Cisco Releases Security Update for Cisco Secure Web Appliance
This article is contributed. See the original author and article here.
This article is contributed. See the original author and article here.
This article is contributed. See the original author and article here.
CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the “Date Added to Catalog” column, which will sort by descending dates.
Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise. BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.
Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the specified criteria.
This article is contributed. See the original author and article here.
This article is contributed. See the original author and article here.
Finnish company Tietoevry is the largest IT services provider in the Nordics, with 24,000 employees worldwide serving customers in 90 countries and regions. As the company’s customers move to the cloud, the skills required of Tietoevry teams are changing accordingly. Hiring new talent is difficult and expensive—current IT skills are in demand everywhere. At the same time, the company has a base of great employees with years of productive experience in legacy technologies.
Many organizations face similar situations, but Tietoevry created an extraordinarily holistic plan for reskilling that serves the company’s needs, valuing and retaining its employees, and building robust teams to serve its customers. To address the challenge, in 2021, Tietoevry created its Connect Academy—a comprehensive program that focuses on reskilling internal employees on Microsoft technologies, with simultaneous new job placement within the company.
One of the pillars of the Tietoevry culture is “Keep Learning,” which means that the company and its employees seek to continue developing their skills—now and in the future—and to stay curious and relevant. “Our employees do value learning very highly, and that’s why we want to support them in this,” says Lelde Saleniece, Tietoevry’s People Development Consultant. “The [Connect] Academy is one great example of how we do that, how we support them—not just in upskilling but in reskilling, as well. We care for them and their knowledge, and we want them to stay here.”
The Connect Academy begins with an analysis of business needs and the resources required to meet them. After the analysis, the candidate selection phase starts and everyone can apply. Line managers nominate candidates, and then, in the “handshake” step, candidates go through a career-planning stage, join their new teams, and begin training—including job shadowing and assignments. Microsoft Learn training resources are key, notes Lelde. “Microsoft has been very helpful, and definitely, without the support and collaboration, this wouldn’t be as good a program as it is.”
Microsoft Learn resources are at the core of the experiential learning journey, reports Lead Cloud Advisor Bjørn Sigurd Hove, who is a mentor for learners in the program. The certifications that learners earn demonstrate mastery, he observes, “But in my view, the road to that certification is maybe more important.” In addition to instructor-led training, he explains, “I stressed that they should use the study guides, which have links to resources on each and every subject.” Bjørn also points learners to the Microsoft Learn labs for hands-on experience. “The certification is just the end goal of this journey, but the journey is most important.”
The training component is intense—two months of dedicated time for classwork, labs, exam preparation, and certification exams. Raja Ali, a Tietoevry employee who completed the Connect Academy, used all the offered Microsoft Learn self-study resources. “The real deal was when you were sitting down and working on Microsoft Learn,” he recalls. “The coolest thing was the sandbox experience you get in Microsoft Learn, when you’re reading something and they ask you to actually do the activity right there.”
The many benefits of this process start with meeting the business needs, ensuring that “we are not training people just for the sake of the training, but we are training people to the actual roles and actual jobs,” notes Ari Lehtovaara, Head of the Connect Academy. “The main idea is to give them basic knowledge so that they can fit into the team and start working.”
Tietoevry Line Manager Niklas Klasén welcomes reskilled employees onto his team. He points out that selecting candidates for the academy is important, given how hard it is to recruit suitable talent from outside the company. Their background is important. “For me,” Niklas emphasizes, “being able to combine the skills that people already have from their long IT careers with the new cloud experience, that has been a very valuable concept for us.”
At every step of the two-month program, the Connect Academy assists employees and supports them in their new roles. They join their new teams immediately when training starts, with a line manager and mentor to help them.
Legacy skills can be helpful to the team, Niklas explains. “Let’s say, for example, they worked with networking on-prem or in our own datacenters. They are now subject matter experts when it comes to connecting that datacenter to the cloud and are a key resource when it comes to migrating from the datacenter, as well.”
With Microsoft Learn partnering to provide technical product knowledge at core of the Connect Academy, Tietoevry has created a thoughtfully strategic way forward for the company—and, most of all, for its employees. As Bjørn points out, “That program gives our colleagues a new career in the cloud space, and I’m really proud of that.”
For more details on Tietoevry’s learning journey, check out the following Microsoft Customer Tech Talks episode.
This article is contributed. See the original author and article here.
