Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2014-04-27 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

IE Zero Day Advisory from Microsoft

Published: 2014-04-27
Last Updated: 2014-04-28 00:06:08 UTC
by Tony Carothers (Version: 1)
20 comment(s)

Microsoft released a Security Advisory yesterday(1) which impacts Internet Explorer versions 6 through 11, taking advantage of a vulnerability in Flash.  The Microsoft advisory notes  that ??The vulnerability is a remote code execution vulnerability. ? The vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website.? 

This exploit is currently being seen in limited attacks at this time against versions IE9-IE11, according to the security vendor Fireeye(2), who is working with MS at this time.  At the time of this writing, a patch is not yet available.

Actions to take to limit the impact of the vulnerability:

- Install EMET . According to Fireeye's testing, EMET 4.1 and 5 do break the exploit.

- Disable Flash . Note that IE 10 and later on Windows 8 do include Flash. But you can still disable it. This is an IE vulnerability but Flash is needed to exploit it and bypass some of the protection techniques implemented in newer versions of IE/Windows.

- Enable the Internet Explorer "Enhanced Protection Mode" (EPM) which became available in Internet Explorer 10. But it may break some plugins.

 

(1)https://technet.microsoft.com/en-US/library/security/2963983

(2)http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html


tony d0t carothers --gmail

Keywords:
20 comment(s)

The Dreaded "D" Word of IT

Published: 2014-04-27
Last Updated: 2014-04-27 03:07:06 UTC
by Tony Carothers (Version: 1)
4 comment(s)

Weekends are usually a good time to catch up on the dreaded ??D? word of IT professionals everywhere?. Documentation.  Security is a process, and as such requires good documentation to drive those processes.  All organizations have (or should have) documentation to support their efforts and guide their work, typically in the form of a Site Security Plan, Change Control processes, Roles and Responsibilities, etc., etc. These process are in place to support constantly changing systems.  Updating the documentation is often a painful process that is left for less mundane and intriguing tasks, thus it is relegated to weekend work.  

 

The landscape of technology, requirements, threats, and vulnerabilities is changing every day, so the processes we use to support these need to adapt as well.  One key to managing the documents is establishing an annual review process of the document library.  These reviews can be broken up over the calendar year, to spread out the work; the larger documents can be sectioned out to team members for draft input and review over a period of time.  The review process, if possible, should include an objective review from a peer or colleague to assist in providing objective feedback and analysis.

 

Any process works best when it is known, documented, and implemented, and Security processes require the same care and feeding as the systems they serve.  

tony d0t carothers --gmail

 

Keywords: Change CM Process
4 comment(s)
Diary Archives