Category: News and Events

Security Advisory: Meltdown & Spectre Vulnerabilities

Arby News and Events , , , , , , , , , , ,
Security Advisory: Meltdown & Spectre Vulnerabilities

Over the past few days, you may have heard of the new vulnerabilities that has been uncovered, Meltdown and Spectre.  These vulnerabilities affect all modern processors, meaning your business machines and even personal gadgets that use processors are affected which puts you in risk of potential attacks.  Below is a brief explanation of what exactly Meltdown and Spectre are:

Meltdown

Meltdown is a hardware vulnerability in processors (Intel x86 microprocessors and some ARM based microprocessors) which allows attackers to use programs to access your computer’s memory.  With this access, they are able to gain sensitive data from your other applications within your system.

Spectre

Spectre is a hardware vulnerability in modern processors, which attackers can use to trick error-free programs, which follow best practices, into leaking their secrets.  Safety checks of said best practices actually increase the attack surface and may make applications more susceptible to Spectre.

However, since the vulnerability has been announced it means that so have the solutions.  Below are the steps in which you need to take fix these vulnerabilities:

1. Update your Processor Firmware

Processor manufacturers have already released firmware updates to fix these vulnerabilities, however they said that they would only be releasing updates for processors within the last 5 years.  Below are the current firmware updates you will need per vendor (note that we will be placing more updates as they come):

HPE

For ProLiant Gen10 products (except for the ProLiant DL385 Gen10), update to System ROM Version 1.28.

For the ProLiant DL385 Gen10 server, update to System ROM Version 1.04.

For ProLiant Gen9 series servers, update to System ROM Version 2.54 (except for the ProLiant DL20 Gen9 or ML30 Gen9)

For the ProLiant DL20 Gen9 or ProLiant ML30 Gen9 server, update to System ROM Version 2.52.

For ProLiant Gen8 series servers, update to a System ROM version dated 12/12/2017.

For the ProLiant m710x server cartridge, update to System ROM Version 1.60

For the ProLiant m710p server cartridges update to the System ROM version dated 12/12/2017.

Click here and place your HPE product to find the firmware patch you need.

Cisco

Below is a table of known Cisco products affected by the vulnerabilities, to download the update, you will need to click on the Cisco Bug ID and log in to your Cisco account to access it.  We will be updating this table when updates are available.

Product Cisco Bug ID Fixed Release Availability
Routing and Switching – Enterprise and Service Provider
Cisco ASR 9000 XR 64-bit Series Routers CSCvh32429
Cisco 800 Industrial Integrated Services Routers CSCvh31418
Cisco NCS 1000 Series Routers CSCvh32429
Cisco NCS 5000 Series Routers CSCvh32429
Cisco NCS 5500 Series Routers CSCvh32429
Cisco XRv 9000 Series Routers CSCvh32429
Unified Computing
Cisco UCS B-Series M2 Blade Servers CSCvh31576 Fix pending
Cisco UCS B-Series M3 Blade Servers CSCvg97965 (18-Feb-2018)
Cisco UCS B-Series M4 Blade Servers (except B260 and B460) CSCvg97979 (18-Feb-2018)
Cisco UCS B-Series M5 Blade Servers CSCvh31577 (18-Feb-2018)
Cisco UCS B260 M4 Blade Server CSCvg98015 (18-Feb-2018)
Cisco UCS B460 M4 Blade Server CSCvg98015 (18-Feb-2018)
Cisco UCS C-Series M2 Rack Servers CSCvh31576 Fix pending
Cisco UCS C-Series M3 Rack Servers CSCvg97965 (18-Feb-2018)
Cisco UCS C-Series M4 Rack Servers (except C460) CSCvg97979 (18-Feb-2018)
Cisco UCS C-Series M5 Rack Servers CSCvh31577 (18-Feb-2018)
Cisco UCS C460 M4 Rack Server CSCvg98015 (18-Feb-2018)

