Onepoint Security by Yurika Sensei https://docs.microsoft.com/archive/blogs/yurikasensei/feed.xml Wed, 17 Apr 2019 03:48:04 GMT en-US hourly 1 Get Started with Security Update Guide - new portal for security updates https://docs.microsoft.com/archive/blogs/yurikasensei/get-started-with-security-update-guide-new-portal-for-security-updates Thu, 13 Apr 2017 15:26:22 GMT https://blogs.technet.microsoft.com/yurikasensei/?p=195 Microsoft Security Bulletin website. We have been asked for better access to security update information, as well as easier ways to customize their view to serve a diverse set of needs. Now, Microsoft released a new destination for security vulnerability information, the Security Update Guide.  

What is the Security Update Guide?

Security Update Guide is a new single destination for security vulnerability and security update information. In addition to providing the rich detail of traditional security bulletins, the new Security Update Guide will add support for new information, and new methods of browsing this information.  

Support for Filtering and Sorting

On the Security Update Guide dashboard page, you can see the release notes associated with the monthly security release. Also, you can filter and sort by product or date range and searching for updates by CVE or KB Number. blog1     You also can drill into each vulnerability. There are links to the KB article, the packages, and CVE details pages. blog2

A new RESTful API

When you click the “DEVELOPER” tab, you’ll sign-in and be given the ability to create a API key and view code samples & API descriptions for programmatically pulling data from Microsoft, in the industry-standard CVRF format. More information is also available at Security Update Guide project on GitHub. blog3        

Example: Generating a HTML Document of Monthly Updates

As an example of PowerShell scripts, let me show you how to generate the summary of monthly security updates by using PowerShell.
  1. Navigate to the Security Update Guide, Developer tab and sign in with your Microsoft Account to generate an API Key.

Copy the Key into an easily accessible location for copying into Clipboard for use in a moment.

e.g. A quick text file created in Notepad saved to the Desktop

 blog4  
  1. Access the GitHub sample codes page and copy the sample script.
blog5  
  1. Edit the script to enter your API key in the following line:
Set-MSRCApiKey -ApiKey "<your API key>" -Verbose  
  1. Edit the script to enter the month of interest in the following line. If it is 2017 April. It will be 2017-Apr
$monthOfInterest = '<year-month>'  
  1. Run the script. In this sample script, the HTML document of Monthly Updates will be generated at c:\temp\MSRCAprilSecurityUpdates.html
blog6   Note: Run the Script for the first time You will momentarily be prompted to install the GitHub NuGet Library as below, please Press “Y” then Enter. Note this prompt will only appear the first time you run the script. blog7 Note: Please see LICENCE here for term of use.      

Where is the Bulletin Number (MSxx-xxx)?

With the launch of the Security Update Guide, the way Microsoft documents vulnerability and security updates has been changed. This old form of security update documentation, including bulletin ID numbers is being retired. The new model for documenting security updates is the Security Update Guide. Instead of bulletin IDs, the new Security Update guide pivots on vulnerability ID numbers and KB Article ID numbers.  There is no context for bulletin ID numbers in the new model, so bulletin IDs are not included.   blog8  

Any change on how to deploy the security updates?

This is the new way of delivering the information of vulnerabilities and security updates. There is no change on security update packages or deployment of security updates. Microsoft Patch Management tools (WSUS, SCCM) are continue to work.    

Questions, Feedback?

