Hello and welcome to TSD, your regular blog post with top of mind security issues! TSD began as an internal newsletter that our Security Lead, Daniel Tobin, would circulate to the team each Tuesday. It proved to be a great resource for all of us so we thought, why not share it with all of you? Our hope is that it helps make you just a bit more secure.
Check back here every Tuesday for more TSD or sign up below to stay in the loop!
Hi Cyraloons and welcome to week 10 of TSD!!, your regular email / blog post with top of mind security issues, a few security tips for both work and home and at least 1 fun thing related to owls.
Please reach out to us directly, via security@cyral.com or on Twitter at @dant24 if you have any questions, concerns, tips or anything else!
- Last Tuesday was Patch Tuesday which listed 111 security holes in Microsoft products. Update, update, update, but hopefully you already did, however, based on a report from CISA just published, we still have a long way to go. The CISA report listed the top 10 most exploited vulnerabilities for 2016 – 2019 and found 7 were related to Microsoft products across various malware families with Apache Struts, Adobe Flash and Drupal rounding out the top 10. Please make sure you enable automatic updates wherever possible. Read the full breakdown of Patch Tuesday from Krebs On Security.
- Microsoft has open sourced their COVID-19 threat data which you can start digging into and incorporate into your own MISP. The Hive Project is another great place to get started if you are interested in buidling out your own platform for bringing in this data. Read the full announcement on Microsoft’s Security Blog.
- “A malicious group is currently targetting academic data centers for CPU mining purposes. The attacker is hopping from one victim to another using compromised SSH credentials.” This is a great time to password protect your SSH keys if you haven’t already. Read the full alert from the EGI CSRIT
Owl fun and facts:
This owl with feathery footsies is an Eurasian Eagle Owl, or it’s awesome scientific name Bubo bubo. Bubo bubo is one of the largest owls, weighing up to 9 pounds with a 6 foot wing span. Image above via Animal Fact Files on Youtube
A Shout Out:
Do you need to lock down your AWS IAM usage but are unsure of how to do so without interrupting your team? AirIAM has the solution for you: “AirIAM is an AWS IAM to least privilege Terraform execution framework. It compiles AWS IAM usage and leverages that data to create a least-privilege IAM Terraform that replaces the exiting IAM management method.” AirIAM was developed by Bridgecrew, the creators of Checkov. Read more about what AirIAM can do. Then go ahead and download AirIAM from Github.
That’s owl for now!