Dell

BIOS updates for PowerEdge Server Products

Generation Models BIOS version
14G R740, R740XD, R640 1.2.71
R540, R440, T440 1.2.71
T640 1.2.71
C6420 1.2.71
FC640, M640, M640P 1.2.71
C4140 1.0.2
R940 1.2.81
T30 1.0.12
Generation Models BIOS version
13G R830 1.7.0
T130, R230, T330, R330 2.4.1
R930 2.5.0
R730, R730XD, R630 2.7.0
C4130 2.7.0
M630, M630P, FC630 2.7.0
FC430 2.7.0
M830, M830P, FC830 2.7.0
T630 2.7.0
R530, R430, T430 2.7.0
C6320 2.7.0

BIOS update for Dell Datacenter Scalable Solutions (DSS)

Models BIOS Version
DSS9600, DSS9620, DSS9630 1.2.71
DSS1500, DSS1510, DSS2500 2.7.0
DSS7500 2.7.0

2. Checking if your registry is compatible with your OS updates (Windows)

There are some third party anti-virus software that are currently incompatible with the latest patch updates from Windows.  If you are unable to update your OS due to this reason, it is recommended that you modify your registry to fix this.  However we highly recommend that you also backup your registry before you manually edit it as using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system.  Below is the registry key to be set:

Key=”HKEY_LOCAL_MACHINE”

Subkey=”SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat” Value=”cadca5fe-87d3-4b96-b7fb-a231484277cc”

Type=”REG_DWORD”

Data=”0x00000000”

For Trend Micro users, there has been a patch release for their products in which enables the ALLOW REGKEY (the above code) automatically.  This however is not the fix to the vulnerabilities and you have to update your OS as this patch will not update your OS but allow you to update.

Additionally, note that per Microsoft, even clients that do not have active anti-malware or security software installed may still be required to apply the specific registry key before the security patches can be obtained from Windows Update.

Product Updated version Notes Platform
OfficeScan XG (all versions including SP1) – CP 1825-4430 Readme Windows
11.0 SP1 – CP 6496 Readme Windows
Deep Security Deep Security Agent 10.0.0-2649 for Windows (U6) Readme Windows
Deep Security Agent 9.6.2-8288 for Windows Readme Windows
Worry-Free Business Security 9.5 CP 1447 Readme Windows

3. Updating your OS (Operating System)

Below are the updates that are currently out for Windows OS for both Servers and Desktop (this will be updated as more updates are released):

Product

Article

Download
Windows Server, version 1709 (Server Core Installation) 4056892 Security Update
Windows Server 2016 (Server Core installation) 4056890 Security Update
Windows Server 2016 4056890 Security Update
Windows Server 2012 R2 (Server Core installation) 4056898 Security Only
Windows Server 2012 R2 4056898 Security Only
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 4056894 Monthly Rollup
4056897 Security Only
Windows Server 2008 R2 for x64-based Systems Service Pack 1 4056894 Monthly Rollup
4056897 Security Only
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 4056894 Monthly Rollup
4056897 Security Only
Windows 8.1 for x64-based systems 4056898 Security Only
Windows 8.1 for 32-bit systems 4056898 Security Only
Windows 7 for x64-based Systems Service Pack 1 4056894 Monthly Rollup
4056897 Security Only
Windows 7 for 32-bit Systems Service Pack 1 4056894 Monthly Rollup
4056897 Security Only
Windows 10 Version 1709 for 64-based Systems 4056892 Security Update
Windows 10 Version 1709 for 32-bit Systems 4056892 Security Update
Windows 10 Version 1703 for x64-based Systems 4056891 Security Update
Windows 10 Version 1703 for 32-bit Systems 4056891 Security Update
Windows 10 Version 1607 for x64-based Systems 4056890 Security Update
Windows 10 Version 1607 for 32-bit Systems 4056890 Security Update
Windows 10 Version 1511 for x64-based Systems 4056888 Security Update
Windows 10 Version 1511 for 32-bit Systems 4056888 Security Update
Windows 10 for x64-based Systems 4056893 Security Update
Windows 10 for 32-bit Systems 4056893 Security Update
Microsoft SQL Server 2017 for x64-based Systems (CU) 4058562 Security Update
Microsoft SQL Server 2017 for x64-based Systems 4057122 Security Update
Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (CU) 4058561 Security Update
Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 4057118 Security Update

