Governance and Update Policies

When an update is necessary (as it is every month) “Patch Tuesday” means Microsoft combines multiple necessary vulnerability updates into one convenient date (2nd Tuesday). For example July it was on the 9th. One of my favorite sites shows the significance of this almost every month: Krebsonsecurity July Edition. What can one do to prevent … Read more

Better password policy: Complex? or longer passwords?

What is the better password policy? A longer password like NIST 800-53 says?   Key NIST password guidelines Minimum length of 8 characters and maximum length of at least 64 characters if chosen by the user. Allow usage of ASCII characters (including space) and Unicode characters. Check prospective passwords against a list that contains values … Read more

Fake Email? or Phishing Email?

I got this email from Cathy Clarke… It claimed to be able to help me get a tax refund due to the SETC and ERC federal programs because of the pandemic   Here is text of email: Hi <insert-name>, Just wanted to check if you’ve submitted your tax refund claim yet? SETC and ERC are … Read more

Patch Tuesday: Zero-day Vulnerability Fixes

Yes it was Patch Tuesday July9th (yesterday). This means Krebsonsecurity had a post describing all the action: The first Microsoft zero-day this month is CVE-2024-38080, a bug in the Windows Hyper-V component that affects Windows 11 and Windows Server 2022 systems. CVE-2024-38080 allows an attacker to increase their account privileges on a Windows machine. Although … Read more