NSA Shares Guide for Mitigating Cloud Vulnerabilities, Threats

health IT Security | January 27, 2020

The National Security Agency released new guidance designed to help organizations across all sectors mitigate cloud vulnerabilities, including identifying cloud security components, threat actors, and potential mitigation techniques. According to the guide, cloud vulnerabilities can be broken down into four key categories: misconfiguration, poor access control, shared tenancy flaws, and supply chain vulnerabilities. The guide is designed both for the organizational leadership team and technical staff and is broken down into three sections: cloud components, cloud threat actors, and cloud vulnerabilities and mitigations. The hope is that leadership can gain perspective on cloud security principles, while addressing cloud security considerations to assist with cloud service procurement.

Spotlight

Are your VMware licenses expiring? Are your VMware costs rising? Two benefits of switching to Red Hat® Virtualization from VMware vSphere include no software licensing conflicts and an end-user portal at no extra charge.


Other News
VMWARE

VMware and Wipro Expand Partnership to Power Customers’ Digital Transformation

VMware | May 09, 2022

VMware, Inc. and Wipro Limited announced an expanded collaboration that will enable customers to achieve the cloud freedom they desire with the enterprise control they require as they execute their digital strategies. The companies are bringing together the power of VMware Cross-Cloud™ services with industry-leading Wipro FullStride Cloud Services to help global enterprises accelerate app modernization and reduce the cost, complexity, and risk of moving to the cloud Multi-cloud architectures can accelerate service delivery and give lines of business and IT the flexibility to innovate using the best services from different cloud providers, without lock-in. Multi-cloud also comes with inherent complexity that can slow down application development, increase management costs, create networking and security blind spots, and produce sub-par user experiences. VMware and Wipro are collaborating to help eliminate the complexity and risk inherent in customers’ multi-cloud initiatives. Wipro will offer a full portfolio of digital transformation services that includes VMware Cross-Cloud services across the Americas, Europe, Middle East, Africa, and Asia Pacific. “Digital transformation and multi-cloud are inseparable concepts, requiring that industry leaders such as VMware and Wipro bring together our collective strengths to help make multi-cloud as easy to adopt and manage as possible,” said Zia Yusuf, Senior Vice President, Strategic Ecosystem And Industry Solutions, VMware. “Together, VMware and Wipro are providing enterprises the solutions and services they need to harness the power of multi-cloud to achieve value from technology investments faster, compete more effectively, and operate their businesses more efficiently and securely.” The innovative solutions we have created with VMware enable enterprises to accelerate the development and deployment of modern apps while dramatically simplifying the management of a multi-cloud infrastructure. This strategic partnership will help customers accelerate innovation and drive agility and scale, which makes it an exciting proposition for leading enterprises.” Jason Eichenholz, Senior Vice President, Global Head of Ecosystems & Partnerships, Wipro Limited About VMware VMware is a leading provider of multi-cloud services for all apps, enabling digital innovation with enterprise control. As a trusted foundation to accelerate innovation, VMware software gives businesses the flexibility and choice they need to build the future. Headquartered in Palo Alto, California, VMware is committed to building a better future through the company’s 2030 Agenda. About Wipro Limited Wipro Limited is a leading global information technology, consulting, and business process services company. We harness the power of cognitive computing, hyper-automation, robotics, cloud, analytics, and emerging technologies to help our clients adapt to the digital world and make them successful. A company recognized globally for its comprehensive portfolio of services, strong commitment to sustainability and good corporate citizenship, we have over 240,000 dedicated employees serving clients across six continents. Together, we discover ideas and connect the dots to build a better and a bold new future.

