Tenable advises organsations to patch Windows OS to protect from “zero-day” expolit

Microsoft, for the sixth month in a row, patched over 100 CVEs in the August 2020 Patch Tuesday release, including 17 CVEs rated critical. For the first time in three months, this update includes patches for two vulnerabilities that were observed being actively exploited in the wild. Please find below a comment from Satnam Narang, Staff Research Engineer at Tenable about this month’s patch update.

“Microsoft has patched over 100 CVEs again, addressing 120 CVEs, including 17 critical vulnerabilities. For the first time in three months, a pair of vulnerabilities have been reported as being exploited in the wild. CVE-2020-1380 is a remote code execution vulnerability in Microsoft’s Scripting Engine due to how objects in memory are handled by Internet Explorer. In order to exploit this vulnerability, an attacker would need to convince their victim to either visit a website containing exploit code or open a malicious document that contains an embedded ActiveX control. Successful exploitation would grant the attacker the ability to execute arbitrary code as the current user.

If said user happens to have administrative privileges, the attacker would be able to perform a variety of actions including creating accounts with full privileges, accessing and deleting data and installing programs. This vulnerability has reportedly been exploited in the wild as a zero-day, likely as part of a targeted attack.CVE-2020-1464 is a spoofing vulnerability in Windows due to an issue with validating file signatures. Successful exploitation of this flaw would allow an attacker to bypass file signature verification to load improperly signed files.

Microsoft says this vulnerability has been exploited in the wild and is publicly known, though they do not provide any further details. Because it affects all currently supported versions of Windows, organizations should apply these patches as soon as possible. This month’s release also contains a fix for CVE-2020-1337, an elevation of privilege vulnerability in the Windows Print Spooler service. Exploitation of this vulnerability would give the attacker elevated privileges on the vulnerable system. This would allow an attacker to execute arbitrary code, create new accounts with full privileges, access and/or delete data and install programs.

The Windows Print Spooler service may sound familiar as it was weaponized by a separate vulnerability in the infamous Stuxnet worm a decade ago. CVE-2020-1337 is a patch bypass for CVE-2020-1048, another Windows Print Spooler vulnerability that was patched in May 2020. Researchers found that the patch for CVE-2020-1048 was incomplete and presented their findings for CVE-2020-1337 at the Black Hat conference earlier this month.” – Satnam Narang, Staff Research Engineer at Tenable.

ADATA Introduces Falcon and Swordfish SSDs- High-Performance Drives to Deliver Increased Productivity and Creativity

The SSDs deliver blazing fast sequential read and write speeds making it ADATA’s highest performing SSD.

NEW DELHI, India – August 12, 2020 – ADATA, a leading manufacturer of high-performance DRAM modules and NAND Flash storage application products and accessories, today unveiled the launch of two new PCIe Gen3x4 M.2 2280 solid state drives (SSD), the ADATA FALCON and SWORDFISH. Both SSDs are designed to help creative minds boost their productivity. They are built with 3D NAND Flash memory and support the PCIe Gen3x4 interface for excellent performance and reliability. The SWORDFISH features sustained read/write speeds of up to 1800/1200MB1 per second for smooth productivity as well as SLC caching, host memory buffer, and random 4K read/write of 180/180K1 IOPS. And, the FALCON delivers read/write speed of up to 3100/1500MB per second for uninterrupted productivity and creativity. With 3D NAND Flash, the FALCON features higher efficiency and increased reliability compared to 2D NAND SSDs. It comes in diverse capacities, ranging from 256GB to 2TB, and features data protection and correction technologies to expand the lifespan of SSD.

“Our Premier Falcon and Swordfish SSDs deliver all the simplicity and reliability enthusiasts demands, in an ultra-compact, high-performance package refined with ADATA quality assurance to deliver leading performance, data reliability, and endurance.” said, Sachin Sharma, Country Manager – India at ADATA Technology (India) Pvt. Ltd. “Rapid growth in technology and intensive usage patterns of data stretch the limits of these professionals. We at ADATA are committed to ease the work and life of them“.

ADATA FALCON

ADATA FALCON comes in diverse capacities, ranging from 256GB to 2TB and features data protection and correction technologies to expand the lifespan of SSD. The FALCON sports intelligent SLC caching, host memory buffer, and random read/write of 180/180K IOPS to give creators seamless performance for creating. The FALCON also comes with a stylish aluminum alloy heatsink for heat dissipation. The FALCON sports an aluminum alloy heatsink with etched grooves that not only look good but also keeps things cool for stable operations during intensive tasks.

