Security News
Attackers can abuse a wide range of Window legitimate tools, including but not limited to Microsoft Defender, Windows Update, and even the Windows Finger command. While being legitimately used by thousands of admins each day for managing their organizations' Azure fleets, their capabilities can also be used for malicious purposes, including circumventing network defense lines.
Microsoft has revealed that its Azure IaaS platform now offers free a virtual trusted platform module. Dubbed "Azure Trusted Launch for virtual machines" and launched as a preview on March 8th, Microsoft's CTO for Azure Mark Russinovich said the new offering "Allows administrators to deploy virtual machines with verified and signed bootloaders, OS kernels, and a boot policy that leverages the Trusted Launch Virtual Trusted Platform Module to measure and attest to whether the boot was compromised."
Strata announced at Microsoft Ignite that its Maverics Identity Orchestrator platform for Microsoft Azure Active Directory enables organizations to migrate applications to the Cloud without rewriting them so identity can be centrally managed by Azure AD. In addition, Strata allows companies to modernize on-premises apps by extending Azure AD authentication and access control capabilities to them with no code changes. Strata makes it possible to transition applications to Azure AD with no user experience changes and no burden on application teams, so organizations can manage and enforce consistent access across hybrid cloud environments.
IOTech announced the launch and availability of Edge XRT, its time-critical edge platform for Microsoft Azure Sphere. Designed and optimized for resource-constrained environments, Edge XRT delivers out-of-the-box device connectivity and edge intelligence for microcontroller units, gateways and smart sensors at the IoT edge.
Microsoft has said it will add end-to-end encryption for some one-to-one Teams calls later this year - and urged folks to move away from using passwords with Azure AD. The Teams improvements, announced at the tech giant's Ignite conference this week, will be available "To commercial customers in preview in the first half of this year." Video conferencing rival Zoom offers end-to-end encryption with a few caveats and additional steps, and that appears to be more or less the approach Microsoft will take, too.
Lunavi announces the launch of its new Azure Adoption Program aligned with the Microsoft Cloud Adoption Framework. The program helps enterprise customers rapidly transition from their current on-premise infrastructure to a secure Azure cloud environment that takes advantage of best practices in security, governance, and optimization.
ZEDEDA announced an integration with Microsoft Azure IoT services that provides customers with full lifecycle management capabilities, single-click bulk provisioning, risk-free updates and a built-in app marketplace. "With scale and security, they can instantly deploy all Azure IoT Edge services on large fleets of nodes with a single click and manage the full lifecycle of both the software and hardware."
AWS and Azure users will achieve significant performance improvements and cost reductions with the launch of the new CloudOps Active Management Solution from igroup. Installed on any new or existing Azure or AWS infrastructure, allows companies using it to concentrate on delivering higher quality applications and services in the cloud rather than spending time supporting and managing their cloud.
Threat actors downloaded some Microsoft Exchange and Azure code repositories during the sprawling SolarWinds supply-chain attack but did not use the company's internal systems or products to attack other victims. "We have now completed our internal investigation into the activity of the actor which confirms that we found no evidence of access to production services or customer data," the company said in a blog post on its Microsoft Security Response Center published Thursday.
Microsoft has completed its internal investigation about the Solorigate security incident, and has discovered that the attackers were very interested in the code of various Microsoft solutions. The attackers viewed some files here and there, but they also managed to download source code from a "Small number of repositories," and this includes the code for some important Microsoft Azure components.