Matt Thrower, UKOLN, University of Bath will talk about UKOLN's Web site redesign and the problems involved. Come along and discuss how we solved these and other problems and what lessons could be learned for your institution.

Brian Kelly, UKOLN and Lawrie Phipps, JISC will review the barriers which we may face when implementing a Web 2.0 strategy and will outline a model and strategies which can be be used in order to address such barriers.

ETSI standardizes new Secure Platform to address IoT, 5G, and security sensitive sectors

Sophia Antipolis, 18 November 2019

Trust and privacy together with cost and flexibility are key to security solutions for many applications in today’s digital world. To address this challenge, ETSI Technical Committee Smart Card Platform, who standardized the former generations of SIM cards, has been working on a brand-new security platform called Smart Secure Platform (SSP). The ETSI committee is pleased to unveil the first three technical specifications to launch this new security platform.

Read More...

ETSI launches new group on Non-IP Networking addressing 5G new services

Sophia Antipolis, 7 April 2020

ETSI is pleased to announce the creation of a new Industry Specification Group addressing Non-IP Networking (ISG NIN). The kick-off-meeting took place on 25 March and John Grant, BSI, was elected as the ISG Chair, and Kevin Smith, Vodafone, was elected as ISG Vice Chair.

With the increasing challenges placed on modern networks to support new use cases and greater connectivity, Service Providers are looking for candidate technologies that may serve their needs better than the TCP/IP-based networking used in current systems.

ISG NIN intends to develop standards that define technologies to make more efficient use of capacity, have security by design, and provide lower latency for live media.

Read More...

ETSI Multi-Access Edge Computing extends services to WiFi to address enterprise needs

Sophia Antipolis, 16 July 2020

The ETSI Industry Specification Group on Multi-Access Edge Computing, ISG MEC, has recently released ETSI MEC GS 028 to extend network information services to the world of WiFi and thus squarely into enterprises space.

Read More...

ETSI releases Middlebox Security Protocols framework specification

Sophia Antipolis, 17 December 2020

ETSI is pleased to announce a new specification, ETSI TS 103 523-1: Part 1 of the Middlebox Security Protocol (MSP) series, which defines the security properties of a Middlebox Security Protocol.

Read More...

ETSI releases Middlebox Security Protocols specification for fine-grained access control

Sophia Antipolis, 2 March 2021

ETSI is pleased to announce a new specification, ETSI TS 103 523-2: Transport Layer MSP (TLMSP), Part 2 of the Middlebox Security Protocol (MSP) series, which defines a protocol for varied (fine-grained) access control to communications traffic. This specification was developed by the ETSI Technical Committee CYBER.

Read More...

The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.

Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.

While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:

The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resource

The FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.

Tenable offers fastest, broadest coverage of CISA’s KEV catalog

At Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.

Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.

FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measure

The FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.

How Tenable’s library of compliance audits can help with Enhanced Logging

Tenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.

FY 2024 NOFO continues to require applicants to address program objectives in their applications

As with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:

• Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.
• Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
• Objective 3: Implement security protections commensurate with risk.
• Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

How Tenable can help agencies meet Objective 2 of the program

Tenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).

Source: Tenable, October 2024

Tenable One deployment options offer flexibility for SLT agencies

Tenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:

• Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)
• Multi-entity projects
• Decentralized deployments of Tenable One managed by individual municipalities,
• Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.

Whole-of-state approach enables state-wide collaboration and cooperation

A “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.

FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practices

As in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.

How Tenable One can help agencies meet the CISA CPGs

The CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.

Learn more

• $1 Billion State and Local Cybersecurity Grant Program Now Open for Applicants
• Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach
• How to Meet FY 2023 U.S. State and Local Cybersecurity Grant Program Objectives
• New U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGs
• Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog

1. 4Critical
2. 82Important
3. 1Moderate
4. 0Low

Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.

Microsoft patched 87 CVEs in its November 2024 Patch Tuesday release, with four rated critical, 82 rated important and one rated moderate.

