We’re alerting our higher education technology community that yesterday’s (1/11/2022) Microsoft Patch Tuesday released critical security updates for Exchange and Windows OS that addresses several serious security vulnerabilities.
In the updates there are fixes for 97 total vulnerabilities, 9 of these are remote code exploits (RCE), 6 of them are classed as Zero-Day, and 1 of them is Wormable.
A wormable exploit means that it could self-propagate through a network with no user interaction. This vulnerability exploits how the OS processes unauthenticated HTTP traffic and carries a severity rating of 9.8 on a scale of 10. Windows Server 2019 and 2022, plus Windows 10 and 11 are affected.
Microsoft suggests patching all affected Windows versions as soon as possible, publicly facing servers with open HTTP and HTTPS ports are the most critical. The security updates for Exchange affect 2013, 2016, and 2019 and this includes hybrid servers for Office 365.
The update has only been released for the latest Cumulative Update (CU) for Exchange Server 2013 (CU23), and the last two CUs for 2016 (CU21 and CU22) and 2019 (CU10 and CU11). This means you will need to patch to one of these CUs before being able to apply this security update.
If you have any questions or need assistance, please click here.
For your reference, click here to read the Microsoft Exchange Team posted a blog about the update and patch process.
We held a complimentary emergency webinar with our most trusted security experts on Wednesday, December 15th, to explain the Log4j threat, address questions, and offer remediation advice.
We’re alerting our higher education technology community that on December 9, a remote code execution vulnerability, dubbed CVE-2021-44228, was disclosed in Apache’s Log4j.
Apache Log4j is an open-source logging utility used by almost all major Java-based applications and currently running on 3 billion devices worldwide.
Log4j has been exposed to a very high-risk vulnerability under active and vigorous exploitation. The exploitation of this vulnerability is simple and only requires the attacker to enter a piece of code into the target triggering the vulnerability, allowing the attacker to remotely control the user victim’s server.
How Do I Tell If I’m at Risk?
Chances are, you have a system(s) at risk. While advanced features of many popular Next Generation Firewalls (NGFWs) or Web Application Firewalls (WAFs) may offer some protection, you still need to patch quickly. We recommend two immediate steps to figure out your level of exposure.
Continue reading “Ferrilli Security Alert: Log4j Vulnerability Affects All Industries”
By Marcia Daniel, Chief Client Officer, Ferrilli
When I meet with institutional leaders across the higher education landscape, I am continually astounded at just how tech-savvy they have become. Provosts are asking about about degree audit software. Registrars want to discuss how best to deploy chatbots. Vice Presidents of Student Life are exploring the benefits of digital nudges. Just about everyone in higher education is a technology expert these days – except in the area that matters most.
Because when I ask them about what they’re doing to ensure data security, there’s a familiar refrain I hear all too often: “Oh, our CIO handles that.”
Continue reading “Data Security: It Takes a Village”
When the COVID-19 pandemic struck, the San Jose-Evergreen Community College District needed to act fast to ensure that its 20,000 students could continue their studies unabated. Job One was finding a way for its 665 administrators, staff, and full-time faculty perform their essential roles from off-campus locations. That meant creating a remote workforce: providing remote access to the technology, tools, and applications they rely on to help support the student body.
Within a matter of days, SJECCD identified the major challenges it needed to navigate – many of which were impacting institutions across the higher education landscape. VPN solutions hadn’t been fully deployed and had to be scaled up. The use of unmanaged devices and unknown WIFI connections created security concerns. There was the potential that employees could unwittingly utilize malicious browser plug-ins. And there simply wasn’t enough hardware to support shifting the entire workforce to remote locations at the same time.
Continue reading “Creating a Remote Workforce in the Face of COVID-19: The San Jose-Evergreen Community College District”
When COVID-19 struck in the spring of 2020, colleges and universities across the country were presented with three key challenges. They had to shift thousands of students, faculty, and employees to remote learning, instruction, and work. They had to do it quickly or risk losing an entire semester to the pandemic. And they had to do it securely or risk the creation of data vulnerabilities that hackers would likely exploit.
Prior to the coronavirus pandemic, higher education was already one of the most targeted industries in the world when it came to cyberattacks. In 2019, Moody’s (which controls the bond ratings for most institutions in the U.S.) reported that data security was “a growing risk for higher education institutions globally” due to the fact that they “retain valuable information across expansive online networks;” that “their breadth of operations can be vast, with innumerable access points;” and that “investing in state-of-the-art defenses likely competes with myriad other priorities.”
Since the pandemic began, cyber criminals have sought to take advantage of these trends like never before. According to a report released by Checkpoint in the summer of 2020, “the number of attacks on educational institutions has grown faster than in any other sector,” with “a 30 percent increase compared to a 6.5 percent increase across all industries in July and August .” During the same time period, Microsoft Security Intelligence found that more than 60 percent of some 9 million malware encounters worldwide took place in the education sector alone.
It was trends and statistics like these that were on the minds of leaders at the San Jose-Evergreen Community College District when ensuring that its 20,000 students could continue their studies unabated amid the coronavirus pandemic. 665 administrators, staff, and full-time faculty would have to perform their essential roles from off-campus locations – and that meant providing remote access to the technology, tools, and applications they rely on to help support the student body.
Continue reading “How the San Jose-Evergreen Community College District Managed the Cybersecurity Threats that Accompanied the Coronavirus Pandemic”
By Marcia Daniel, Chief Client Officer, Ferrilli
In the spring of 2021, the Colonial Pipeline data breach hit the southeastern United States particularly hard. For the first time in a generation, there were gasoline shortages that caused service stations to close and long lines at the pumps that somehow remained open. For many of us in the region, it was the first time that data security had impacted our lives on a truly fundamental level. It wasn’t just about personal finance anymore; but our ability to get to the grocery store, drive the kids to soccer practice, or visit loved ones we hadn’t seen in ages.
Here in the summer of 2021, higher education finds itself in a similar circumstance. For years, we’ve known that colleges and universities are among hackers’ favorite targets. We’ve read the stories of ransomware attacks that cost some institutions more than a million dollars. We’ve come to understand the brand damage that can accompany a high-profile breach. But as technology proliferates our campuses and data is used in new ways, something even more important is at stake. Higher education data security is fast becoming a question of student success.
Continue reading “The Emerging Link Between Data Security and Student Success”