Why is the US even using Microsoft? They’re in effect an Indian company now
Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
171–180 of 456 posts
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#172Earlier quoted context omitted.
So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?
Yes, that's zero trust in a nutshell: A VPN that does a tunnel per TCP connection instead of one tunnel for all TCP connections. The other salient point is that all connections are established outbound through a broker, and importantly this is the case from both sides: The appliance at the terminating end of the tunnel establishes reverse tunnels to the broker for the connections, so it's never "exposed to the intern…
(Not just TCP)
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#173I've heard many Pentagon employees claim that if someone wanted to take out the US military, all they'd have to do is kill Sharepoint. It's the go-to warm-up joke whenever someone in the military gives a speech.
If somebody deleted PowerPoint the US Army would fall to its knees
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#174Earlier quoted context omitted.
Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remot…
Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!
Zero trust is when every session with every service is like its own VPN, independently authenticated and encrypted. Consider the way an HTTPS session between a server and a browser is created anew every time the browser accesses a domain, and ends after a short flurry of requests needed to load a page.
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#175Meanwhile, Citrix has been on fire causing much worse things (you can just grab any session you want and become anyone who's already logged in). Who needs to break into SharePoint when you're becoming someone who's already got access... including to everything else (not just SharePoint)
It's patchable, but it's been two times in a row now, and patching is always slow and incomplete.
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#176SharePoint is a great way to share data with third parties. You may even know some of them.
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#177We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD. No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned." So…
> Isn't security the number one priority in those spaces?
Money changing hands between suitable people who pop up together at the right social occasions is the priority.
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#178There is a war going on. It’s not just tanks in the Donbas, it’s a global intelligence and cybersecurity conflict.
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#179We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD. No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned." So…
The clients of said server are not going to be Linux. Running a secure, working, manageable CIFS server on Linux serving Windows clients is surely going to cost much more than just using the Microsoft solution. Some products don't even work at all with that configuration (e.g. Quickbooks Enterprise).
Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say
#180[dead]