Business Continuity – Page 5 – RISC Management and Consulting

Microsoft has released out-of-band updates to address a critical use-after-free vulnerability in Internet Explorer versions 6 through 11, including IE versions running on Windows XP.

According to the United States Computer Emergency Readiness Team, their organization’s goal is toward a safer, “stronger Internet for all Americans by responding to major incidents, analyzing threats, and exchanging critical cybersecurity information with trusted partners around the world” (US-CERT, 2014). US-CERT is part of the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC). US-CERT coordinates the sharing of cyber information and proactively address the nation’s cyber risks while protecting the constitutional rights of Americans.

Please read the following updates and the following links.

Security Update for Internet Explorer (2965111) Published: May 1, 2014

“This security update resolves a publicly disclosed vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using an affected version of Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers. For more information, see the subsection,

Affected and Non-Affected Software, in this section.

The security update addresses the vulnerability by modifying the way that Internet Explorer handles objects in memory. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry later in this bulletin.

This security update addresses the vulnerability first described in Microsoft Security Advisory 2963983.

Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871. For Customers who do not have automatic updating enabled, the steps in Turn automatic updating on or off can be used to enable automatic updating.
For administrators and enterprise installations, or end users who want to install this security update manually (including customers who have not enabled automatic updating), Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service. The updates are also available via the download links in the Affected Software table later in this bulletin”.

Affected and Non Affected Software Link to the table: https://technet.microsoft.com/library/security/ms14-021#ID0E1OAE

RISC Management and Consulting, LLC www.RISCsecurity.com

References

United States Computer Emergency Readiness Team. (2014). Microsoft releases security update for internet exploere use-after-free vulnerability. Retrieved from ttps://www.us-cert.gov/ncas/current-activity/2014/05/01/Microsoft-Releases-Security-Update-Internet-Explorer-Use-After-Free

Microsoft. (2014). Microsoft security bulletin MS14-021: Security update for Internet Explorer. Retrieved from https://technet.microsoft.com/library/security/ms14-021

Chris Heuman, the Practice Leader for RISC Management and Consulting will be presenting at the Genesis Health Alliance (GHA) Vendor Fair at Evansville, IN.

When: April 10^th, 2014

Chris will join key partners to present to members of GHA on the topic of HIPAA’s Contingency Plan Standard – What’s required, what steps should be completed, how to develop documentation, how and what to test

What to Test

Chris Heuman and RISC Management will cover the HIPAA Contingency Plan areas of:

Data Backup Plan
Disaster Recovery Plan
Testing and Revision Procedures
Emergency Mode Operation Plan
Data and Applications Criticality Analysis

Join Chris Heuman and RISC to learn real world scenarios and steps for success in meeting this extremely difficult Standard in the HIPAA Security Rule. RISC will introduce leading edge solutions that facilitate a Covered Entity or Business Associate’s compliance with these difficult-to-manage requirements.

To bring this presentation to your site or via WebEx ,Contact RISC to receive more information in identifying, documenting, addressing, and eliminating risk to all of your sensitive information.

In support of knowing what data and which systems are most critical to an organization, and which systems and applications are in-scope for HIPAA, RISC recommends Data Loss Prevention (DLP) solutions.

RISC DLP Solutions

The first step in any information security and compliance program is understanding what data your organization has, where it is located, and who is using it; authorized or unauthorized. RISC Management’s DLP solution can assist you in finding the sensitive information that is created, collected, stored, processed, transmitted, disclosed, or archived by your organization. Complete and accurate knowledge is necessary in order to understand what laws or requirements apply to your organization, and which members of your workforce may require training or monitoring.

RISC Management delivers data loss prevention (DLP) solutions that protect regulated, sensitive, or confidential employee, customer, or company information and safeguard intellectual property across all electronic communications channels.

RISC Management can help you watch the sensitive information flowing into, throughout, and out of your network without impacting performance or requiring infrastructure modifications.

Genesis Health Alliance (GHA) is an organization that brings together 20 hospitals from the Southeast Illinois, Southwest Indiana, and Western Kentucky with the mission of improving the health status of the community they serve. Their other objective is to provide a group purchasing initiative to assist the hospital members in improving services and reducing operational costs. GHA is governed by a Board of Directors that meets quarterly.

To bring this presentation to your site or via WebEx, Contact RISC to receive more information in identifying, documenting, addressing, and eliminating risk to all of your sensitive information.

Rose Rienton

Rose.Rienton@RISCsecurity.com