June 2021 News & Updates

Executive Summary

So far, June 2021 is a bit of a reprieve from the massive oil pipeline breach that we were looking at this time just a month ago. That said, there are a couple of things to keep your eyes on.

• Threat actors, including nation states, are targeting vaccine and virology organizations as well as pharmaceutical companies. If you’re in these verticals or do business with these verticals (supply chain, customers, etc.), be on the lookout for targeted attacks.
• Multiple significant bugs patched
  • Microsoft patched six zero-day vulnerabilities, including a Remote Code Execution (RCE) vulnerability and a privilege escalation vulnerability that are being actively exploited in the wild.
• Threat actors are evolving – According to this article, the bad guys seem to be doing a better job of applying lessons learned to evolve. Not only are ransomware attacks on the rise but the attackers are changing tactics (for example, rather than just locking data, threatening to expose it) in an attempt to sure that victims pay up.
• Enhanced Patch Management – Our Enhanced Patch Management continues to be a huge success for our MyIT Clients. If you don’t have a way to curate, install and track vendor updates that are vital to maintaining the stability and security of your systems, we’d love a chance to talk to you about how our MyIT program can do that (and much more). We have made a small adjustment to the reboot requirement for updates to display the reboot notification for a full hour before automatically rebooting. Additionally, for non-critical updates, the user has the option to delay the reboot for up to eight hours.

Updates

Microsoft released updates to address 50 vulnerabilities this month including 5 that are considered critical, meaning that an attacker could exploit the vulnerability remotely with no user interaction required and 2 have been previously disclosed. According to Microsoft, six of the vulnerabilities are being actively exploited in the wild.

Microsoft also released the 21H1 Windows 10 Feature Update on 18 May 2021. Additional information on this latest feature update is available here and here.

Microsoft releases regular updates the second Tuesday of each month, often referred to as ‘Patch Tuesday’. These updates are categorized as Low, Moderate, Important or Critical. Details on the categories are available here. The updates can include any supported Microsoft product from Windows to Office to Internet Explorer and server products like Exchange and SQL Server. If you have one or more of these products installed, especially if the update is listed as Important or Critcial, it’s important that the updates are installed.

Additional details on this months Microsoft updates are available from Microsoft, Brian Krebs, SANS and ZDNet.

Adobe released 10 updates this month (so far) including critical updates to Adobe Acrobat and Reader, Photoshop and Creative Cloud, RoboHelp, Premier and After Effects.

Like Microsoft, Adobe now releases updates to their products on the second Tuesday of each month. Adobe will also release ‘out of band’ updates if necessary to address critical vulnerabilities in their products. Adobe products include Adobe Reader (for viewing PDF files), Adobe Flash Player (often used to watch videos, for interactive content like games, etc.), Adobe Shockwave and the Adobe Creative Suite (Photoshop, Illustrator, Acrobat, Lightroom, etc.).

Additional details are available from Adobe Here including links to download the update(s) and instructions for installation.

Need IT Support? We’d love to help!