Tag Archive for: Microsoft’s

Microsoft’s end-of-summer software security cleanse crushes more than 80 bugs • The Register

/in


Patch Tuesday For its September Patch Tuesday, Microsoft churned out fixes for 66 vulnerabilities alongside 20 Chromium security bugs in Microsoft Edge.

Affected products include: Azure, Edge (Android, Chromium, and iOS), Office, SharePoint Server, Windows, Windows DNS, and the Windows Subsystem for Linux.

Of these CVEs, three are rated critical, one is rated moderate, and the remainder are considered important.

One of the already publicly disclosed CVEs resolves a critical zero-day vulnerability (CVE-2021-40444) in MSHTML, also known as Microsoft’s legacy Trident rendering engine. The flaw can be abused to achieve arbitrary code execution using a malicious ActiveX control within a Microsoft Office document that hosts the browser rendering engine. This is the vulnerability we learned of on September 7 and was used in targeted attacks on Office users. Code to exploit the hole has been passed around the web and between security researchers, so get patching.

Another fix updates a publicly disclosed patch from August 11 which addressed last month’s Print Spooler RCE (CVE-2021-36958).

“The update has removed the previously defined mitigation as it no longer applies and addresses the additional concerns that were identified by researchers beyond the original fix,” explained Chris Goettl, VP of product management at Ivanti, an IT asset management firm, in a statement emailed to The Register. “The vulnerability has been publicly disclosed and functional exploit code is available, so this puts further urgency on this month’s Windows OS updates.”

Goettl said the third previously disclosed vulnerability (CVE-2021-36968) addresses a privilege elevation flaw in Windows DNS. “This CVE applies to the legacy Windows OSs. Public disclosure gives threat actors a bit of a jump start on developing a working exploit.”

There are other two critical…

Source…

Microsoft’s Opportunity to Reinvigorate Security Leadership

/in


The White House-hosted cybersecurity summit on August 25, 2021 was an opportunity for representatives from the private and public sectors to discuss how they can collaborate to address pressing information and computer security issues.  Many of the leading technology companies, such as Amazon, Google, IBM and Microsoft, made commitments to expand cybersecurity funding and to help address the shortage of skilled cybersecurity professionals.

Microsoft pledged to “invest $20 billion over the next five (5) years to accelerate efforts to integrate ‘cybersecurity by design’ and deliver advanced security solutions.  This was, by far, the largest commitment from any of the leading cloud and information technology companies in attendance.

$20 Billion, in Context

Microsoft’s commitment to invest $20 billion over five years to improve cybersecurity software resilience is a significant dollar amount. However, when put into context, the amount represents only a tiny share of the total amount companies are presently spending on (and earning from) cybersecurity. According to IDC and Gartner, the overall market for cybersecurity products and services was between $125 billion and $134 billion in 2020.

On average, then, Microsoft’s promise breaks down to $4 billion a year; substantially more than the $1 billion in security investment Microsoft committed to in 2017.  It is also only a fraction of the $10 billion in revenue Microsoft earned over a 12-month period from “advanced security and compliance” products and services sold to hundreds of thousands of enterprise customers.  In fiscal year 2021, for instance, Microsoft had total revenue of $168 billion with net income of $61 billion.

Reinvigorate Trustworthy Computing

One of the seminal moments in cybersecurity history was the “Trustworthy Computing” memo Bill Gates sent to all Microsoft employees on January 15, 2002. In that email, Gates (then chairman and chief software architect at the company) stated that Microsoft needed to focus on building more reliable products. Security requirements needed to be the priority.

That focus led to the development of Microsoft’s security development life cycle (SDL) process, on which all…

Source…

Microsoft’s Surface Duo Android phone will get three years of updates – The Verge

/in
  1. Microsoft’s Surface Duo Android phone will get three years of updates  The Verge
  2. Microsoft Surface Duo to receive three years of Android updates  BGR India
  3. Don’t worry about the older hardware, the Surface Duo will get three years of Android updates  TechRadar Singapore
  4. Microsoft’s Surface Duo is a big-picture product  Computerworld
  5. View Full Coverage on read more

“android security news” – read more