This month’s update includes patches for:

• .NET and Visual Studio
• Airlift.microsoft.com
• Azure CycleCloud
• Azure Database for PostgreSQL
• LightGBM
• Microsoft Exchange Server
• Microsoft Graphics Component
• Microsoft Office Excel
• Microsoft Office Word
• Microsoft PC Manager
• Microsoft Virtual Hard Drive
• Microsoft Windows DNS
• Role: Windows Hyper-V
• SQL Server
• TorchGeo
• Visual Studio
• Visual Studio Code
• Windows Active Directory Certificate Services
• Windows CSC Service
• Windows DWM Core Library
• Windows Defender Application Control (WDAC)
• Windows Kerberos
• Windows Kernel
• Windows NT OS Kernel
• Windows NTLM
• Windows Package Library Manager
• Windows Registry
• Windows SMB
• Windows SMBv3 Client/Server
• Windows Secure Kernel Mode
• Windows Task Scheduler
• Windows Telephony Service
• Windows USB Video Driver
• Windows Update Stack
• Windows VMSwitch
• Windows Win32 Kernel Subsystem

Remote code execution (RCE) vulnerabilities accounted for 58.6% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 29.9%.

Tenable Solutions

A list of all the plugins released for Microsoft’s November 2024 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.

Get more information

• Microsoft's November 2024 Security Updates
• Tenable plugins for Microsoft November 2024 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

Toronto ─ On October 21, the Canadian Securities Administrators (CSA), the Canadian Public Accountability Board (CPAB), and the Office of the Superintendent of Financial Institutions (OSFI) co-hosted the sixth annual Canadian Audit Quality Roundtable.

"It's been a year since the horrific events at Freddy Fazbear's Pizza, and Charlie is just trying to move on. Even with the excitement of a new school and a fresh start, she's still haunted by nightmares of a masked murderer and four gruesome animatronic puppets. Charlie thinks her ordeal is over, but when a series of bodies are discovered near her school bearing wounds that are disturbingly familiar she finds herself drawn back into the world of her father's frightening creations. Something twisted is hunting Charlie, and this time if it finds her, it's not letting her go." -- Publisher's description.

"This riveting story set in the future pits the old guard— Superman, Batman, Wonder Woman and their peers, against a new, uncompromising generation of heroes in the final war to determine the fate of the planet." -- Description provided by publisher.

"Bruce Wayne's latest ward, Tim Drake, has all the makings of becoming the greatest Robin yet. He's intelligent, athletic, and levelheaded, and his detective skills rival those of his mentor. However, every Boy Wonder who has come before has endured tragedy, and Tim may be no exception when his parents are marked for death by the sinister Obeah Man. Will the Dark Knight stop the Obeah Man in time, or must Tim face a deadly rite of passage in order to be worthy of inheriting the mantle of Robin?"--Provided by publisher.

Two-time Spur Award nominee Cameron Judd spins Westerns that lasso listeners' attention. In this inspiring story of self-sacrifice, menacing dangers spur 17-year-old Pennington Malone to grow up quickly. With his father in Leavenworth Prison, Penn travels to Dodge City packing his dad's loaded sixgun. He soon meets Jonah Littlejohn, a lanky man gifted with incredible strength and boxing prowess-and haunted by painful secrets. But when Penn learns that three shadowy riders are trailing him-and framing him for murders they commited-he needs all the help he can get.

Keith Attle 700258 : Addie May was in many ways before her time. She was strong willed, not afraid to speak her mind, and could distinguish between right and wrong with good common sense. For her, there was no middle ground. This became evident at a very early age as she was born with two strikes against her. First, one leg was shorter than the other, which caused her to limp all of her life and subjecting her to be ridiculed as a child. Secondly, she was left-handed. Today this is not an issue, but for thousands of years, this attribute was associated with witchcraft and devil possession. Addie May's mother tried everything she could to change her but to no avail. Even a sore and blistered hand and punishment by her first-grade teacher did not dissuade her. Her formal education finished at eighth grade, yet she became a court deputy, a bookkeeper for her husband's hugely successful business, a practical nurse, mother, and grandmother. It was the later when I came to know her. Death was a frequent visitor throughout her life. Somehow she was able to mask her inner emotions while smiling and comforting others facing pain, distress, and death. She was a decent, honorable, and compassionate human being who never thought of herself as anything special. This book is a tribute to a woman who never received the recognition she deserved. It is my desire to correct this. It's unfortunate she will never know.

At the turn of the 20th century, Jewish families scattered by migration could stay in touch only through letters. Jews in the Russian Empire and America wrote business letters, romantic letters, and emotionally intense family letters. But for many Jews who were unaccustomed to communicating their public and private thoughts in writing, correspondence was a challenge. How could they make sure their spelling was correct and they were organizing their thoughts properly? A popular solution was to consult brivnshtelers, Yiddish-language books of model letters. Dear Mendl, Dear Reyzl translates selections from these model-letter books and includes essays and annotations that illuminate their role as guides to a past culture.