the vulnerability in March of 2017, the exploit was used in May of 2017 by the WannaCry ransomware, then again in June of 2017 in the NotPetya cyberattack. This is why patching systems quickly and effectively is so important. Ryan Linder, risk and vulnerability engineer at Censys said that the exploit affects the Server Message Block (SMB) protocol. Today there remain over 200,000 systems exposed to the internet which support SMBv1 (created in 1983). Too many companies fail to keep their software up to date, leaving them vulnerable to critical exploits. and even when exploits are disclosed publicly, many still fail to patch their systems. An IT asset management solution is an effective tool to identify unpatched and vulnerable systems.
Click here to read moreApple Patch Day: Gaping Security Holes in iOS, macOS, iPadOS
Apple also released software updates to address security vulnerabilities in macOS (Catalina, Big Sur, Monterey), tvOS, WatchOS, iTunes and Xcode. At least five of the iOS/iPad vulnerabilities could lead to remote code execution attacks. An iPhone user would need to open a malicious PDF file or view malicious web content to enable the attack. According to Apple, the newest iOS 15.4 and iPadOS 15.4 address multiple memory safety issues in several OS components. IT p[professionals can utilize their IT asset management tools to identify unpatched systems.
Click here to read moreShort-Term Defense Strategies Against Russian Cyberaggression
To companies that haven t prioritized cybersecurity, one wonders whether frequent alerts from the government may go unnoticed. But what if the overall level of cyberaggression does spike so such that businesses must address the issue pay? When the intrusion alarms go off, advice about running cybersecurity drills, installing new security tools and encrypting data will be no help. A panel experts made a list of cybersecurity preventative actions a business could reasonably complete in about five business days. Matt Gyde, chairman and CEO of Foresite noted that Patching is the single most important security process an organization can do to drastically improve their security posture. Threat actors are lazy, so they go for the easiest approach. If a threat actor knows that your front door is unlocked [you have a clear vulnerability]. Gyde continued to say that Besides aggressively patching all systems in the environment, the best thing to do is to have robust monitoring of the environment. You cannot defend what you cannot see, and every organization has black holes of rogue IT within them. Every asset must be monitored. A robust IT asset management solution can easily identify unpatched systems and inventory every device and software application on the network
Click here to read moreShadow IT Is Evolving as Businesses Sanction More Apps
IT departments were unprepared to support thousands of remote employees after Covid-19 forced workers out of the office. However, with nearly everyone working from home (WFH) the tools employees relied on were not as effective when accessed from outside the corporate network. Consequently, WFH employees sourced the needed software themselves. However, according to Gartner, shadow IT, in the traditional sense, is on the decline. In many cases IT has either sanctioned a wide array of useful SaaS tools for individual or departmental use, or the business units are asking IT's permission to use a new service. Lane Severson, senior research director at Gartner noted that "It's clear that we are moving away from shadow IT in the classic sense and moving into the era of business-led IT where workers are making decisions about what apps they want to use to get their job done. But they are working with IT to make sure those apps are sanctioned. They aren't just buying random cloud applications and expensing them as much as they were pre-COVID-19." IT asset management tools are an effective way for IT to monitor exactly what is running on the network, both for on-premises and remote workers.
Click here to read moreUnpatched Vulnerabilities Remain Primary Ransomware Attack Vector
A recent report by Ivanti ,working with Cyware and Cyber Security Works, determined that cyber-criminals continually leverage unpatched vulnerabilities as their main ransomware attack vector,. Researchers discovered 65 new vulnerabilities associated with ransomware in 2021. This number was nearly a 30% growth compared to 2020. More than a third of those new vulnerabilities were being actively searched for on the internet. This fact further empasizes the need to prioritize patching. The report noted that Unpatched vulnerabilities are the main attack vectors that ransomware groups exploit to gain entry into vulnerable networks. However, our research also identified ransomware groups expanding their focus to not just single unpatched instances but to combinations of vulnerabilities, vulnerable third-party applications, technology protocols, and even insider recruiting as a means to take that first step in launching an attack. IT asset management solutions are a first line of defense in identifying vulnerable systems and software.
Click here to read moreBLS: More Than One-Third of Employers Embraced Telework Due To The Pandemic
According to a recent U.S. Bureau of Labor Statistics (BLS) report, since the start of the pandemic more than 30% of private-sector employers increased telework for some or all employees. The study included data from over 80,000 private-sector employers between July of2 021, and September of 2021. In addition, 25% of private-sector employers offered flexible or work hours. Over the past 2 years, many reports indicated that remote and hybrid work would be become a more permanent model for many employees. The BLS confirms that observation. The BLS survey showed that employers that increased telework, 60% and they expect it to be a permanent change. The move to remote work further underscores the need for IT asset management tools that can identify devices and software in corporate and distributed networks.