This article is contributed. See the original author and article here.
We continue to expand the Azure Marketplace ecosystem. For this volume, 113 new offers successfully met the onboarding criteria and went live. See details of the new offers below:
Get it now in our marketplace | |
|---|---|
| Airflow on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Airflow on Ubuntu Server 20.04 LTS. Airflow is an open-source platform for programmatically authoring, scheduling, and monitoring workflows. Airflow pipelines are defined in Python, which allows for dynamic pipeline generation. | |
Cassandra on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides Cassandra on Ubuntu Server 18.04 LTS. Apache Cassandra is an open-source NoSQL distributed database trusted by thousands of companies for scalability and high availability. Cassandra enables developers to dynamically scale their databases with no downtime. | |
Cassandra on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Cassandra on Ubuntu Server 20.04 LTS. Apache Cassandra is an open-source NoSQL distributed database trusted by thousands of companies for scalability and high availability. Cassandra enables developers to dynamically scale their databases with no downtime. | |
Cassandra on Ubuntu Server 22.04 LTS: This offer from AskforCloud provides Cassandra on Ubuntu Server 22.04 LTS. Apache Cassandra is an open-source NoSQL distributed database trusted by thousands of companies for scalability and high availability. Cassandra enables developers to dynamically scale their databases with no downtime. | |
DecisionRules: DecisionRules, a lightweight and blazingly fast business rules engine, streamlines workflows and helps organizations digitalize their day-to-day decision-making processes. DecisionRules is available as a privately managed cloud or as an on-premises deployment. | |
Dolphin on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides Dolphin on Ubuntu Server 18.04 LTS. Dolphin, an open-source platform for building social networks, is designed to be easy to use and customize. | |
Dolphin on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Dolphin on Ubuntu Server 20.04 LTS. Dolphin, an open-source platform for building social networks, is designed to be easy to use and customize. | |
Dotclear on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides Dotclear on Ubuntu Server 18.04 LTS. Dotclear is an open-source web-publishing tool written in PHP. Its flexible template system allows you to customize your Dotclear demo without having PHP knowledge, and its comment system has built-in anti spam protection. | |
Dotclear on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Dotclear on Ubuntu Server 20.04 LTS. Dotclear is an open-source web-publishing tool written in PHP. Its flexible template system allows you to customize your Dotclear demo without having PHP knowledge, and its comment system has built-in anti spam protection. | |
Dotclear on Ubuntu Server 22.04 LTS: This offer from AskforCloud provides Dotclear on Ubuntu Server 22.04 LTS. Dotclear is an open-source web-publishing tool written in PHP. Its flexible template system allows you to customize your Dotclear demo without having PHP knowledge, and its comment system has built-in anti spam protection. | |
e107 on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides e107 on Ubuntu Server 18.04 LTS. e107 is an open-source content management system powered by PHP, MySQL, and Twitter Bootstrap. Its intuitive interface gives users complete control of their website and digital assets even if they have no knowledge of HTML or JavaScript. | |
e107 on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides e107 on Ubuntu Server 20.04 LTS. e107 is an open-source content management system powered by PHP, MySQL, and Twitter Bootstrap. Its intuitive interface gives users complete control of their website and digital assets even if they have no knowledge of HTML or JavaScript. | |
e107 on Ubuntu Server 22.04 LTS: This offer from AskforCloud provides e107 on Ubuntu Server 22.04 LTS. e107 is an open-source content management system powered by PHP, MySQL, and Twitter Bootstrap. Its intuitive interface gives users complete control of their website and digital assets even if they have no knowledge of HTML or JavaScript. | |
Exponent CMS on Ubuntu 18.04 LTS: This offer from AskforCloud provides Exponent CMS on Ubuntu 18.04 LTS. Exponent CMS is an open-source content management system based on PHP and the Exponent framework. With Exponent, users can easily create and manage dynamic websites without directly coding web pages or managing site navigation. | |
Hadoop on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Hadoop on Ubuntu Server 20.04 LTS. Apache’s Hadoop framework transparently supports data motion and reliability for applications. Hadoop implements the computational paradigm MapReduce, dividing an app into fragments, each of which may be executed or re-executed on any node in a cluster. | |
Kafka on Debian 10: This offer from AskforCloud provides Kafka on Debian 10. Apache’s Kafka, an open-source distributed event store and streaming platform, is used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. | |
Kafka on Debian 11: This offer from AskforCloud provides Kafka on Debian 11. Apache’s Kafka, an open-source distributed event store and streaming platform, is used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. | |
