Tenable chief says no way to verify Microsoft claims about fixing Azure flaw

Friday, 04 August 2023 06:03

Tenable chief says no way to verify Microsoft claims about fixing Azure flaw Featured

By Sam Varghese

Image by Steve Buissinne from Pixabay

Microsoft claims it has completely fixed a critical security issue in its Azure cloud platform, found in March by researchers from security firm Tenable, who then told Microsoft about it. Tenable chief executive and chairman Amit Yoran had claimed in a blog post on Wednesday that it took more than 90 days for Microsoft to effect a partial fix.

As part of its response to a query from iTWire, regarding Yoran's claim, a Microsoft spokesperson said: "Our initial fix in June mitigated the issue for the majority of customers. This issue has now been fully addressed for all customers and no customer action is required."

This portion of the response was initially provided on the basis that it was not attributable "but can be used to help inform your story". When iTWire pointed out that this could not be done, permission to attribute it was given.

Microsoft has been under fire ever since a breach of the Azure platform came to light on 13 July, with criticism coming from Democrat Senator Ron Wyden of Oregon, apart from tech experts.

Azure was breached by attackers who gained access through a vulnerability discovered in June by the State Department, according to anonymous officials quoted in the Washington Post.

Microsoft has also denied a detailed technical post about the breach by cloud security firm Wiz, despite having been involved in verifying the post.

The email account of US Commerce Secretary Gina Raimondo was among a slew of accounts breached at both the State and Commerce Departments by the attackers, who are claimed to be from China.

In his post, Yoran said the flaw his staff had found was expected to be fixed only by September.

In light of Microsoft's additional claims regarding the vulnerability, the Tenable chief was contacted again on Friday for his response.

He responded: "The last validation was Monday. And it now appears that it's either fixed, or we are blocked from testing. We don't know the fix, or mitigation, so hard to say if it's truly fixed, or Microsoft put a control in place like a firewall rule or ACL to block us.

"When we find vulns in other products, vendors usually inform us of the fix so we can validate it effectively. With Microsoft Azure that doesn't happen, so it's a black box, which is also part of the problem. The 'just trust us' lacks credibility when you have the current track record."

In a related development, the website Federal News Network reported on Wednesday that the US House Oversight and Accountability Committee was now looking at the breach.

It said legislators had sent letters to both Raimondo and Secretary of State Antony Blinken asking for staff briefings before 9 August.

Read 999 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here

GARTNER MARKET GUIDE FOR NDR 2022

You probably know that we are big believers in Network Detection and Response (NDR).

Did you realise that Gartner also recommends that security teams prioritise NDR solutions to enhance their detection and response?

Picking the right NDR for your team and process can sometimes be the biggest challenge.

If you want to try out a Network Detection and Response tool, why not start with the best?

Vectra Network Detection and Response is the industry's most advanced AI-driven attack defence for identifying and stopping malicious tactics in your network without noise or the need for decryption.

Download the 2022 Gartner Market Guide for Network Detection and Response (NDR) for recommendations on how Network Detection and Response solutions can expand deeper into existing on-premises networks, and new cloud environments.

DOWNLOAD NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!