4. Updating your browsers

The last step would be to make sure that your internet browser is patched to the latest version.  Below are a few of the most used browsers and the versions they need to be updated to:

Mozilla – Firefox 57.0.4

Internet Explorer/Microsoft Edge – Included in the latest security update of Windows KB4056890 (OS Build 14393.2007)

Again more updates will be posted as soon as the fixes are released by the respective vendors.  If you need more details or help in implementing the said solutions from vendors, please do contact us at 893-9515 and we will do our utmost to help!

 

Manage your Data and Analyze your Data Effortlessly and Efficiently with Pure Storage and Oracle®

Arby News and Events , , , , , , , , , ,
Manage your Data and Analyze your Data Effortlessly and Efficiently with Pure Storage and Oracle®

In today’s business, storing data properly has become business critical.  Analyzing the right data against other data types (internal or by global standards) can be key in improving your business and putting it in the right direction.  This process is known as Digital Transformation.  To begin the transformation, companies must be able to store, access and analyze their data efficiently and as fast as possible so that they can gain insights before their competition does.  Just asked yourself, are you analyzing your business data like customer support emails or their chat logs?  If not it would be best if you started now before your competitors do.  Below is a simple guide to mapping your data with data management application Oracle®:

  1. Data value starts with operational data (transactions), structured data stored in Oracle® Database.
  2. Data becomes more valuable with the addition of data warehousing and business intelligence to provide descriptive analysis of your business based on historical data.
  3. Data value is greatest when you combine all of your data assets — structured and unstructured — to gather predictive and prescriptive analytics from different sources, such as the Internet of Things (IoT) and other application data to fully participate in the era of digital transformation.

Below are ways in which Pure Storage can help your infrastructure make Oracle® effortless and efficient when analyzing your data:

Simplicity

  • All-flash solutions take half as long to deploy as other storage solutions and with Pure Storage’s solution, you can be sure of its simplicity and validity as they have been fully tested and validated.
  • Fast and efficient Pure Storage snapshots let you automate the copy, clone, and refresh processes of an Oracle® database and reduce the time to copy and clone up to 90%.
  • Pure Storage solutions let you run Oracle® databases for development, test, quality assurance (QA), and production for online transaction processing (OLTP) and online analytical processing (OLAP) workloads on the same Pure Storage platform.

 

Data Reduction

  • Pure Storage solutions include both in-line lossless deduplication and compression for ultimate data reduction, which can help data reduction of 3 – 5 times the conventional Oracle® data types — such as number, date, char, and varchar.
  • By running your Oracle® solutions on Pure Storage, you not only compress data to lower its footprint and reduce storage needs, you also do away with the need for Oracle® compression.

Performance

  • Pure Storage all-flash solutions improve performance by orders of magnitude, with sub-millisecond latency, no disruptions, and no effect on performance for upgrades or maintenance.
  • Pure Storage uses flash instead of disks, which eliminates the performance delays caused by the inherent latency of disk storage, which means you can run Oracle® OLTP and OLAP solutions in parallel on the same Pure Storage all-flash storage platform.

Click here to learn more about Pure Storage on Oracle®, to learn more about Pure Storage visit our product page or contact us at 893-9515!

New updates for XenApp and XenDesktop for November 2017

Arby News and Events , , , , , ,
New updates for XenApp and XenDesktop for November 2017

November was a great month for Citrix users as updates for XenApp and XenDesktop, which you can download now with the release of patch v.7.16. Updates (as well as compliance information) for the ever popular XenApp and XenDesktop 7.15 LTSR was also added just this November.  Below is a summary of some of the new updates:

User Experience

Significant user experience enhancements for both XenApp and Xendesktop Service and on-premises deployments in v.7.16, which was first introduced on our cloud services:

Real time user experience optimizations with Adaptive Transport

Only Citrix can dynamically adjust its HDX Adaptive Transport technology in mid-session to adapt to changing network conditions in real time to deliver the best possible high-definition user experience.