If you have questions and feedbacks, please visit Security Update Guide Frequently Asked Questions (FAQ) and Security Update Guide – User Forum         For many years, it’s been a pain and expensive process to gather vulnerability and security update data from the bulletin website each month for many IT professionals.  Now, with this new Security Update Guide, I belive it becomes a very easy and industry standard process.     Yurika Kakiuchi Security Program Manager, Customer Services and Support  ]]> Microsoft SHA-1 Deprecation Plan - User's Guide https://docs.microsoft.com/archive/blogs/yurikasensei/sha1-users-guide Tue, 29 Nov 2016 11:36:01 GMT https://blogs.technet.microsoft.com/yurikasensei/?p=115 Microsoft Advisory and Microsoft Edge Official Blog, Microsoft, in collaboration with other members of the industry including various browser venders, is taking gradual steps to deprecate SHA-1 and warn users of the possible risk when they encounter websites using the SHA-1 certificate. We have already started to remove the “lock icon” from the address bar in Microsoft Edge and Internet Explorer when browsing the websites with SHA-1 Certificate. Update: We are updating our timelines to deprecate SHA-1 by mid-2017 May 2017 to ensure compliance in all configurations and scenarios for Microsoft Edge and Internet Explorer 11. At that time, these browsers will prevent sites that are protected with a SHA-1 certificate from loading and will display an invalid certificate warning. Additionally, the next release of Windows 10 will block SHA-1 by-default in the browser. Customers who would like to disable SHA-1 today may do so with the instructions in the Microsoft Edge Developer Blog Update: On May 9, 2017, Microsoft will release an update to Microsoft Edge and Internet Explorer that will prevent sites that are protected with a SHA-1 certificate from loading and will display an invalid certificate warning. Additionally, the Windows 10 Creators Update blocks SHA-1 by-default in the browser. Update: Security Advisory 4010323 Deprecation of SHA-1 for SSL/TLS Certificates Beginning May 9, 2017, Microsoft released updates to Microsoft Edge and Internet Explorer 11 to block sites that are protected with a SHA-1 certificate from loading and to display an invalid certificate warning. This change will only impact SHA-1 certificates that chain to a root in the Microsoft Trusted Root Program where the end-entity certificate or the issuing intermediate uses SHA-1. Enterprise or self-signed SHA-1 certificates will not be impacted, although we recommend that all customers quickly migrate to SHA-2 based certificates. Please review security advisory 4010323 for more details about the issue, a complete list of affected software, answers to frequently asked questions, and links to additional resources. Security Advisory 4010323: https://technet.microsoft.com/library/security/4010323 Knowledge Base Article 4010323: https://support.microsoft.com/kb/4010323   For more information, please see Windows Enforcement of SHA1 Certificates.     This post is to provide summary of the SHA-1 deprecation with infographics and user’s guidance to help you test ahead of time. If you are a website administrator, please check your site to make sure your site won't be alerted . For the latest information, please see https://aka.ms/sha1   - Yurika Kakiuchi,  Security Program Manager,Customer Service & Support       sha1update_201705-1     sha1update_201705-2          ]]> Can Microsoft IT be infected by computer viruses? – The answer is YES! https://docs.microsoft.com/archive/blogs/yurikasensei/msit_malware Thu, 13 Oct 2016 09:40:44 GMT https://blogs.technet.microsoft.com/yurikasensei/?p=45 Malware Infections at Microsoft In Microsoft internal IT environment, real-time antimalware software (anti-virus software) is required on all user devices that connect to the Microsoft corporate network. User computers must be running the latest version of the software, antimalware signatures must be no more than six days old. Windows Defender and System Center Endpoint Protection 2012 (SCEP) that come with Windows 8 and later, are the antimalware solutions that Microsoft IT deploys to its users (Windows Defender and SCEP have the same signature file and engine). The average monthly level of antimalware compliance rate at Microsoft exceeded 98 percent each month during the second half of 2015 (from July to December).   Concerning malware infection, there were two million malware detection reports in the second half of 2015. These are known malware that are detectable and blocked by signature files. There are also new types of malware that are not reflected to the signature database. In that case, malware is not recognized when it first penetrates the computer, but is detected at timings such as regular scanning after the signature file is updated. 41 cases of such malware infection were confirmed in the second half of 2015. These infections are blocked by real-time protection of antimalware software that recognized the "suspicious behavior", and threats are blocked by Windows mitigation features or intrusion detection systems such as Windows Defender Advanced Threat Protection. 20161012_Pic2 Infections and removals at Microsoft in 2H 2015, by category 20161012_Pic3 Infections and removals at Microsoft in 2H 2015, by file type    