Kafka on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides Kafka on Ubuntu Server 18.04 LTS. Apache’s Kafka, an open-source distributed event store and streaming platform, is used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. | |
Kafka on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Kafka on Ubuntu Server 20.04 LTS. Apache’s Kafka, an open-source distributed event store and streaming platform, is used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. | |
Kafka on Ubuntu Server 22.04 LTS: This offer from AskforCloud provides Kafka on Ubuntu Server 22.04 LTS. Apache’s Kafka, an open-source distributed event store and streaming platform, is used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. | |
Kubernetes on Ubuntu: This offer from Apps4Rent provides Kubernetes on Ubuntu. Kubernetes is a portable and extensible open-source platform for managing containerized workloads. | |
LAMP on Ubuntu 20.04: This offer from Apps4Rent provides a LAMP stack on Ubuntu 20.04. The LAMP stack includes Apache HTTP Server, the MySQL relational database management system, the PHP programming language, and a Linux operating system. Engineers use the stack to develop and deploy high-performance web apps in a Linux environment. | |
Laravel Framework on Ubuntu Server 20.04 LTS: This offer from AskforCloud provides Laravel on Ubuntu Server 20.04 LTS. Laravel is a PHP framework with expressive, elegant syntax. The framework is robust and incredibly scalable, so it can grow with your project. | |
Laravel on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides Laravel on Ubuntu Server 18.04 LTS. Laravel is a PHP framework with expressive, elegant syntax. The framework is robust and incredibly scalable, so it can grow with your project. | |
LightWAN vCPE: The LightWAN network access device LightWAN vCPE provides customers with cloud interconnection and access to acceleration services. LightWAN is based on SDN and WAN acceleration technology and can swiftly connect branches, datacenters, and cloud services to LightWAN POP nodes. This app is available only in Chinese. | |
Mattermost on Ubuntu 18.04 LTS: This offer from AskforCloud provides Mattermost on Ubuntu 18.04 LTS. Mattermost is an open-source collaboration platform. Bring together team messaging, task and project management, and workflow orchestration so you can deliver high-quality software. | |
Mattermost on Ubuntu 20.04 LTS: This offer from AskforCloud provides Mattermost on Ubuntu 20.04 LTS. Mattermost is an open-source collaboration platform. Bring together team messaging, task and project management, and workflow orchestration so you can deliver high-quality software. | |
Mattermost on Ubuntu 22.04 LTS: This offer from AskforCloud provides Mattermost on Ubuntu 22.04 LTS. Mattermost is an open-source collaboration platform. Bring together team messaging, task and project management, and workflow orchestration so you can deliver high-quality software. | |
OutSystems Standard Edition: Quickly create and update web and mobile applications with OutSystems, a modern platform for developing, delivering, and evolving compelling apps that drive innovation at the pace that business requires. OutSystems features visual development tools and automation powered by AI. | |
Piwigo on Ubuntu 22.04 LTS: This offer from AskforCloud provides Piwigo on Ubuntu 22.04 LTS. Piwigo is open-source photo management software designed for organizations, teams, and individuals. Easily organize and share your photos on the web with Piwigo. | |
Pydio on Ubuntu Server 18.04 LTS: This offer from AskforCloud provides Pydio on Ubuntu Server 18.04 LTS. Pydio is open-source file-sharing and synchronization software that allows you to access and securely share large amounts of data from a central location. | |
Pydio on Ubuntu Server 20.04 LTS: Easily access and share large amounts of data from a central location with this offer from AskforCloud, which provides Pydio on Ubuntu Server 20.04 LTS. Paris-based Pydio is a leader in the self-hosted enterprise document sharing and collaboration market. | |
ServicePilot SaaS: ServicePilot allows you to collect, monitor, and analyze historical data across your on-premises and Microsoft Azure environments. Proactively identify underperforming servers and applications before they impact users and customers. | |
Tanium Cloud: Turbocharge your security team’s capabilities with Tanium. Delivered as a fully managed cloud-based service, with zero infrastructure requirements, Tanium offers complete visibility over all endpoints so you can quickly manage, secure, and protect your network at scale. | |
Tanium Cloud Package Management Service (TCPMS): This global service optimizes the Tanium linear-chain architecture for customers and remote workers. It creates efficiencies in software distribution across all endpoints by eliminating database bloat and connection overload across your on-premises, cloud, and hybrid environments. | |
UCMC NetCM: GBM’s open-source configuration management platform powered by Ansible eliminates repetitive tasks by automating workflows for firewalls, endpoints, and switches, and it makes your network operations more efficient and productive. | |