Read More

VIRTUAL SERVER INFRASTRUCTURE

AudioEye Appoints David Moradi as Chief Executive Officer

AudioEye | January 17, 2022

The Board of Directors of AudioEye, Inc., an industry-leading digital accessibility platform delivering website accessibility compliance to businesses of all sizes, has appointed David Moradi as its Chief Executive Officer (CEO), effective January 13th, 2022. David Moradi has served as the Company's interim CEO over the last 18 months, a period of significant progress in the Company's transition to a highly scalable platform with industry-leading gross margins and considerable improvements in the Company's product, technology, and go-to-market. Over the past two years, David has skillfully, tenaciously, and tirelessly led AudioEye's transformation into a higher margin and more scalable enterprise with a truly differentiated product that brings transparency to the issues of web accessibility. He sets the tone with his relentless pursuit of excellence and his passion for eradicating all barriers to digital accessibility, and he has assembled an extremely strong leadership team to help achieve this mission. We value not only his strong leadership and commitment but also the significant personal financial investment he has made in AudioEye, which we believe strengthens the alignment of interest between management and other shareholders." Carr Bettis, Executive Chairman of AudioEye David Moradi is an entrepreneur, investor, and advisor to numerous market-leading technology companies. Moradi is Co-Founder and Executive Chairman of First Contact Entertainment, a leading virtual reality (VR) game development studio. He is also the founder and CEO of Sero Capital LLC, a family office that invests in all stages of a company's lifecycle, from angel investing to late-stage private investments. Before First Contact and Sero Capital, Moradi was the founder and CEO of Anthion Management, a technology fund with peak assets exceeding one billion dollars. Before Anthion, Moradi was a Portfolio Manager at firms including Pequot Capital Management and Soros Fund Management. Before that, he was a special situations analyst at Imperial Capital. Moradi holds a B.A. in psychology from the University of California, Los Angeles. He is also the founder and Chairman of the David Moradi Foundation, a charitable foundation supporting education and veterans. Moradi added, "My tenure at AudioEye began as Chair of the Strategic Committee of the board of directors in 2019, with the goal of building a scalable product with high gross margins. We have made tremendous progress on these initiatives, and I am excited to continue working with one of the best leadership teams I've worked alongside, as well as exceptional employee talent. We have hired over 90 people over the last 18 months, including every member of leadership, and now have the strongest team at any point in the Company's history." About AudioEye AudioEye is an industry-leading digital accessibility platform delivering ADA and WCAG compliance at scale. By combining easy-to-use technology and subject matter expertise, AudioEye helps companies and content creators solve every aspect of web accessibility — from finding and resolving issues to navigating legal compliance, to ongoing monitoring and upkeep. Trusted by the FCC, ADP, SSA, Samsung, and others, AudioEye delivers automated remediations and continuous monitoring for accessibility issues without making fundamental changes to website architecture, source code, or browser-based tools. Join us on our mission to eradicate barriers to digital access.

Read More

VMWARE

CISA recommends VMware, F5 patches. Liquidity mining fraud. Strapi issues patched. TDI clarifies data incident.