Click here to read moreNearly One-Third of SaaS Spend Goes to Waste, Survey Says
According to Flexera's State of ITAM 2022 report, almost thirty percent of SaaS software spend is underutilized or wasted. The survey included 465 global IT professionals at companies with 1,000 or more employees. Companies also have difficulty managing desktop software. The report noted that employees estimated that over thirty percent of the company s spend in this category is either underutilized or wasted. Only one-third of surveyed IT asset management teams said that they currently SaaS usage, and almost half of respondents plan to start tracking SaaS usage. Most respondents noted that their main priority is responding to audits. Clearly, an IT asset management solution that can help manage cloud services, especially SaaS, will yield real benefits to the IT organization.
Click here to read moreVMware Plugs Security Holes in Workstation, Fusion and ESXi
Tracked as CVE-2021-22045, the vulnerability exists in the CD-ROM device emulation function of Workstation, Fusion and ESXi. Disabling or disconnecting the CD-ROM/DVD devices on all running virtual machines should prevent any potential exploitation. CVE-2021-22045 affects ESXi 6.5, 6.7, and 7 versions, Workstation 16.x, and Fusion 12.x. VMware Cloud Foundation (ESXi) 4.x and 3.x are affected as well. IT managers can use their IT asset management tools to identify vulnerable and/or unpatched systems.
Click here to read moreRecognizing the Customer s Responsibility in a Shared Responsibility Model
Every industry, regardless of its size, is working to realize the benefits of the cloud. However, it is crucial to align the cloud strategy with the business goals and desired outcomes. From a security standpoint, it s also important to be aware of the regulatory and compliance requirements and how they can be achieved using cloud platforms. It is naive to believe that the cloud provider is entirely responsible for its customers security. Too many enterprises are failing to address how their employees use external applications, leaving them free to share huge amounts of proprietary information. A cloud providers Software as a Service (SaaS) model does not mean IT does not need a holistic program that covers people, processes, and technology. A fully functional IT asset management solution that helps manage cloud applications and vendors provides a good platform to fgain control over cloud assets.
Click here to read moreCritical, Wormable Microsoft Vulnerability Could Lead to Cyberattacks
One vulnerability, labeled CVE-2022-21907, is a remote code execution (RCE) flaw in the HTTP Protocol Stack. This vulnerability can be enabled in Windows server 2022, 20H2 core, along with Windows 10 and Windows 11 versions. The vulnerability is wormable, as it does not require human interaction to spread its attack surface. Microsoft recommends that organizations prioritize patching this vulnerability immediately. IT managers can utilize their IT asset management software to identify unpatched or vulnerable servers.
Click here to read moreLog4j: How to Protect Yourself from This Security Vulnerability
The Log4j security vulnerability (a.k.a. Log4Shell) is becoming one of the worst recent security flaws to be uncovered. It affects millions of applications and makes targets out of unpatched systems that hackers can compromise and control. Log4j is a Java-based logging utility that is used in hundreds of millions of devices worldwide. The vulnerability, allows a threat actor to access a device remotely to gain entry into IT systems without authentication. However, there are steps IT managers can take to ensure their systems are protected. Organizations are urged to upgrade Log4j to version 2.16.0, that was released by Apache on December 13. Nonetheless, simply updating Java is not enough to combat the bug. Dan Piazza, technical product manager for Netwrix noted that "For organizations that still need to mitigate the vulnerability, they must update the log4j package itself and should not just update Java. This was an early misconception, that updating Java could reduce the severity of the vulnerability, which is simply not true. In addition, Cisco, Oracle and VMware have released out patches and fixes, and open source security provider WhiteSource has released a free developer tool called WhiteSource Log4j Detect that can be run to detect and resolve Log4j vulnerabilities. IT managers can also us the information provided by their IT asset management solution to identify vulnerable or unpatched servers.
Click here to read moreOvercoming Legacy Debt Is A Process Problem, Not A Modernization One
Legacy technology is any technology that can impede a business. It transcends mainframes and databases, and includes anything that shuts down business agility, efficiency and progress. Anne Thomas, distinguished research VP at Gartner noted that "Legacy technology is any technology that makes it difficult for organizations to change their application systems to support changing business requirements. And, therefore, it impedes business agility." Companies need to rethink long-term strategies and create a plan for applications as they become obsolete. Modernization needs to be a continuous process, constantly evaluating the out-of-date tech that needs to go. According to Thomas, firms should deal with legacy debt that the vendor or employees can no longer maintain as well as customized applications that are difficult to update as they reach end-of-life. IT management can use the information generated by their IT asset management solutions to identify legacy software and hardware and make plans to replace it.
