Intermedia Cloud Communications’ Post

🚨 Security Alert: CrowdStrike Incident Affects 8.5 Million Windows Devices 🚨 Microsoft has confirmed that a recent incident involving CrowdStrike has impacted approximately 8.5 million Windows devices. The disruption has caused significant operational issues across various sectors globally. To mitigate the damage, Microsoft has released a recovery tool aimed at helping affected systems return to normal. Key Points: Impact: 8.5 million Windows devices affected Response: Microsoft has deployed a recovery tool to assist in resolving the issue Sectors Affected: Aviation, healthcare, financial services, and more This incident highlights the importance of robust cybersecurity measures and prompt response strategies. Read more https://lnkd.in/g4ZZvgHE #CyberSecurity #Microsoft #CrowdStrike #ITOutage #PenetoLabs

These software updates are often important to address security concerns. Going forward, updates with broad organizational impact will need to be sandbox tested before general release. We clearly can't rely on vendor testing. #SoftwareUpdates #Cybersecurity #Testing #SecurityConcerns

On 19TH July 2024, a significant global technology outage unfolded following a flawed software update by CrowdStrike, a leading cybersecurity firm. The issue originated from a defective deployment of CrowdStrike's "Falcon" tool update for Windows hosts, which affected critical systems worldwide. The fallout included disruptions across multiple sectors: flights were grounded, banks faced payment processing issues, media outlets experienced broadcast outages, and hospitals encountered delays in appointments and critical care services. Despite CrowdStrike's assurance that the incident was not a cyberattack but rather a technical glitch confined to a single update, the impact was widespread, affecting approximately 8.5 million Windows devices globally. In response, Microsoft's David Weston, Vice President of Enterprise and OS Security, highlighted collaborative efforts with CrowdStrike and others to address the issue. They engaged in automating solutions, deploying engineers to assist customers, and collaborating with AWS and GCP for comprehensive support. Conversely, CrowdStrike CEO George Kurtz expressed apologies for the disruption caused by their Falcon update on Windows hosts, swiftly identifying and fixing the issue while ensuring ongoing updates and support through official channels. Both emphasised transparency and customer-focused resolutions amidst the challenges. On 19th July 2024, CERT-In (Computer Emergency Response Team of India) also responded by issuing a critical advisory. The advisory highlighted the severity of the outage, which affected numerous sectors globally, including aviation, banking, healthcare, and media. The advisory mentioned the importance of immediate action for organisations impacted by the update, which led to system crashes and the infamous "Blue Screen of Death (BSOD)" error on Windows devices using CrowdStrike's Falcon Sensor. CERT-In recommended affected organisations to boot their systems into Safe Mode or Windows Recovery Environment, navigate to the specific directory, and delete the problematic file identified as "C-00000291*.sys" to restore normalcy and has advised to continuously monitor for updates from CrowdStrike and collaborations with their technical support channels for further guidance and assistance. On 20th July 2024, Microsoft introduced an updated recovery tool with two repair options to assist IT administrators in expediting the repair process. The Microsoft Recovery Tool, available for download from the Microsoft Download Center (https://lnkd.in/gQteRibJ), includes detailed recovery steps for Windows clients, servers, and OS hosted on Hyper-V. This incident highlights the importance of robust cybersecurity measures and collaborative efforts among technology providers to mitigate such disruptions in the future.

CrowdStrike Microsoft Outage: A Detailed Explanation The major tech outage that occurred on July 19th, 2024, which disrupted businesses and services worldwide, stemmed from a faulty update deployed by cybersecurity firm CrowdStrike. Here's a breakdown of the incident: Cause: CrowdStrike's Falcon Sensor, an antivirus software used on Microsoft Windows machines, received a defective update. This update triggered an unintended consequence, causing widespread disruption. Impact: The faulty update impacted numerous organizations relying on Microsoft 365 applications, including: Airlines: Flights were grounded due to issues with critical systems. Businesses: Many businesses faced disruptions to online services and internal operations. Banks: Banking services might have been inaccessible for a period. Media Outlets: News organizations and television stations could have experienced problems. Timeline (Approximate): Deployment: The exact time of the faulty update deployment by CrowdStrike remains unclear. Outage: The outage likely began in the early hours (local time) for affected organizations worldwide on July 19th. Resolution: CrowdStrike identified the issue, issued a fix, and reported its resolution within a timeframe yet to be definitively established. Key Points: This incident highlights the critical role of cybersecurity software updates and the potential consequences of even minor glitches. It underscores our dependence on a limited number of software providers and the far-reaching impact disruptions can have. Importantly, CrowdStrike emphasized that this was not a security breach or cyberattack.