Introducing full browser content redirection, not just HTML5 video redirection

 Extending the capabilities of our content redirection technology, XenApp and XenDesktop now enable the full contents of a web browser, not just the HTML5 video, to be rendered on the client for maximum server scalability and optimal user experience.

Enhanced multi-monitor graphics quality with Citrix Receiver for Windows

Many users leverage multiple monitors across their virtual app and desktop sessions to optimize productivity. Now Citrix Receiver for Windows 4.10 makes multi-monitor configuration easier than ever.

Extending the power of Windows 10 S with Citrix Receiver

Windows 10 S is a streamlined OS for security and superior performance that only runs applications delivered from Microsoft Store. This means many existing Win32 apps will not run locally on Windows 10 S. The most secure way to get access to these business-critical Win 32 apps is through Citrix XenApp.

Improved graphics experience with H.265 and integrated 3D Pro VDA installer

With ever-increasing improvements to video resolution, Citrix is extending its codec capabilities by incorporating H.265 codec into XenApp and XenDesktop Platinum edition. By leveraging new H.265 hardware with XenApp and XenDesktop with NVIDIA GPUs, you will notice improved graphics performance while reducing bandwidth consumption by up to 50%.

Expanding our industry-first Windows Continuum virtual desktop experience

 XenDesktop, with XenServer, was the first and only desktop virtualization solution to deliver Windows Continuum experience with Windows 10 virtual desktops. Now, XenDesktop is expanding its industry-leading Windows Continuum virtual desktop technology by enabling a Windows 10 virtual desktop to recognize when the user switches from a physical tablet to a physical desktop and automatically toggle the virtual desktop between tablet and desktop mode.

To read more about the November updates, please visit the original article here!  You may also learn more about Citrix on our product page or directly contact us at 893-9515.

VeloCloud Kept Users Connected during the Level 3 Outage!

Arby News and Events , , , , , ,
VeloCloud Kept Users Connected during the Level 3 Outage!

Internet connectivity is now easily one of the most critical components in a business now.  Without it, many aspects of companies would not function and result in many lost opportunities and big loss to profit.  One such example would be what happened on November 6, in which Level 3 an ISP backbone used by many internet providers in the US went offline for 90 minutes.  This was a disaster to many as they panicked due to the huge impact it had to their business and livelihood.  However, this was not the case for SD-WAN users. In fact, many VeloCloud users were not even aware of an internet blackout until the next day.  This is thanks to VeloCloud’s Dynamic Multipath Optimization.

With Dynamic Multipath Optimization (DMPO), all transport links are monitored on a continuous basis and when issues arise, traffic is steered proactively, dynamically and automatically on a sub-second basis to an alternative transport path(s).  This dynamic steering was what prevented VeloCloud users from experiencing the 90-minute blackout other Level 3 subscribers felt.  VeloCloud’s sub-second steering allows independent decisions in both uplink and downlink directions without introducing any asymmetric routing to avoid impacts from brownout or blackout conditions.

Below are some examples of the impact of the Level 3 outage on VeloCloud Cloud-Delivered SD-WAN:

First example is of a customer with dual Comcast links and a single Verizon LTE link in active mode.  From the Quality of Experience screenshot, you can clearly see the packet loss and jitter indicated by the yellow and red bands.  The long stretch of red from the Comcast links was the portion of the day when Level 3’s outage happens, the red band of course meaning there was almost no passable way for traffic to go through that link.  From the overall VeloCloud enhancement, you can see that the customer experienced almost no downtime of their connections even though the Comcast links were in the red for so long.

The second example will be a VeloCloud user who uses a broadband cable internet link and a DSL link.  The Comcast cable link again is using Level 3 as its ISP backbone.  From here, we can see an even better result as the customer had no downtime whatsoever as there was no red band after the VeloCloud enhancement even when the Comcast link had almost no connectivity it was still able to get a quality score of ever 9.94.

To learn more about how VeloCloud can help your business, please visit our product page on VeloCloud or contact us directly at 893-9515!