VisionDocs: This solution from Mint Management Technologies extracts information from PDFs, images, and scans and makes it searchable on applications like Microsoft Teams and SharePoint. Match invoices to vendors and enrich document scans or facial comparisons. | |
| ZooKeeper on Ubuntu Server 20.04 LTS: AskforCloud’s offer provides ZooKeeper on Ubuntu Server 20.04 LTS. Apache ZooKeeper is an open-source server for highly reliable distributed coordination of cloud applications. | |
Go further with workshops, proofs of concept, and implementations | |
Agile Data Engineering Sprints: 2-Week Implementation: Customer-centric experts from Appsfactory will apply the agile methodology to support the design, implementation, and testing of your data engineering tasks using Microsoft Azure Cognitive Services, Microsoft Power Platform, and custom solutions powered by Azure Machine Learning Studio. | |
Cognizant 1Sustainability Accelerator: 4-Week Implementation: Accelerate and automate your sustainability initiatives with solution, which Cognizant will implemented on Microsoft Azure. 1Sustainability integrates with Microsoft Cloud for Sustainability (MCfS) for seamless cross-department data collection and energy consumption management. | |
Customer Explorer Analytics: 6-Week Implementation: Learn how to drive growth and improve customer experience with Tredence’s offering. Optimize your marketing campaign build cycle with a custom web app for creating and exporting customer segments using Azure Databricks, Azure Monitor, and Azure Data Lake Storage. | |
Data Science Modernization: 6-Week Implementation: Get useful insights and best-practice recommendations from Tallan as you prepare to modernize your legacy data science system. Tallan’s experts will help migrate your workloads to Microsoft Azure while creating a robust governance and security process. | |
DevOps as a Service: 2-Day Workshop: The experts from Transition Technologies PSC will lay the foundation for innovation and growth by introducing you to the agile and integrated framework of Microsoft Azure DevOps. Walk away with a solid strategy to transform your ecosystem. | |
Disaster Recovery as a Service: 10-Day Implementation: TM Systems’ offering will protect your business-critical applications and data through the design and implementation of backup and disaster recovery using Azure Site Recovery. Keep your business running and proactively resolve any outage issues. | |
Enterprise Modern Data Science Platform: 4-Month Implementation: Ensure the success of your data science projects by simplifying data engineering workloads and reducing production time with Tallan’s enterprise-scale Modern Data Science Platform (MDSP) on Microsoft Azure. | |
Machine Learning Operations: 2-Month Implementation: Using Microsoft Azure DevOps best practices along with automated retraining and continuous monitoring of your machine learning and statistical models, Tallan will help maximize the return on your data science investment. | |
Microsoft Defender for Endpoint: 2-Week Design and Implementation: Difenda’s Microsoft-certified technical experts will tailor your Microsoft Defender for Endpoint configuration and implementation so you can maximize your security investment with a unified and robust service across your environment. | |
Migrate Workloads to Azure and SQL Server: 3-Week Implementation: Prime DB will provide a cost-effective, interactive experience for your team to safely identify risks and gaps before deploying workloads to Microsoft Azure, Microsoft SQL Server, Microsoft 365, and more. This service is available only in Portuguese. | |
| Zero Trust Security: 3-Day Workshop: In this workshop, Oxford Computer Group will help your organization explore and customize a Zero Trust security solution built on Microsoft 365. Simplify security management and provide ongoing protection for your users and resources. | |
Contact our partners | |
| 2OS Deep No-Code (No-Code + AI) | |
5-2 Cloud-Native Migration and App Modernization: 2-Hour Briefing | |
Azure Application Modernization: 1-Day Briefing | |
| Azure App Modernization: 4-Week Assessment | |
Azure Business Insights and AI: 2-Hour Briefing | |
Azure Cloud-Native Design: 1-Week Assessment | |
Azure Foundation Workshop and Implementation | |
BDO Managed Compliance Services | |
BDO Managed Detection and Response | |
Cloud Readiness: 2-Week Assessment | |
Customer Explorer Analytics SaaS Offering | |
Doc Reader: Intelligent Document Processing for Finance | |
EdGraph Data Management and Analytics Platform | |
FSI Strategies: Managed Services for Microsoft 365 | |
Genpact Cora Intelligent Data Orchestration | |
Global Directory for Microsoft Teams | |
Liquid Cyber Security SOC Onboarding | |
Optical Quality Assurance in Production: 3-Month Proof of Concept | |
PwC Intelligent Risk Monitoring Tool (Subscription) | |
Retail & Distribution Data and AI for Azure Synapse: 2-Week Assessment | |
Thomson Reuters ID Risk Analytics | |
Unica Managed Detection & Response | |
Using Azure Synapse in Industrial and Energy Markets: 2-Week Assessment | |
Veeam Backup for Microsoft Azure: 2-Hour Briefing | |
ZenCRM Linea Business Advanced Edition | |
ZenCRM Linea Business Full Edition | |
ZenCRM Linea Business Pro Edition | |
| Zoom DataParser | |
This article is contributed. See the original author and article here.