Not only Antimalware, but Defense-in-depth Measures

Antimalware software has no meaning if malware infection is not completely eliminated. That is definitely not the case. Antimalware software serve an important role as the first fort to prevent intrusion to devices. Also, it plays a key role as to disinfect malware as well as detecting it. In fact, the 2 million detections in Microsoft internal IT environment are known malware, and because antimalware software was running properly, intrusion was prevented. On the other hand, it is true that many sophisticated attacks are designed to avoid detection by antimalware software, and technology of the software cannot prevent all attacks. That is the cause of the 41 infection cases at Microsoft.   To efficiently secure the enterprise environment, first understand the antimalware software execution status and its effect. Then, on the assumption that intrusion caused by virus infection will occur, it is important to implement security measures "in-depth". Microsoft analyzed how the 41 infection cases happened and how we can prevent the damage caused by the infections, and reflected the results to defense-in-depth measures. Here are our top ten examples of the security measures implemented at Microsoft internal IT environment:
  • Ensure that all software deployed on computers in the environment is updated to the latest version and has applied the latest security updates.
  • Ensure that both Microsoft products and non-Microsoft products are updated to the latest version.
  • Centralize management of users and devices using Active Directory. Use Group Policy, Intune to apply updates, and to enable security features such as firewall or SmartScreen.
  • Enable antimalware software.
    • Enable Windows Defender Cloud Protection in Windows 10 and configure it so that the signature files are updated real-time.
  • Use the intrusion detection system.
    • Use Windows Defender Advanced Threat Protection (Windows 10) to quickly detect and address threats that are not detected by antimalware software.
  • Consider the necessity of technology that might become a clue to attacks, such as Java and Flash, and develop a plan to minimize its use.
  • Use AppLocker to block the installation and use of unwanted software such as peer-to-peer (P2P) applications.
  • Implement the Enhanced Mitigation Experience Toolkit (EMET) on important systems, to minimize exploitation of unknown vulnerabilities in your environment.
  • Implement strong password policies, and strengthen authentication as necessary by using multi-factor authentication or smart cards to protect credentials.
  • Enable Windows PowerShell v5 security features via Windows Management Framework 5.0:
    • Script Block Logging
    • System-Wide Transcripts
    • Constrained PowerShell
    • Antimalware integration (AMSI)
 

The Goal of Security is not to reach for "Zero Infection"

The security goal of Microsoft internal IT environment is not making the open rates of targeted mail to zero, nor to boost the antimalware compliance rate to 100% and prevent all virus infection. For example, the average monthly antimalware compliance rate at Microsoft exceeded 98 percent during the second half of 2015. But we believe that attempting to boost the compliance rate of an organization with more than 600,000 devices will likely be a costly endeavor and not realistic to operate. We are aware that a certain number of users (e.g. 2 percent at Microsoft IT) have devices that do not comply with the policies, and aim to reduce the risks by implementing defense-in-depth measures. The goal of attackers is not malware infection; it is to steal information and make money by using malware. Therefore, our goal is to prevent the attacker to achieve their goal. That is to say, to prevent information disclosure caused by security breaches, and to minimize damage when such breach occurs. It is important to measure effectiveness of basic security measurements and to plan on the assumption that intrusion will occur. Implementing antimalware measurements only or setting uniformed numerical targets is not essential. Microsoft believes that setting a goal for overall operation and measurement from the big picture, analyzing the effectiveness, periodically reviewing and improving measurements is the key to enterprise security.   For more information on the malware infection in the Microsoft IT environment, be sure to check out "Microsoft Security Intelligence Report". We hope it will help management of your IT environment!   Malware free is the best way to be! -Yurika]]>