// archives

TWC

This tag is associated with 4 posts

RSA 2015 – Microsoft Key Announcements in Security

 

The US RSA conference is probably the world’s leading security conference with about 30’000 participants and took place last week in San Francisco. Scott Charney, Microsoft’s CVP Trustworthy Computing, gave a noteworthy keynote on Enhancing Cloud Trust that can be watched here. It is well worth the time.

The announcements made by us and the presence that Microsoft had at the conference was impressive. The main theme was very clearly that we truly live in a mobile first, cloud first world and that with the explosion of devices and apps come new challenges. Security has been a top priority for Microsoft for a long time already and Microsoft is committed to providing customers with transparency and control over their data in the cloud. Here are the highlights that we announced:

  • New Security & Compliance signals and activity log APIs so that customers can access enhanced activity logs of user, admin and policy related actions through the new Office365 Management Activity API.
  • New customer Lockbox for O365 that brings the customer into the approval workflow if one of our service engineers would have to troubleshoot an issue that requires elevated access. With the customer lockbox the customer has the control to approve or reject that request.
  • Device guard is the evolution of our malware protection offering for Windows 10 and brings a new capability to completely lock down the Windows desktop such that it is incapable of running anything other than trusted apps on the machine.
  • Increasing levels of encryption where O365 will implement content level encryption for e-mail in addition to the BitLocker encryption we offer today (similar to OneDrive for Business’ per-file encryption). In addition we expect enabling the ability for customers to require Microsoft to use customer generated and controlled encryption keys to encrypt their content at rest.
  • Microsoft Passport is a new two factor authentication designed to help consumers and businesses securely log-in to applications, enterprise content and online experiences without a password.
  • Windows Hello which will provide that Microsoft Passport can be unlocked using biometric sensors on devices that support that (most notably iris and face unlock feature in addition to fingerprint).
  • Azure Key Vault which helps customers safeguard and control keys and secrets using FIPS 140-2 Level 2 certified Hardware Security Modules in the cloud with ease and at cloud scale and provides enhanced data protection and compliance and control.
  • New Virtual appliances in Azure where we work with industry leaders to enable a variety of appliances so that customers have greater flexibility in building applications and enabling among others network security appliances in Azure.
  • Enterprise Mobility where we have the Enterprise Mobility Suite (EMS) bringing customers enterprise grade cloud identity and access management, mobile device management and mobile app management and data protection (Reto’s comment: not new but worthy to call out having grown our install base by 6x just in the last year)

More information can be found on Scott Charney’s blog on “Enabling greater transparency and control” that also has further links to more in-detail information on the individual technologies mentioned above.

Posting personal Information online? Beware if you overshare!

A new Microsoft study shows that before posting personal information online, more than half of U.S. teens and parents don’t truly consider the potential consequences of their actions.  Teens recognize the importance of limiting what they share online, yet they still reveal more personal data than their parents.  Six in 10 teens also say they have so-called “friends” in their social networks whom they’ve never met in person.

Chances are you already have a “digital reputation,” and you may not even know it.  On the Internet, we create an image of ourselves through the information we share in blogs, comments, tweets, photos, videos, and the like. Others add their opinions – both good and bad – and contribute to our online reputations.  Anyone can find this information and make judgments.  Accordingly, everyone needs to be cognizant of what they’re posting online, and how that aggregated information can tell one’s personal story and shape their digital impression.

A recent Microsoft survey  found that 79 percent of hiring managers and job recruiters in the U.S. said they routinely review online reputational information when considering job applicants.   All of sudden, that photo of you partying hardy or playing a practical joke on a friend may not be so funny after all even if you consider them your private matter. College admissions officers are also looking into social networks. As college board vice president James Montoya points out, the people who evaluate applications at most schools are “often under 30 years old and often Facebook users themselves.” Of course they will check out your online reputation. Should a partying foto matter? I agree – no it shouldn’t. Can it make the tipping point in deciding for or against an applicant? Yes it very well can. As the Microsoft study shows – 70% of employers have turned down job applicants because they didn’t like what they found online.

Managing one’s online behavior and reputation is a key component of being a good digital citizen. Digital citizenship is usually defined as “the norms of behavior with regard to technology use.”  But digital citizenship is more than just teaching social norms – it’s a way to prepare young people for life in a technology-rich society. Digital citizenship empowers young people and helps them develop a sense of ownership and personal responsibility – in order to make appropriate, ethical decisions in the online world.

In an effort to create a culture of “good digital citizens,” Microsoft is committed to helping youth, teens, parents and caregivers think about their online reputations.  Today we are releasing a new whitepaper titled Fostering Digital Citizenship and a Teen Reputation Guide.  The guide notes a series of tips, including …

  • Tip 1 If you wouldn’t wear it, Don’t share it!
  • Tip 2 Don’t use technology as a weapon. Really angry? Walk away from the keyboard – hands off your smartphone.
  • Tip 3 Know what the Internet is telling people about you. Regularly search yourself online.
  • Tip 4 Create strong passwords, change them often, and don’t share them with friends.