ADATA SWORDFISH

As with the FALCON, the SWORDFISH is also equipped with 3D NAND Flash memory and utilizes the PCIe Gen3x4 interface. The SWORDFISH features sustained read/write speeds of up to 1800/1200MB1 per second for smooth productivity as well as SLC caching, host memory buffer, and random 4K read/write of 180/180K1 IOPS. The SSD comes in capacities ranging from 250GB to 2TB. For stable operations, the SWORDFISH sports a beautifully etched aluminum alloy heatsink that not only looks cool, but also stays cool, even during the most intensive tasks.

With support for LDPC (Low-Density Parity-Check) error correcting code technology, the FALCON and SWORDFISH can detect and fix errors to ensure data integrity and thus enjoy extended lifespans. AES 256-bit encryption keeps the data inside the SSDs password-protected and away from prying eyes.

Every FALCON and SWORDFISH purchase qualifies for free downloads of ADATA SSD Toolbox and Migration Utility. SSD Toolbox allows users to monitor and manage the SWORDFISH with drive status, wear level, and lifespan information. The Migration Utility is especially helpful for users making the move from HDD to SSD, as it is designed for simple and quick backup and migration of the contents of entire drives, including the operating system.

Price, Availability & Warranty:

KBC Computech, is exclusively National Distributor for Falcon & Swordfish SSD across PAN India.

These products are exclusively available on Amazon and comes with the warranty of 5 years.

The partners can reach out to ADATA sales representatives:

Ashwini: 8566950003 for North India

Hanuman: 9029997111 for East India

Ramesh: 9892544391 for West India

Shivraj: 9900508823 for South India.

# # #

About ADATA

ADATA Technology, one of the world’s largest vendors of DRAM modules and USB flash drives, provides complete solutions, including memory cards, solid-state drives, and portable hard drives. ADATA products also include on the go power for mobile devices and the company is now a major provider of advanced LED lighting. ADATA products continue to garner international acclaim from organizations such as iF Design Awards (Germany), red dot Awards, CES Best of Innovations Awards, Good Design Awards (Japan), Best Choice of Computex Awards, and Taiwan Excellence Gold Awards. The company’s slogan of Love, Life, and Dreams embodies the ADATA brand and the role of innovative memory products in the human pursuit of universally cherished ideas. For more information, please visit www.adata.com

Remote Working Made Safer Using Access Gateway

The COVID-19 pandemic has forced many organizations to adapt to a new reality where much of the staff have to work from home. This poses significant challenges because the existing VPNs the companies had in place were not designed to handle a sudden explosion of remote workers. With infrastructure becoming expensive it’s a good opportunity to have remote access with zero trust architecture to provide a safe and secure remote working environment for employees. Many organizations that had been reluctant in moving towards remote access were found to be completely unprepared to tackle the sudden lockdown, which negatively impacted their businesses. To overcome situations like these, different business units, project groups, partners, contractors and guests require secure and different levels of remote access and often require a user experience tailored to employees unique requirements and devices. Mobile devices and Bring Your Own Device (BYOD) present additional challenges in providing on-demand connections in a manner that keeps data secure in the corporate network and limits exposure. But with just remote access there also comes the vulnerability of an opportune moment for the hackers to execute cyber-attacks and gain access to sensitive data of commercial value.

“The increasing global spike in the number of phishing emails from last few months is not new to anyone. These have been indicating a serious and targeted attempt to exploit the anxiety related to the pandemic. Remote access in combination with zero trust is the perfect solution to counter such threats. With Array’s Network ADC, SSL VPN and WAF solutions, organizations will be at an advantage. This combined with zero trust – a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect before granting access gives organizations an edge like never before.” said Shibu Paul, Vice President – International Sales at Array Networks.

Array’s secure remote access solutions provide greater levels of security, a greater range of access methods, a broader range of device support and the ability to provide differentiated, identity-based access tailored to the needs of multiple communities of interest. Besides, with Array’s secure mobile access solution, sensitive data remains protected on the enterprise network and is accessible anytime, anywhere, so BYOD becomes an advantage rather than a threat to security. Mitigating risks associated with business continuity events and realizing gains through higher employee productivity are driving increased demand for remote access. While traditional VPNs are well suited for giving remote access to employees they are not as adept at supporting office workers. Remote access can be cost-effectively scaled for as many workers as needed even from a single appliance. It’s not just employees, even third-party vendors who work remotely have the advantage of being under the protection of Array’s remote access solutions. What’s more, because data never leaves the network, security is assured.