Cryptocurrency Malware CoinHive becomes the 6th most common Malware

Arby News and Events , , , , , ,
Cryptocurrency Malware CoinHive becomes the 6th most common Malware

CoinHive, the cryptocurrency miner that made the news in September when it was discovered that the EITest campaign was using it to trick victims into paying for their services or handing out financial data via tech support scams.  However, a new report from coindesk.com reveals that the malware is becoming more widespread as it reaches 6th place on the list of most common malware in the world.

CoinHive works by providing website owners and operators a Javascript code that they can embed into their site. What this code does is that it covertly uses the website visitor’s processing power to mine the Monero cryptocurrency. This give both sides mutual benefits, as CoinHive keeps a portion of the mined amount, while the website owner keeps the rest. Unfortunately for website visitors, they won’t know that their processor is being used without their knowledge. While Coinhive itself is a legitimate company, its rather dubious method of operation often lends itself to abuse by malicious threat actors.

While Cryptomining malware is still not as well known as other malware like ransomware, the report from Coindesk is alarming as it shows that this threat is growing fast.   Stealthy and non-intrusive are attributes of cryptocurrency mining that might be helping in its rapid growth.  Decreased performance and latency caused by the cryptocurrency malware are annoying but can be hard to pinpoint to them as the cause.  Also, with multiple infected systems, the miner essentially gains more and more personal miners for himself without the computer owners knowledge.

Defending against CoinHive

Users who want to prevent CoinHive from using their resources may do the following:

  • Block Javascript-based applications from running on their browsers
  • Implementation of best practices to avoid engineered schemes such as the EITest campaign
  • Regularly update and patch your software (especially on your browsers)

Users should also look into effective security solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security, which protect end users and businesses from threats by detecting and blocking malicious files and all related URLs. Trend Micro™ Smart Protection Suites deliver several capabilities like high fidelity machine learning, web reputation services, behavior monitoring and application control that minimize the impact of this cryptocurrency miners and other threats.

Learn more about Trend from our Product page or contact us at 893-9515!

CT Link Systems, Inc. Adopts Microsoft Teams!

Arby News and Events , , , , , , , ,
CT Link Systems, Inc. Adopts Microsoft Teams!

Office collaboration is becoming key to success in businesses right now.  Business mobility and workforce communication have become so important that it can lead to you losing a big sale to your competitors.  CT Link Systems, Inc. in an effort to improve their collaboration has decided to adopt Microsoft Teams.  Below are a few functions of Microsoft Teams that we are enjoying and helping us collaborate easier:

Chat

Chatting using Microsoft Teams is an improved experience if you are coming from other Microsoft Instant messengers like Skype for business.  One big difference is that unlike Skype you have an archive for your chat history.  You don’t have to worry that your chat between you and your superiors will disappear, you can always go back and check what was noted and even favorite a message for faster identification.  Files are not immediately deleted as well once your chat is finished, it saves itself on your OneDrive and you will have a tab where all your files from that particular contact will be saved to make it easier for you to find your files!  One feature missing from Teams so far is the capability to do video calls, however Microsoft has stated that they are working on it!

Teams

This is the main feature of Microsoft teams in which you can create a group, which serves as something similar to group chat but with more functions.  Within each group, there are different tabs which have different functions, the default would be the wiki and files.  The wiki tab would be the page where you can place your glossary for the group so that everyone has a reference area during conversations.  The files tab is where you can view all the files shared in the group and even real time edit the file such as word and excel.  You may also place more tabs per group if needed, any app available in Office 365 can be placed on it such as planner (a favorite in our office) to help remember deadlines and keep yourself on track.

These are just examples of ways teams helped our organization, however teams is still constantly being improved for better user experience so keep a watch out for it!  If you’d like to learn more, please visit our Microsoft page or contact us at 893-9515!

Simplify and Collaborate your Work with ShareFile!

Arby News and Events , , , , ,
Simplify and Collaborate your Work with ShareFile!