This article is contributed. See the original author and article here.
Actions for ZCS administrators to take today to mitigate malicious cyber activity:
• Patch all systems and prioritize patching known exploited vulnerabilities.
• Deploy detection signatures and hunt for indicators of compromise (IOCs).
• If ZCS was compromised, remediate malicious activity.
The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) are publishing this joint Cybersecurity Advisory (CSA) in response to active exploitation of multiple Common Vulnerabilities and Exposures (CVEs) against Zimbra Collaboration Suite (ZCS), an enterprise cloud-hosted collaboration software and email platform. CVEs currently being exploited against ZCS include:
Cyber threat actors may be targeting unpatched ZCS instances in both government and private sector networks. CISA and the MS-ISAC strongly urge users and administrators to apply the guidance in the Recommendations section of this CSA to help secure their organization’s systems against malicious cyber activity. CISA and the MS-ISAC encourage organizations who did not immediately update their ZCS instances upon patch release, or whose ZCS instances were exposed to the internet, to assume compromise and hunt for malicious activity using the third-party detection signatures in the Detection Methods section of this CSA. Organizations that detect potential compromise should apply the steps in the Incident Response section of this CSA.
CVE-2022-27924 is a high-severity vulnerability enabling an unauthenticated malicious actor to inject arbitrary memcache commands into a targeted ZCS instance and cause an overwrite of arbitrary cached entries. The actor can then steal ZCS email account credentials in cleartext form without any user interaction. With valid email account credentials in an organization not enforcing multifactor authentication (MFA), a malicious actor can use spear phishing, social engineering, and business email compromise (BEC) attacks against the compromised organization. Additionally, malicious actors could use the valid account credentials to open webshells and maintain persistent access.
On March 11, 2022, researchers from SonarSource announced the discovery of this ZCS vulnerability. Zimbra issued fixes for releases 8.8.15 and 9.0 on May 10, 2022. In June 2022, SonarSource publicly released proof-of-concept (POC) exploits for this vulnerability.[1][2] Based on evidence of active exploitation, CISA added this vulnerability to the Known Exploited Vulnerabilities Catalog on August 4, 2022. Due to the POC and ease of exploitation, CISA and the MS-ISAC expect to see widespread exploitation of unpatched ZCS instances in government and private networks.
CVE-2022-27925 is a high severity vulnerability in ZCS releases 8.8.15 and 9.0 that have mboximport functionality to receive a ZIP archive and extract files from it. An authenticated user has the ability to upload arbitrary files to the system thereby leading to directory traversal.[3] On August 10, 2022, researchers from Volexity reported widespread exploitation—against over 1,000 ZCS instances—of CVE-2022-27925 in conjunction with CVE-2022-37042.[4] CISA added both CVEs to the Known Exploited Vulnerabilities Catalog on August 11, 2022.
CVE-2022-37042 is an authentication bypass vulnerability that affects ZCS releases 8.8.15 and 9.0. CVE-2022-37042 could allow an unauthenticated malicious actor access to a vulnerable ZCS instance. According to Zimbra, CVE-2022-37042 is found in the MailboxImportServlet function.[5][6] Zimbra issued fixes in late July 2022.
CVE-2022-30333 is a high-severity directory traversal vulnerability in RARLAB UnRAR on Linux and UNIX allowing a malicious actor to write to files during an extract (unpack) operation. A malicious actor can exploit CVE-2022-30333 against a ZCS server by sending an email with a malicious RAR file. Upon email receipt, the ZCS server would automatically extract the RAR file to check for spam or malware.[7] Any ZCS instance with unrar installed is vulnerable to CVE-2022-30333.