The Covid-19 situation has led to a significant rise in phishing attacks and social engineering scams. Threat actors are using Covid-19 themes to trick users into clicking on malicious links that spread ransomware, harvest credentials and so on and to fight these threats organizations need rigid security measures. They need to keep in mind that a zero trust framework cannot be implemented without a secure tool for remote access. Zero trust has many benefits when combined with remote access. It can help organizations cut back on complexity, reduce its attack surface, and increase visibility for auditing and compliance. There are a few best practices when configuring remote access within a zero trust framework like strict authentication rules, restrict authorization and auditing. The zero trust architecture is similar to one-to-one segmentation and helps in preventing DDoS attack, server scanning, application exploits, man-in-the-middle attacks and SQL injection.

It is all the more important now to have a network security model that verifies the user for the organization at every step of the way and all the time. With the combination of remote access and zero trust, organizations find an answer to the security concerns during the pandemic times.

# # #

About Array Networks

Array Networks solves performance and complexity challenges for businesses moving toward virtualized networking, security and application delivery. Array addresses the growing market demand for network functions virtualization (NFV), cloud computing, and software-centric networking. Proven at more than 5,000 worldwide customer deployments, Array is recognized by leading analysts, enterprises, service providers and partners for pioneering next-generation technology that delivers agility at scale. Visit: www.array-networks.co.in to know about Network Functions Virtualization (NFV), cloud computing, and software-centric networking.

Crayon, the Software Experts, are now Microsoft FastTrack Ready Partner – An Honour for a limited number of Partners Worldwide!!!

 Being a FastTrack Ready partner enables Crayon to provide eligible customers to accelerate deployment and end-user adoption of their Microsoft 365 solutions.

MUMBAI, India – August 10, 2020

Crayon – the Software Experts, is now a Microsoft FastTrack Ready Partner, an honour enjoyed by a limited number of partners worldwide.

Being FastTrack Ready enables Crayon to provide eligible customers to accelerate deployment and end-user adoption of the Microsoft 365 solutions.

The Microsoft FastTrack Ready program provides a closer working relationship between Microsoft and Crayon to help its customers maximise the success and utilisation of Microsoft 365 within their organisation.

“Microsoft FastTrack Ready partners follow proven best practice methodologies for envisioning, on-boarding and the adoption of Microsoft 365 technologies and solutions. We are pleased to update our next level of partnership with Crayon India, as we have achieved FastTrack ready partnership with them. This will help Crayon for faster M365 deployment in order to drive customer adoption. Looking forward and here’s wishing Crayon India Team all the very best for this endeavor” said Shakeb Rais, Partner Lead at Microsoft India.

Commenting on the news of this latest Microsoft recognition, Vikas Bhonsle, CEO at Crayon India said, “We are obviously delighted to be a Microsoft FastTrack Ready partner, which furthers strengthens our close working relationship with Microsoft. It reflects the commitment and enthusiasm of our teams in helping our customers drive tangible business benefits, using Microsoft suite of M365 products and collaboration technology. We want to support organisations end to end in their transformational journey, be it serving them with the right cloud technology, cloud migration & deployment or cloud optimisation.”

“Gartner recently reported that by the end of 2022, 70% of teams in the enterprise will rely on workstream collaboration as the primary means of communicating, coordinating, and sharing information,” Vikas further added.

Customers engaging with Crayon with Microsoft FastTrack program will enjoy the following benefits:

1. Guidance through best practice deployment methodologies
2. Access to a collective wealth of expertise
3. Seamless customer engagement initiatives
4. A streamlined journey to the Microsoft Cloud
5. User adoption advice from certified specialists
6. And of course, all the skill sets around Software & Cloud consulting, helping customers optimise infrastructure, Support & Managed Services.

“It has been an incredible journey so far, As an approved FastTrack Ready Partner, we are qualified to help organizations to deploy Microsoft 365 – Office 365, Windows 10 and Enterprise Mobility + Security (EMS) cloud solutions and drive user adoption. I am proud to say that our performance, expertise, technical intensity and our Software & Cloud optimisation strengths have put us head and shoulders above the rest,” said Rajesh Thadhani, Executive Director – Digital Transformation & Services at Crayon India.