2017 was a transformative year for Citrix ShareFile. ShareFile helped companies (and continuous to) with their cloud journey by creating efficiency in their work by allowing users to collaborate in the digital workspace from anywhere.  Even after helping many companies with their collaboration, they continued to improve ShareFile; they added additional features earlier this year such as Information Rights Management to create a better tool for their customers.  However, they aren’t finished with their improvements as they have just released the following additional features to ShareFile:

Data Migration Service

A service that offers to help customers migrate their data from legacy file servers and other data sources in to ShareFile.  This service provides a frictionless experience for customers who want to set up with ShareFile while getting all their data in one environment as simply as possible.

Custom Workflows

ShareFile Custom Workflows streamline and automate the repeated, time-consuming, manual document-centric processes that customers face each day. This solution enables customers to combine mobile forms, triggers, and actions into a tailored, automated workflow that benefits both IT administrators and everyday users, including the mobile workforce. The latest updates bring this functionality to mobile devices and Custom Workflows now supports on-premises zones.

Microsoft Integrations

ShareFile is the perfect complement to Microsoft Office.  ShareFile for Outlook — a new Microsoft Outlook add-on — brings ShareFile functionality to Outlook for Mac and Outlook Online (Office 365, Outlook Web Access, and Outlook.com) users. Customers using on-premises StorageZones can now take advantage of native Office mobile app integrations and offer collaborative web editing, thanks to our integration with Microsoft Office Online Server (OOS).

ShareFile also enhances Office365 investments by providing electronic signatures, co-editing, supporting hosted desktop solutions, supporting external collaboration, direct integration with OneDrive for Business and other data sources, so users can access all their data from one environment. Collaboration can happen in one environment and data is available anywhere, on any device, at any time with direct integration with Microsoft Teams.

To learn more about ShareFile and other Citrix products, visit our product page or you can contact us at 893-9515 for more details.

Your Data at Large: Some of the Common Security Pitfalls

Arby News and Events , , , , , ,
Your Data at Large: Some of the Common Security Pitfalls

With data mobility’s rise, you would expect that security of data would increase as well.  However, many of the controls to mitigate the risk of data exposure still rely on traditional protection.  Direct attacks, simple mistake, and even negligence are still major reasons as why data is lost.  Below are some of the most common examples of common security pitfalls:

  • Loss or destruction of endpoints
  • Using consumer-grade collaboration and file sharing tools
  • Transferring files over insecure media including USB drives
  • Emailing sensitive information to personal email accounts
  • Social engineering (i.e. phishing) – the human factor and malware

These days, we use new IT services built on multiple cloud infrastructures to work in conjunction with the legacy and custom applications (business critical apps) built on-prem, this results in business data sprawled across multiple devices and locations.  This makes the traditional enterprise perimeter almost completely eroded.  The industry’s response has been to solve each gap in security with slew of security products, which each have their own unique policies, capabilities and limitations.  This creates even more complexity in the already complex problem which can do ultimately do more damage than help.

In the global study from Citrix and The Ponemon Institute, they  discovered that:

  • 64 percent of respondents say their organization has no way to effectively reduce the inherent risk of unmanaged data (e.g. downloaded onto USB drives, shared with third parties, or files * with no expiration date)
  • 79 percent of respondents are worried about security breaches involving high-value information
  • 52 percent of respondents do not feel that their security infrastructure facilitates compliance and regulatory enforcement with a centralized approach to controlling, monitoring and reporting of data

That requires a purpose-built architecture, one that is designed and hardened for security from the ground up. Integral to this architecture is the inherent security Citrix provides by:

The solution to the problem?  Control must be given back to IT while delivering security to the business without affecting the users experience.  This type of architecture is inherent in the security Citrix provides by:

  • Centralizing and keeping data off endpoints
  • Containerizing and encrypting data on mobile devices
  • Controlling access to data contextually
  • Using file level access and control (DLP and IRM) for data in motion
  • Partnering with industry leaders to protect data

At the end of the day, people need and want to work efficiently, if we make data sharing onerous it would create more problems rather than help solve them.

To learn more about Citrix products, please visit our product page or call us directly at 893-9515.