Researchers from SonarSource shared details about this vulnerability in June 2022.[8] Zimbra made configuration changes to use the 7zip program instead of unrar.[9] CISA added CVE-2022-3033 to the Known Exploited Vulnerabilities Catalog on August 9, 2022. Based on industry reporting, a malicious cyber actor is selling a cross-site scripting (XSS) exploit kit for the ZCS vulnerability to CVE 2022 30333. A Metasploit module is also available that creates a RAR file that can be emailed to a ZCS server to exploit CVE-2022-30333.[10]
CVE-2022-24682 is a medium-severity vulnerability that impacts ZCS webmail clients running releases before 8.8.15 patch 30 (update 1), which contain a cross-site scripting (XSS) vulnerability allowing malicious actors to steal session cookie files. Researchers from Volexity shared this vulnerability on February 3, 2022[11], and Zimbra issued a fix on February 4, 2022.[12] CISA added this vulnerability to the Known Exploited Vulnerabilities Catalog on February 25, 2022.
Note: CISA and the MS-ISAC will update this section with additional IOCs and signatures as further information becomes available.
CISA recommends administrators, especially at organizations that did not immediately update their ZCS instances upon patch release, to hunt for malicious activity using the following third-party detection signatures:
CISA and the MS-ISAC recommend organizations upgrade to the latest ZCS releases as noted on Zimbra Security – News & Alerts and Zimbra Security Advisories.
See Volexity’s Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925 for mitigation steps.
Additionally, CISA and the MS-ISAC recommend organizations apply the following best practices to reduce risk of compromise:
If an organization’s system has been compromised by active or recently active threat actors in their environment, CISA and the MS-ISAC recommend the following initial steps:
See the joint CSA from the cybersecurity authorities of Australia, Canada, New Zealand, the United Kingdom, and the United States on Technical Approaches to Uncovering and Remediating Malicious Activity for additional guidance on hunting or investigating a network, and for common mistakes in incident handling. CISA and the MS-ISAC also encourage government network administrators to see CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks. Although tailored to federal civilian branch agencies, these playbooks provide operational procedures for planning and conducting cybersecurity incident and vulnerability response activities and detail steps for both incident and vulnerability response.
CISA and the MS-ISAC would like to thank Volexity and Secureworks for their contributions to this advisory.
The information in this report is being provided “as is” for informational purposes only. CISA and the MS-ISAC do not provide any warranties of any kind regarding this information. CISA and the MS-ISAC do not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring.
This article is contributed. See the original author and article here.
This article is contributed. See the original author and article here.
Many people still prefer to pick up the phone when they want to access customer service. Many others find that the phone is a vital last resort when they fail to get answers in digital channels. Regardless of why people call a contact center, it is essential that the experience is fast, simple, and satisfying.
In the first article in the series, we talked about how the Microsoft Digital Contact Center Platform is an open, extensible, and collaborative platform for delivering seamless, omnichannel customer engagement at scale. In this article, we’ll look at how the Microsoft Digital Contact Center Platform brings together Nuance and Microsoft innovations to help organizations engage customers efficiently and effectively in the voice channelfrom the moment they reach the interactive voice response (IVR) system.
Most IVRs make customers navigate a maze of menu options and listen to irrelevant messages because they lack the intelligence to resolve inquiries themselves. They frustrate customers, who have learned to keep pressing ‘0’ or shout “agent!” to reach a human agent who has no knowledge of what happened during the IVR session. That forces the customer to restart their search for a satisfactory resolution. These can be frustratingeven infuriatingcustomer experiences, which can damage brand loyalty.
With a conversational IVR, however, callers can explain their needs in their own words and get answers to questions in a few seconds.
Conversational IVRs use natural language understanding (NLU) to interpret what callers want to accomplish and resolve their issues in a fast, satisfying self-service experience. Of course, some interactions will require a live agent (like complex queries, sensitive issues, or high-value transactions), so AI-powered IVRs route those calls to an available agent with the right skill set.
The best conversational IVRs can recognize thousands of complex instances of customer intent from customers’ natural spoken words, tone, and patterns; dramatically improving the customer experience. For example, when the health insurance company Humana replaced its legacy system with a conversational IVR, its Net Promoter Score (NPS) rose by 80 percent.
