robopet3

Если кто-то забыл, то:
SMB1 - отключен давно
SMB2 -
This article describes information about Windows disabling guest access in SMB2 by default, and provides settings to enable insecure guest logons in Group Policy. However, this is generally not recommended.
https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/guest-access-in-smb2-is-disabled-by-default

TLS1.0 and TLS 1.1 S
Since November 1st Microsoft has changed the TLS to 1.2 for all environments. Exchange 2019 has even no opportunity to change back to the old standard. That means Exchange 2019 supports TLS 1.2 only.
https://www.msb365.blog/?p=2599#:~:text=TLS%20support,2019%20supports%20TLS%201.2%20only.
https://tkolber.medium.com/exchange-2019-free-busy-issue-with-exchange-2013-2016-ca902ca543a8

Final Notice for disabling of TLS1.0 and TLS 1.1 Support for Exchange Online Mail Flow
MC229914 · Published Dec 14, 2020 Message Summary
https://fromreallife.wordpress.com/2021/01/12/про-коварный-microsoft/

LDAP Channel Binding and LDAP Signing Requirements 2020
https://fromreallife.wordpress.com/2019/12/27/ldap-channel-binding-and-ldap-signing-requirements-2020/

Using OCSP, LDAP & HTTP for Certificate Checking
https://www.isode.com/whitepapers/ocsp-ldap-http-certificate-checking.html

Защита привилегированных аккаунтов домена:
Вот цикл статей неплохой, о том, что нужно защищать. Понятно, что сейчас virtual base security и пр, нового много. Но для понимания полезно, чтобы debug привилегиями не ограничиваться: https://www.securitylab.ru/analytics/431689.php
https://www.securitylab.ru/analytics/437458.php
https://www.securitylab.ru/analytics/437459.php
https://www.securitylab.ru/analytics/437270.php

Summary:
Potential security vulnerabilities in Intel® Converged Security and Manageability Engine (CSME), Intel® Server Platform Services (SPS), Intel® Trusted Execution Engine (TXE), Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM) and Intel® Dynamic Application Loader (DAL) may allow escalation of privilege, denial of service or information disclosure. Intel is releasing firmware and software updates to mitigate these potential vulnerabilities.
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html

Feature description
A standalone Managed Service Account (sMSA) is a managed domain account that provides automatic password management, simplified service principal name (SPN) management and the ability to delegate the management to other administrators. This type of managed service account (MSA) was introduced in Windows Server 2008 R2 and Windows 7.

The group Managed Service Account (gMSA) provides the same functionality within the domain but also extends that functionality over multiple servers. When connecting to a service hosted on a server farm, such as Network Load Balanced solution, the authentication protocols supporting mutual authentication require that all instances of the services use the same principal. When a gMSA is used as service principals, the Windows operating system manages the password for the account instead of relying on the administrator to manage the password.

https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview

Уязвимость CVE-2020-1048 , названная исследователями PrintDemon, присутствует в отвечающем за печать компоненте Windows Print Spooler. Диспетчер отправляет данные для печати на USB/параллельный порт физического принтера, TCP-порт принтера в локальной сети или в интернете или локальному файлу (в случае, если пользователь хочет отложить печать).

Патч для проблемы был выпущен в рамках «вторника исправлений» Microsoft 13 мая 2020 года.
https://www.securitylab.ru/news/508332.php

CVE-2020-0796: New vulnerability in SMB protocol
Microsoft has released a patch for newly discovered critical vulnerability CVE-2020-0796 in the network protocol SMB 3.1.1.
https://www.kaspersky.com/blog/smb-311-vulnerability/33991/

Microsoft SMBv3.11 Vulnerability and Patch CVE-2020–0796 Explained
Update 03/12/2020:
Microsoft releases out of band patch: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796

Summary
SMBv3.11 has a buffer overflow vulnerability when compression is enabled (default value). Windows 10 and Server use SMBv3.11 and the service runs as SYSTEM. Successful exploitation will result in remote code exection, with SYSTEM privileges. This is considered “wormable”. Microsoft did not release a patch in March 2020 Patch Tuesday.

Надеюсь, никому не надо напоминать о EternalBlue и WannaCry

Приглашаем вас на конференцию компании «Информзащита», где мы расскажем об управлении информационной безопасностью в публичных облаках и нашем подходе к организации SOC:

http://bit.ly/2VDaaey

Description of the security update for Microsoft Exchange Server 2019 and 2016: February 11, 2020
This update rollup is a security update that resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE):

CVE-2020-0692 | Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2020-0688 | Microsoft Exchange Memory Corruption Vulnerability

A customer requires that their data is fully protected from theft, both at the volume layer and at the disk layer. Which two features of ONTAP satisfy this requirement? (Choose two.)
-
A volume encrypted with an aggregate-level key is called an NAE volume (for NetApp Aggregate Encryption)
NetApp Volume Encryption (NVE) is a software-based technology for encrypting data at rest one volume at a time.