KRACK Vulnerabilities creates huge Security risks for WiFi

Arby News and Events , , , , , , ,
KRACK Vulnerabilities creates huge Security risks for WiFi

On October 16th, 2017, ten new security vulnerabilities, referred to as Key Reinstallation Attack (KRACK), were announced that target the session establishment and management process in WPA(1/2)-PSK and WPA(1/2)-Enterprise.  This marks the first security vulnerability of WPA2 since its introduction.  The vulnerabilities are related to different key handshakes, used between the Wi-Fi supplicant (client) and the AP (authenticator) to derive and install encryption keys. Using these vulnerabilities an attacker can force a client or access point (AP) to reinstall the keys used to encrypt wireless data. This gives attackers the option to replay, decrypt, or forge frames from your WiFi network, meaning they can see your traffic or steal your data from devices connected to compromised WiFi.

How to keep your devices safe

Most vendors have already released patches/firmware for their devices in which you can fix these vulnerabilities.  Below are the firmware versions that are protected from the vulnerabilities and steps into upgrading to them if you have not already:

Meraki

MR33s, 30Hs, 74s networks must be upgraded to firmware MR 25.7, all other networks should be upgraded to version 24.11.

To upgrade your firmware, please use the “Firmware Upgrade Tool” on your dashboard.  To be sure that you have the right firmware, you may look for the “802.11r Vulnerability Impact” page on your dashboard.

Aruba

The following ArubaOS are protected from the KRACK vulnerabilities 6.3.1.25, 6.4.4.16, 6.5.1.9, 6.5.3.3, 6.5.4.2, 8.1.0.4.  For InstantOS, please make sure that your firmware is upgraded to 4.2.4.9, 4.3.1.6, 6.5.3.3, 6.5.4.2.

Please note that this takes care of one half (infrastructure), you must also make sure that your other half (clients) are also updated to their latest firmware to keep your whole network secure from these attacks.  Please see below for some of the vendor status for their firmware updates:

Desktops

Microsoft, Ubuntu and Linux have all released firmware updates to protect your clients from the vulnerability.  Although Microsoft has only stated that the current iterations of their products have updates such as Windows 7, 8 and 10.  As of now, macOS has no known fix but will be soon rolling out their fix soon.

Mobile

As of now, Android has already released a statement saying that a patch will be released on November 6, 2017 that will solve these issues.  So be ready to update your firmware for it by then.  Just like macOS, the iOS have no known fix as well, but the upside to this is that there will be a guaranteed update to your apple device so you will be updated the moment the patch is ready.

Again, to ensure you are protected from the KRACK vulnerability, you need to have both infrastructure and client sides protected protected from the vulnerability not one or the other.  We will update this article with the latest updates when they come out so please do check back every so often!

If you have any more inquiries on this, please do contact us at 893-9515 and we will do our best to answer them!

Image Designed by Freepik

Office 2007 Support has officially ended

Arby News and Events , , , ,
Office 2007 Support has officially ended

Office 2007’s support officially ended last October 10, 2017.  This doesn’t mean that you will lose all your Office 2007 apps, nor will you lose any of your data associated with Office 2007.  Then what exactly does this mean then?  One big issue from discontinued support would be security; with no support, you could be exposing yourself to huge security risks.  Below are what you will be losing with the end of support:

  • You’ll no longer receive Office 2007 software updates from Microsoft Update.
  • You’ll no longer receive security updates. Security updates are what help protect your PC from harmful viruses, spyware, and other malicious software.
  • You’ll no longer receive phone or chat technical support.
  • No further updates to support content will be provided. In fact, most online help content will be retired.
  • You’ll no longer be able to download Office 2007 from the Microsoft web site.

Even though Office 2007 is still usable, you may want to consider upgrading to a newer version in lieu with the above benefits that you will be losing.  Below are the upgrades you can consider:

  1. Upgrading to Office 365 – the subscription version of Office that comes with Word, Excel, PowerPoint, and other apps, depending on the plan you choose. With Office 365, the apps are available on your computer for up to 5 users and via browser; one subscription enables you to use them on both your PC and Mac.
  2. Upgrading to Office 2016 – Office 2016 is a one-time purchase (not a subscription) for installation on one computer only.