CISA | May 20, 2022

VMware yesterday addressed issues in several of its products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager. That these are more significant than the ordinary run of patches may be seen by the way the US Cybersecurity and Infrastructure Security Agency (CISA) has discussed them. Alert (AA22-138B), "Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control" warns that "malicious cyber actors, likely advanced persistent threat (APT) actors, are exploiting CVE-2022-22954 and CVE-2022-22960 separately and in combination." The Alert adds, "CISA expects malicious cyber actors to quickly develop a capability to exploit newly released vulnerabilities CVE-2022-22972 and CVE-2022-22973 in the same impacted VMware products. In response, CISA has released, Emergency Directive (ED) 22-03 Mitigate VMware Vulnerabilities, which requires emergency action from Federal Civilian Executive Branch agencies to either immediately implement the updates in VMware Security Advisory VMSA-2022-0014 or remove the affected software from their network until the updates can be applied." US Federal civilian agencies have until next Monday to identify and remediate the issues, and they're required to report completion no later than Tuesday. Fraudulent liquidity mining. Sophos describes the way the threat of fraudulent liquidity mining is shaping up in decentralized finance systems. "Legitimate liquidity mining exists to make it possible for decentralized finance (DeFi) networks to automatically process digital currency trades," Sophos explains, and criminals are using social engineering to abuse such systems to defraud cryptocurrency investors of their holdings. More loosely regulated than conventional cryptocurrency exchanges, which use market makers and seek to ensure that sufficient reserves are on hand to back trades, DeFi exchanges use Automated Market Makers (AMMs). Sophos explains that "Smart contracts built into the DeFi network have to rapidly determine the relative value of the currencies being exchanged and execute the trade. Since there is no centralized pool of crypto for these distributed exchanges to pull from to complete trades, they rely on crowdsourcing to provide the pool of cryptocurrency capital required to complete a trade—a liquidity pool." Liquidity pool tokens, ("LP tokens") are used to represent the portion of the liquidity pool an investor contributed. But unethical DeFi operators can cancel the tokens (or simply not create a pool to back them in the first place), and this, Sophos observes, offers "ample opportunity for digital Ponzi schemes, fraudulent tokens, and flat-out theft." CMS vulnerabilities disclosed and patched. The Synopsys Cybersecurity Research Center (CyRC) has identified two vulnerabilities in Strapi. Strapi is an open-source headless content management system (CMS) Javascript software that enables developers to quickly design and build content-rich APIs. Both vulnerabilities involve authenticated users with access to the Strapi admin panel having access to private and sensitive data, such as email and password reset tokens. The first vulnerability allows for the authenticated user to view private and sensitive data for other admin panel users that have a relationship with content accessible to the authenticated user. The second vulnerability allows for the authenticated user to view private and sensitive data for API users if content types accessible to the authenticated user contains relationships to API users. The vulnerabilities are fixed in newer, updated versions of Strapi, and Synopsys has commended Strapi for its quick response to the discovery. Texas Department of Insurance clarifies facts surrounding its data incident. The Texas Department of Insurance (TDI) has sent around a fact sheet that clarifies a data incident the agency sustained earlier this year: "In January 2022, TDI found the issue was due to a programming code error that allowed internet access to a protected area of the application. TDI promptly disconnected the web application from the internet. After correcting the programming code, TDI placed the web application back online. The forensic investigation could not conclusively rule out that certain information on the web application was accessed outside of TDI. This does not mean all the information was viewed by people outside TDI. Because we couldn't rule out access, we took steps to notify those who may have been affected." While data could have been accessed by unauthorized personnel, TDI has investigated and found that, "There is no evidence to date that there was a misuse of information."

Read More

VMWARE

Broadcom in Talks to Acquire Cloud Company VMware

VMware | May 23, 2022

Broadcom Inc. is in talks to acquire VMware Inc., the cloud-computing company backed by billionaire Michael Dell, according to people familiar with the matter, setting up a blockbuster tech deal that would vault the chipmaker into a highly specialized area of software. The discussions are ongoing and there’s no guarantee they will lead to a purchase, said the people, who asked not to be identified because the matter isn’t public. VMware currently has a market valuation of about $40 billion. Assuming a typical premium, the potential deal price would be higher, though the terms under consideration couldn’t be learned. Shares in VMware rose 15% in premarket trading on Monday, which would give the company a market value of about $46 billion. Broadcom, which has a valuation of about $222 billion, fell 2.4%. The transaction would extend a run of acquisitions for Broadcom Chief Executive Officer Hock Tan, who has built one of the largest and most diversified companies in the chip industry. Software has been a key focus in recent years, with Broadcom buying CA Technologies in 2018 and Symantec Corp.’s enterprise security business in 2019. A representative for VMware declined to comment. A representative for Broadcom wasn’t available for comment. “Investors have been increasingly focused on Broadcom’s appetite for another strategic or platform enterprise software acquisition—especially given the recent compression in software valuation, “ Wells Fargo analysts wrote after Bloomberg News’s report. “An acquisition of VMware would be considered as making strategic sense; consistent with Broadcom’s focus on building out a deepening enterprise infrastructure software strategy.” Broadcom makes a wide range of electronics, with its products going into everything from the iPhone to industrial equipment. But data centers have become a critical source of growth, and bulking up on software gives the company more ways to target that market. Broadcom was previously in talks to acquire SAS Institute Inc., a closely held software company valued at $15 billion to $20 billion. But those discussions ended last year without a deal.

Read More

Spotlight

Are your VMware licenses expiring? Are your VMware costs rising? Two benefits of switching to Red Hat® Virtualization from VMware vSphere include no software licensing conflicts and an end-user portal at no extra charge.

Resources