Modern IVR solutions give callers intelligent, seamless, conversational self-service experiences that lead to faster resolutions, increased customer satisfaction, and lower service costs.
The most advanced IVR systems can improve customer experiences in many ways. They can offer callers the option to shift to digital experiences such as a virtual assistant or live chat to get faster servicewhile maintaining context throughout the engagement. They can also integrate with call-back management systems, so when wait times are long, the IVR gives customers the option to be called back rather than waiting in line.
On the Microsoft Digital Contact Center Platform, conversational IVRs can create even more value for customersand for organizationsby uniting Microsoft and Nuance innovations. When the IVR escalates an engagement to a live agent, it can hand over the full context of the conversation. The agent desktop can also pull in a unified view of the customer, including previous interactions, purchase history, and more. Agents feel empowered to quickly address queries and issues, increasing their productivity, while the customer feels understood and valued.
Conversational IVRs can handle most routine inquiries and even more complex interactions, increasing call containment and minimizing transfers to agents. When transfers are needed, agents have a clear view of the context of incoming calls and can serve customers more effectively. And because agents are no longer handling routine interactions, they can apply their skills to higher-value, more rewarding engagements, which in turn increases agent experience and loyalty.
For example, at a major global telco, a conversational IVR successfully handles more than 70 percent of the 4 million calls it receives each month, reducing the strain on the organization’s live agents.
On the Microsoft Digital Contact Center Platform, IVRs use intelligent routing to further increase the ability of agents to resolve most incoming calls successfully and swiftly. The real-time data and context from the IVR enhance call handling by intelligently routing callers to the live agent best suited to help, while providing them with the information needed to provide rapid, reliable resolution. That leads to higher customer and agent satisfaction as well as a significant reduction in contact center costs.
One of the most valuable developments in modern IVR technology is the addition of biometric authentication. Voice biometrics technology in Nuance Gatekeeper can accurately identify customers (and fraudsters) based on more than 1,000 characteristics of their “voiceprint” using only half a second of their natural speech.
Authenticating callers using voice biometrics increases security (because PINs and passwords can be easily bought or stolen) and eliminates the need for agents to spend time on lengthy, often tedious knowledge-based authentication processes. It also enables deeper level of personalization. By seamlessly authenticating a caller in the IVR with voice biometrics, a conversational IVR can use existing data sources to understand the caller’s relationship with the brand, past history, and other data points to personalize the experience. One of the world’s largest asset managers uses passive voice biometrics to authenticate 79 percent of customers as they speak with its conversational IVR. By automating the caller authentication process, the contact center reduced the average handle time for each call by 82 seconds because agents no longer have to begin every interaction by verifying the caller’s identity.
The Microsoft Digital Contact Center Platform makes it easy to build an enterprise-grade, secure, conversational voicebot or FAQ application for the IVR that can handle everything from straightforward queries to complex interactions. What’s more, these applications will be purpose-built to meet specific requirements and business goals.
Organizations can build DIY voicebots in Nuance Mix (more on that in our next article) or call on the expertise of Nuance’s professional services teams, speech scientists, data scientists, and conversational design specialists. And as the Microsoft Digital Contact Center Platform continues to evolve, organizations will be able to build voicebots with Microsoft Power Virtual Agents, then enhance and evolve those bots with Nuance Mix.
By bringing together Nuance Conversational IVR and Mix, Microsoft Power Virtual Agents, and Microsoft Dynamics 365 Customer Service, along with Microsoft Azure Communications Services and Azure Cognitive Services, organizations now have a single platform to create innovative customer and agent experiences.
For example, organizations can build bespoke, enterprise-grade applications using highly intelligent call routing capabilities in Dynamics 365; or create smart, personalized, empathetic, and natural IVR and bot applications with Azure Cognitive Services. It is now possible to turn those innovative “what if?” customer service ideas into reality. And, of course, it is all possible while protecting your current investments thanks to backwards compatibility and a clear, disruption-free migration path to any future solutions.
Next time, we will dive deeper into how Nuance MixNuance’s conversational AI tooling platformcomplements Microsoft Power Virtual Agents. Until then, learn more about the Microsoft Digital Contact Center Platform and how to create engaging, personalized digital experiences.
The post The AI-powered contact center, part 2: Achieve superior self-service voice support appeared first on Microsoft Dynamics 365 Blog.
Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.
Recent Comments