Datashield Becomes Member of Microsoft Intelligent Security Association (MISA)

Datashield recommends patching any Microsoft Exchange servers due to the recently released series of vulnerabilities, CVE-2021-26855 in particular, and the evidence of this exploit being utilized in the wild. An unauthenticated attacker can compromise the server and obtain access into the network. There is no current mitigation besides patching the affected Exchange servers. Datashield has deployed some initial detections for this CVE, but is still evaluating and creating new detections as we gather more information.

Azure Virtual Network (VNet) is a platform enabling you to create and maintain private networks in the context of Azure cloud and services. VNet works in a similar fashion a network in a data center works while introducing added advantages such as scale, availability, and isolation.

Microsoft Azure ExpressRoute is a connector that uses a connectivity provider to extend your on-premises networks into the Microsoft Azure and Microsoft 365 clouds over a private connection.

Microsoft announced a critical vulnerability as part of their Patch Tuesday on 10/12/2020. CVE-2020-16898, dubbed "Bad Neighbor", is a remote code execution (RCE) that occurs when the Windows TCP/IP stack incorrectly handles ICMPv6 Router Advertisement packets with an even length field.

Organizations running applications in public clouds need a centralized system for deploying managing and securing their apps.

Azure Security Center by Microsoft is a solution that provides unified security management across hybrid cloud workloads. It offers threat protection for data centers within both cloud workloads and on-premises. The platform also works with hybrid clouds that are not part of the Azure ecosystem.

Datashield recommends patching any Microsoft Windows domain controllers due to the recently released vulnerability, CVE-2020-1472, and subsequent release of publicly available proof of concepts (POC’s). An unauthenticated attacker with access to the network and a route to a domain controller, will allow attackers to compromise it and obtain domain admin privileges in the network. There is no current mitigation besides patching the affected domain controllers.