Click here to read moreSecond Log4j Vulnerability Carries Denial-Of-Service Threat, New Patch Available
A second vulnerability impacting Apache Log4j has been discovered. According to the CVE description, the new vulnerability, (CVE 2021-45046) enables attackers to develop malicious input data using a JNDI lookup pattern, which results in a denial-of-service (DoS) attack. A patch for the new exploit, which removes support for message lookup patterns and disables JNDI functionality by default, has already been released. The Log4j 2.15.0 fix for the original flaw was described as incomplete in certain non-default configurations. The discovery of this second vulnerability is indicative of the ongoing security risks posed by the Log4j issue. IT managers ca use their IT asset solutions to identify unpatched and vulnerable systems.
Click here to read moreYour Microsoft Network Is Only as Secure as Your Oldest Server
For most corporations, desktop deployments are relatively under control, however server deployments may not be a comprehensive. There is evidence that when recent desktop Windows updates interact with older unpatched platforms it causes problems and undue hardships. The problem is not patching, but the server platforms that are in use for authentication and storage. If g Windows Server 2003 are in use in the network, it provides entry points for attackers and it allows SMB v1 to be deployed in the network. Consequently, networks are prevented from deploying more secure authentication techniques. There are inherent incompatibilities between Windows 10 and 11 and older servers. IT managers can use their IT asset management tools to identify servers running outdated operating systems and make plans for upgrades or replacements.
Click here to read more4 Tips for Adopting a Multi-Cloud Strategy
Today, cloud spend has increased across the board this year, alon g with with a decrease in on-premises software spend. Flexera's 2021 tech spend report indicates that firms are investing more in public cloud resources, which is the second-highest IT spend category after SaaS. Many companies are adopting multi-cloud cost management tools to help contain architecture costs. Forrester recommends performing cost management by adopting third-party tooling and solutions. Many of these tools are easy to implement and provide forecasting, optimization, and offer unified management of the entire space. An IT asset management solution with cloud-management capabilities can help manage cloud costs along with all on-site IT assets.
Click here to read moreShadow IT Is Evolving as Businesses Sanction More Apps
Managing rogue IT is a continuing challenge for CIOs and CISOs. The challenge stems from several factors: 1) they can t manager what they don t know exists, 2) cloud providers are very good at selling directly to end users, 3) the tools for discovering shadow IT are not fully effective. according to a survey from ManageEngine only about a third of U.S. companies are doing an adequate job of keeping rogue IT under control. However, the probability of getting shadow IT 100% under IT control is lower than ever, considering the ease with which technology can be purchased and the vast number of high-quality freemium apps that are available. CIOs can run network scanning software and track expenses at the departmental level to uncover as many unknown applications and services as possible. They can also talk to their peers in the organization to determine out what technology is currently in use, what they'd like to be using, any existing problems are, and the potential technology needs of any current projects.
Click here to read more90% Of Companies Use Cloud, But Core App Modernization Lags
Cloud computing is in use by a majority of organizations. According to data collected bty the Synergy Research Group data, the cloud infrastructure services market alone reached nearly $50 billion in Q3, up over. 35% year over year. Overall, in the first half of 2021, the cloud market was over $230 billion in revenue, up 25% year over year. Companies are changing how they implement cloud workloads, especially with regard to infrastructure as a service. Public cloud constitutes, over 60% of deployments, followed by private cloud utilization. Multicloud architecture is used in almost 25% of deployments, however multicloud is gaining traction with large-scale providers. Adoption of multicloud coincides with companies implementing highly controlled and strict cloud plans, as opposed to the gradual accumulation of services companies have adopted to in the past. With the rise of cloud-only operations, it is more critical than ever to utilize an IT asset management toolset that can manage a wide range of cloud operations.
Click here to read moreZero-Days Under Attack: Microsoft Plugs Exchange Server, Excel Holes
Microsoft recently released patches for at least 55 documented security vulnerabilities over a wide range of products. The company called urgent attention to two specific flaws that have already been exploited in the wild. Microsoft noted that the two under-attack vulnerabilities exist in Microsoft Exchange Server and Microsoft Excel. The company put a critical rating on the Exchange Server bug and warned that an authenticated attacker can launch code execution attacks. The Excel vulnerability affects Microsoft Office for macOS, however patches for the Apple platform are not yet available. The patches also include fixes for serious flaws affecting Azure, Microsoft Edge, Windows Defender, Visual Studio and several Windows components. Six of the 55 security bulletins from Microsoft are rated critical. The company said, Our recommendation is to install these updates immediately to protect your environment. CIOs can use their IT asset management tools to identify vulnerable and unpatched systems and endpoints.
Click here to read more