A critical vulnerability has been identified in Cisco Firepower Management Center (FMC) Software’s web-based management interface. This vulnerability could potentially allow authenticated, remote attackers to conduct SQL injection attacks on affected systems. This vulnerability, tracked as CVE-2024-20360, poses significant risks, including unauthorized data access, command execution on the underlying operating system, and privilege escalation to root. Vulnerability Details – CVE-2024-20360 The vulnerability exists due to inadequate user input validation within the web-based management interface of Cisco FMC Software. ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service An attacker with at least Read Only user credentials can exploit this flaw by sending crafted SQL queries to the affected system. Successful exploitation could lead to severe consequences, such as: Obtaining any data from the database Executing arbitrary commands on the underlying operating system Elevating privileges to root This vulnerability affects devices running a vulnerable release of Cisco FMC Software, regardless of the device configuration. Cisco has confirmed that Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software are unaffected by this vulnerability. Mitigation and Fixed Software Cisco has released software updates to address this critical vulnerability. No workarounds are available, so users need to apply the updates promptly. Customers with service contracts can obtain the necessary security fixes through their usual update channels. Those without service contracts can contact the Cisco Technical Assistance Center (TAC). Users are advised to consult the official Cisco Security Advisory for detailed information on the affected software releases and the fixed versions. Cisco strongly recommends that all users of affected Cisco FMC Software versions upgrade to the fixed software releases to mitigate the risks associated with this vulnerability. Users should ensure their devices have sufficient memory and that current hardware and software configurations are compatible with the new release. For further assistance and to determine their exposure to vulnerabilities, users can utilize the Cisco Software Checker tool, which is available on the Cisco website. The discovery of CVE-2024-20360 underscores the importance of regular software updates and vigilant security practices. Organizations using Cisco FMC Software should act swiftly to apply the necessary updates and protect their systems from potential exploitation

In today's interconnected world, the sudden incapacitation of approximately 8.5 million computers globally due to the "Blue Wall" disruption has sent shockwaves across the globe. This unprecedented outage, impacting users of the Windows operating system, has raised serious questions about the resilience, security, and reliability of our increasingly interconnected digital infrastructure. #cybersecurity #ggf #ggfdialogue #ggfnews #ggfupdate #Ravindrakirti #software

Lessons learnt : This issue predominantly affected Microsoft users who were utilizing CrowdStrike antivirus software. The problem stemmed from an update issued by the third-party security software provider, CrowdStrike, which corrupted several Microsoft Windows operating system drivers, preventing the system from restarting. CrowdStrike Falcon, primarily used for Windows computers, is designed for threat detection. To mitigate such incidents, companies should adhere to IT Service Management (ITSM) processes, including change management, problem management, crisis management, and manual backup procedures. This incident serves as a critical reminder for software and IT giants globally to ensure stringent oversight and thorough testing when integrating updates from third-party vendors. Additionally, maintaining regular communication with vendors and conducting comprehensive risk assessments before deploying updates can further safeguard against such disruptions. #ITSM #CyberSecurity #ChangeManagement #ProblemManagement #CrisisManagement #BackupProcedures #Microsoft #CrowdStrike #TechUpdate #RiskManagement #SoftwareIntegrity #ESG #BRSR #TechNews #ITResilience #ThirdPartyRisk

🔧 Weekly Tech Tip: Regularly Update Your Software 🔧 Keeping your software up-to-date is crucial for maintaining a secure and efficient IT environment. Outdated software can be a gateway for cyberattacks and can cause compatibility issues with other systems. 🛠 Why Regular Updates Matter: Enhanced Security: Updates often include patches for vulnerabilities that could be exploited by cybercriminals. Improved Performance: New updates can bring performance enhancements, making your systems run smoother. New Features: Updates often come with new features and improvements that can boost productivity. Compliance: Staying updated helps ensure you meet industry standards and compliance requirements. 🌐 Best Practices for Software Updates: Automate Updates: Where possible, enable automatic updates to ensure you’re always running the latest version. Schedule Regular Checks: Regularly check for updates if automatic updates are not available. Backup Before Updating: Always back up your data before performing updates to prevent data loss in case something goes wrong. Educate Your Team: Make sure your team understands the importance of keeping their software up-to-date. Stay ahead of potential threats and keep your business running smoothly by prioritizing software updates! #TechTip #CyberSecurity #SoftwareUpdates #BusinessIT #ParksideTech https://lnkd.in/gmVZxSVB