Please reach out to us today to discuss how we can help you to leverage the power of your Office 365 investment, just in case you are planning to start a digital transformation project across a large, dispersed workforce.

# # #

About Crayon

Crayon, a global leader in IT and digital transformation services and the largest independent ‘cloud economics’ practice, strongly believes in “Pay-per-usage” model — organizations must pay for the IT resources they actually need. Crayon is the most reliable and trusted technical advisor for many of the world’s leading organizations. Through unique people, tools, and systems, the company ensures the best ROI from complex technology investments. Crayon — specialized in software asset management (SAM), cloud and volume licensing and associated consulting services, is headquartered in Oslo, Norway with offices around the world. For more information, visit: www.crayon.com

How to Enhance Your Data Security Through Encryption?

The digital world may have brought the entire physical world close, virtually. One can experience a virtual butterfly effect while being a part of the digital world, where a threat actor sitting in one part of the world targets another who is miles away from him/her. Security of our data is of paramount importance. This is why, encryption – a technology of scrambling data can help so that only authorized parties can understand the information. Based on this logic in 1995 SSL encryption was introduced where SSL is an encryption-based internet security protocol developed to ensure privacy, authentication and data integrity in internet communications. It is now deployed in many consumer products. In a world in which cyber-criminals are active 24/7, trying to get their hands on as much data as possible, this level of security is an essential feature of online data exchange. But we say that encryption is a double-edged sword and this is where Array’s SSL Intercept comes into picture.

“The SSL Intercept is a unique function that offers to decrypt SSL traffic for 3rd-party security appliances to perform the inspection; it then re-encrypts traffic before forwarding it to a final destination. It provides decryption of SSL/TLS traffic to allow security appliances to fully inspect the traffic without incurring the large compute load of SSL processing. Built-in SSL resources offload compute-intensive decryption, allowing security appliances to operate at their peak performance level,” said Shibu Paul, Vice President – International Sales at Array Networks.

Traditionally, network managers deploy best-of-breed, single-function security appliances to protect against attacks, intrusion and other threats. However, solutions such as WAF, NGFW, IDS/IPS and DDoS protection either lack the ability to decrypt and inspect SSL traffic as high volumes of SSL traffic can overwhelm their in-built SSL resources, robbing processing cycles and impacting performance or sometimes lack the time but SSL intercept helps in decrypting and re-encrypting the traffic. It also acts as an optional site service that protects users from sites with malicious payloads or inappropriate content and whitelisting ensuring that sensitive information to and from trusted sites is not decrypted. Besides, Array can load balance traffic across multiple 3rd-party security appliances to help assure high performance and availability of critical security mechanisms. SSL intercept function is provided by Array vAPV virtual appliances running on Array’s Network Functions Platform. The vAPV runs as a large, medium, small, entry or shared entry virtual application delivery controller on Array’s AVX network functions platforms to flexibly enable on-demand, full-featured load balancing and application delivery with guaranteed performance. Array APV Series appliances are also ideal for intranet applications as well as home-grown enterprise applications and services. The high-performance SSL resources process SSL traffic far more efficiently than the majority of security appliances in turn helping assure their performance. The SSL intercept offers multiple modes to accommodate different deployment environments, including L2 or L3 mode, integrated or distributed mode, forward or reverse proxy and Web-agent service.

Array’s Certified Platform Ready 3rd-party ecosystem includes technology partners whose respective products have been tested and proved compatible with AVX Series Network Functions Platforms. Deployment guides and other materials provide guided roadmaps for deploying these solutions with Array’s network functions virtualization environment. SSL intercept is also available as a stand-alone virtual appliance or a dedicated hardware appliance.

# # #

About Array Networks

Array Networks solves performance and complexity challenges for businesses moving toward virtualized networking, security and application delivery. Array addresses the growing market demand for Network Functions Virtualization (NFV), cloud computing, and software-centric networking. Proven at more than 5,000 worldwide customer deployments, Array is recognized by leading analysts, enterprises, service providers and partners for pioneering next-generation technology that delivers agility at scale. Visit: www.array-networks.co.in to know about Network Functions Virtualization (NFV), cloud computing, and software-centric networking.