We make a host of digital citizenship resources available at our Safety & Security Center.  In addition to our research, reputation guide and whitepaper we’ve recently created three infographics, depicting how teens spend their time online, as well as an “at school” Internet safety tip card. Check them out or contact me if you are interested in learning more.

Rather than relying solely on protective measures, an approach to online safety that includes digital citizenship will help young people interact more safely in the online world. Teaching them about digital literacy, and digital ethics and etiquette is an important part of successfully navigating today’s online and offline world. It can make the difference between getting into the university they want and getting the job they applied for.

Security updates – measuring effect (Autorun Abuse)

Obviously I am a strong advocate of keeping computers up to date and especially on installing security updates. However, it is normally pretty hard to measure the effects on such activities. And now that we have an example where we can see very directly the effect of a security update I would like to share that with you.

Maybe you are aware of Windows XP and Vista’s autorun feature. Basically very convenient but also unfortunately widely exploited. On 8. February Microsoft started the release of updates for Win XP and Vista to prevent AutoPlay from being enabled automatically except in combination with CD’s and DVD’s. Effectively locking down this feature more. With this we can now look at infection rate before and after this update and measure the effect. You can read the whole thread in our threat research and response blog.

In a nutshell – the effect was pretty substantial. The infection rates for Win XP and Vista went significantly down. XP’s infections on scanned computers were reduced by 59% and the ones of Vista by 74% while Win 7 stayed basically the same as it had this feature already enabled. An additonal interesting point is that the infection rate didn’t change significantly with Win XP SP2 as it is out of support and therefore didn’t get the update.

Chart showing effect of autorun update. Source: Microsoft

 

 

 

 

 

 

 

Another interesting aspect was that the overall infection rates changed also significantly. By May of 2011 the number of infections found by the Microsoft Malicious Software Removal Tool was reduced by 68%. Which means that by making even just one section of a computer “population” more secure it can have a significant residual effect with the rest of the computers.

My conclusion? This is a good example to show the effectiveness of security updates. So my recommendations is to let the update feature install them automatically as soon as they get available and to make sure that your operating system is still receiving the updates and is not out of support. So if you still run XP SP2 please make sure to update as quickly as possible to XP SP3.

New Microsoft Security Incident Report – current and emerging threats

 

This morning the microsoft trustworthy computing team released the new Security Incident Report (SIR). The report provides in-depth perspectives on software vulnerabilities, software vulnerability exploits, malicious and potentially unwanted software, and security breaches in both Microsoft and third party software.

And why is this relevant? While reading a crime novel has certainly more entertainment value, the report gives an impression on where cybercrime is heading and how the threats are evolving. This has relevance for security experts, government officials but also for everybody using the internet. Here are some information that I found especially interesting:

  • Cybercriminals continue in deceiving customers through “marketing-like” campains and fake product promotions.
  • Pornpop is an adware family that attempts to display adult advertising. In the 4th quarter of 2010 it was the most prevalent malware worldwide and was cleaned from nearly 4 million systems by Microsoft’s anti malware desktop products. Cybercrime has definitely moved to becoming a business.
  • Phishing attacks to social networking sites jump 8.3% to 84.5% which shows that criminals have seen success with social engineering based approaches especially on social networking sites.
  • Specifically to Switzerland. The MSRT detected malware on 4.1 of every 1’000 computers scanned in Switzerland in 4Q10. This compares to an average worldwide of 8.7 of every 1’000.

The security incident report is special insofar, that it contains the most comprehensive data coverage of any report in the industry. It includes over 600 million data samples, executing millions of malware removals annually, scanning billions of e-mails, over 280 million active Hotmail accounts, and billions of pages scanned by Bing each day. The data collection is actually quite impressive. The data included is gathered from a wide range of Microsoft products and services globally, including: Bing, Windows Live Hotmail, Forefront Online Protection for Exchange, Windows Defender, the Malicious Software Removal Tool (MSRT), Microsoft Forefront Client Security, Windows Live OneCare, Microsoft Security Essentials and the Phishing Filter in Internet Explorer.

You can read and download the report at www.microsoft.com/sir. Maybe not something to put on your bedside table as it will probably keep you awake at night!

About the Author

Reto is partner at PwC Switzerland. He is leading the Cybersecurity practice and is member of PwC Digital Services leadership Team. He has over 15 years work experience in an information security and risk focused IT environment. Prior to working at PwC he was Microsoft's Chief Security Officer for Western Europe and also has work experience as group CIO, Chief Risk Officer, Technical Director and Program Manager.

more about me and contact info

Translate

Chinese (Simplified)EnglishFrenchGermanItalianPortugueseRussianSpanish

replica Rolex