Is your post-warranty service retention strategy for your servers up-to-date? Without warranty coverage, hardware failures can lead to potential downtime and increased costs, while expired warranties may mean you're not receiving critical security updates and patches, leaving your servers susceptible to cyber attacks and data breaches. Constor Solutions can help you mitigate these risks with our comprehensive support and solutions. Our extended warranty services ensure continuous coverage for your server hardware beyond the manufacturer's warranty period, providing peace of mind against unexpected hardware failures. We offer maintenance contracts tailored to your specific needs, providing regular inspections, preventive maintenance, and timely repairs to keep your servers running smoothly, minimizing the risk of downtime and ensuring optimal performance. Our team can manage security updates and patch management for your servers, even after warranty expiration, enhancing your server's overall security posture and mitigating the risk of cyber threats and data breaches. We also offer expert technical support to address any server-related issues or challenges you may encounter, ensuring minimal disruptions to your business operations. Let Constor Solutions help you plan and execute server hardware upgrades or refresh cycles as needed, ensuring your infrastructure remains modern, reliable, and supported. Our proactive approach minimizes the risk of hardware failures and ensures compatibility with the latest software and applications. Protect your investment and maintain your peace of mind by partnering with Constor Solutions for your post-warranty server needs. Contact : [email protected] Phone : 02045746946 #servermaintenance #itsupport #itsecurity #serversecurity #datacenter #riskmitigation

𝗧𝗼 𝗶𝗻𝘀𝘁𝗮𝗹𝗹 𝗡𝗲𝘅𝗽𝗼𝘀𝗲, 𝘆𝗼𝘂'𝗹𝗹 𝗻𝗲𝗲𝗱 𝘁𝗼 𝗳𝗼𝗹𝗹𝗼𝘄 𝘁𝗵𝗲𝘀𝗲 𝗴𝗲𝗻𝗲𝗿𝗮𝗹 𝘀𝘁𝗲𝗽𝘀: 𝟭. 𝗢𝗯𝘁𝗮𝗶𝗻 𝘁𝗵𝗲 𝗡𝗲𝘅𝗽𝗼𝘀𝗲 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲: Visit the Rapid7 website (https://lnkd.in/dYSbnx3A) and acquire the necessary installer or virtual appliance for your operating system or virtualization platform. Note that Nexpose may require a license or subscription, so make sure you have the appropriate credentials or contact Rapid7 for further assistance. 𝟮. 𝗥𝗲𝘃𝗶𝗲𝘄 𝘀𝘆𝘀𝘁𝗲𝗺 𝗿𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀: Check the system requirements documentation provided by Rapid7 to ensure your environment meets the necessary hardware, software, and network specifications for installing Nexpose. 3. Prepare the installation environment: Set up a server or virtual machine that meets the system requirements. This could involve installing the supported operating system, allocating adequate resources (CPU, memory, disk space), and ensuring network connectivity. 𝟰. 𝗥𝘂𝗻 𝘁𝗵𝗲 𝗶𝗻𝘀𝘁𝗮𝗹𝗹𝗲𝗿 𝗼𝗿 𝗱𝗲𝗽𝗹𝗼𝘆 𝘁𝗵𝗲 𝘃𝗶𝗿𝘁𝘂𝗮𝗹 𝗮𝗽𝗽𝗹𝗶𝗮𝗻𝗰𝗲: Execute the Nexpose installer or import the virtual appliance file into your virtualization platform (such as VMware, Hyper-V, or VirtualBox). Follow the on-screen instructions and provide the necessary configuration details when prompted. 𝟱. 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗲 𝗡𝗲𝘅𝗽𝗼𝘀𝗲: Once the installation is complete, you'll need to configure Nexpose. This typically involves setting up network scanning ranges, specifying credentials for scanning devices, and defining scan schedules. You may also need to configure any additional features or integrations you require, such as patch management or compliance reporting. 𝟲. 𝗣𝗲𝗿𝗳𝗼𝗿𝗺 𝗮𝗻 𝗶𝗻𝗶𝘁𝗶𝗮𝗹 𝘀𝗰𝗮𝗻: Initiate a scan using Nexpose to identify vulnerabilities in your environment. This scan will help populate the vulnerability database and provide you with a starting point for remediation efforts. 𝟳. 𝗥𝗲𝘃𝗶𝗲𝘄 𝘀𝗰𝗮𝗻 𝗿𝗲𝘀𝘂𝗹𝘁𝘀 𝗮𝗻𝗱 𝘁𝗮𝗸𝗲 𝗮𝗰𝘁𝗶𝗼𝗻: Analyze the scan results generated by Nexpose. Prioritize the vulnerabilities based on their risk scores and potential impact on your environment. Develop a plan to remediate the vulnerabilities, which may involve applying patches, implementing configuration changes, or other security measures. 𝟴. 𝗠𝗼𝗻𝗶𝘁𝗼𝗿 𝗮𝗻𝗱 𝗺𝗮𝗶𝗻𝘁𝗮𝗶𝗻: Continuously monitor your environment for new vulnerabilities and updates. Regularly schedule and perform scans using Nexpose to stay on top of the evolving threat landscape. Keep the Nexpose software up to date by applying patches or upgrading to newer versions as they become available. #cybersecurity #infosec #internet