this is susan bradley for cso online today i'm going to talk about some changes that microsoft
made in its communication and how it presents and explains its security vulnerabilities
and its products the new security guides aligns itself with security industry standards
by describing these vulnerabilities in something called cvss the cvss provides a way to capture the
principal characteristics of a vulnerability and produces a numerical score reflecting its severity
this severity can be translated to a qualitative representation such as low medium or high to help
your organization assess and prioritize the vulnerability i'm going to take example here
for the month of january we're going to look at the top here of the different base score metrics
the one at the top is network and what network means is how does the attack come into your system
so there's four different types of attacks one is local adjacent network physical or network local
means the attacker has to have physical access to a vulnerable system adjacent network means the
attacker has to be close such as bluetooth or arp spoofing physical attacks obviously needs hands-on
connection and last but not least our dear friend network attacks it's the one we most usually
interact with and those are ones that are coming through the network and are remotely exploitable
the next section is attack complexity high means that the attack would be very complicated
media means that there's some circumstances that would make the attack hard to complete
but not impossible and finally low means the attack is very easy to
accomplish our next section talks about what kind of privileges are required
and it talks about next talks about user interaction if it takes a human
to click on something or if it's warmable totally from remote then the next section
talks about what's called temporal score metrics and that's exploit code is unproven
no exploit code is available so no one has come up with a a actual proof of concept
then it talks about what kind of fix is available official fix means there's a patch
and finally the last part talks about report confidence meaning that there's been an actual
proof of concept to the vendor meaning microsoft and they've proven out that this is an actual bug
it's not a theoretical bug that there's functional exploits out there that may prove what's going on
so let's give an example of january called cve 2021-1674 and it's the windows remote
desktop protocol core security feature bypass vulnerability and we see from this that it's got
in the network it's from the network it's got low attack complexity
low privileges are required there's no user interaction and we see that there's not that much
more information there's an acknowledgement of who found the bug but there's not really an
explanation of what's going on with the bug so we can better understand how to protect from it
while we're waiting for our testing process to occur now if you're like most of us you install
updates after you test for them you don't do them right away so in the meantime i look for
some other resources that i can better understand security vulnerabilities that come out one of
them is the zero day initiative and once a month there's a particular person by the name of dustin
childs and he comes out with security blog posts about the updates that come out that month and
he gives some guidance because his organization is actually involved in matching up researchers
with vendors and he makes sure that the the patches are responsibly disclosed to the vendors
and usually he goes in for the ones that go through their organization they actually discuss
a little bit more about the patch and what's going on so you can better understand the vulnerability
and perhaps better protect yourself while you're waiting for your testing process to occur
so you can see there are the ones that have gone through the zdi system they actually explain a
little bit more and discuss some of the the what's behind the bug a little more so you can better
understand what's going on and this is a blog post again comes out every month and i always come to
this site once a month to better read on the security bulletins that are coming out for that
particular month now in their blog post they don't have a lot of information about the particular
bug that i'm looking for the one the remote desktop protocol bug and you can even see
there he indicates the patch is a bit of a mystery it carries a relatively high cvss score
but it doesn't have an executive summary so we can only guess what security feature in rdp core
is being bypassed so this really doesn't give me a lot of information about this particular patch and
what's going on so i then use some other resources out there on the web one of the sites that i go
to is something called attackerkb.com and what they do and this is not just for microsoft other
vendors are on the site as well is they will list the cves and they'll go into detail about the cves
and it's a crowdsourced site so if you know anything about a cve by all means you can
come out here and put some more information yourself and it gives me a little bit more
it gives me more information about the particular cve and what's going on it's um i can read more a
little bit more about the potential way that they can come into my system another site that i use is
believe it or not the japanese microsoft security bulletin website now i don't speak japanese not a
single bit i mean i guess if you call the i can count to five in japanese but that's it
so what i do is i go out here and in any modern browser there's always a translate button and i go
out there and i translate the japanese website to english and suddenly i can read more about certain
security patches and they've got a little bit more information than the main microsoft site about
some details about security patches and issues so by all means take a look at the japanese security
website remember you can translate to english and it gives you a little bit more information
some of the next things i do is i actually use social media such as twitter believe it or not
researchers love to talk about their issues so i will go and i will copy that cbe number and i'll
go and search over on twitter and there's a search box in the corner and i paste that cve out there
and they search for the cve and i see if there's any additional information out there
in twitter about particular bug now some researchers will actually use this as
a pr site other times it's a repeat of what i already know so sometimes i have to go and i
have to read the information and say no that really doesn't expand on what i already know
that's just the repeat of the same blog information so this sometimes can be
very helpful sometimes in this case it's not very helpful so we can see that social media
sometimes helps sometimes doesn't help and so at the very top of the microsoft security bulletin
they're actually asking for feedback on their new bulletin and they ask you to either click there to
share your thoughts in a form or email them and by all means if you're looking for more information i
would strongly suggest that you give them feedback on their form you can go ahead and click there
either either email them or click on the form and provide them with more information about what you
might need in this their security bulletin now i've given them more feedback that i think there
needs to be a bit more of an executive overview because there's sometimes like this bug has shown
it doesn't give enough information i'd like a little bit more but by all means make your voice
heard give some feedback to the microsoft security bulletins team as to what you might like to see in
a security bulletin information to give you more information on how to better protect your systems
because it's my opinion that patches aren't enough you need to have information to keep
you more secure as well a good network isn't secure merely because we've installed an update
you're secure because we understand how the attack occurs so we can have to monitor and
prioritize our defenses until then this is susan bradley for cso online stay safe stay secure