Ron  Cartwright

Ron Cartwright


Microsoft is a Leader in the 2020 Gartner Magic Quadrant

We are excited to share that Microsoft has been named a Leader in the Gartner Magic Quadrant for Full Life Cycle API Management 2020 based on the ability to execute and completeness of vision. Our placement is a testament to our continued innovation in enterprise API management capabilities and broad customer adoption of Azure API Management.

With the rapid shift to and increasing adoption of digital channels for all business transactions, APIs are becoming increasingly important for organizations, enabling them to innovate, increase agility and take advantage of new business opportunities by building thriving API ecosystems. Azure API Management helps organizations of all sizes to design, secure, publish, scale, and observe APIs across clouds and on-premises and make them discoverable and consumable by internal, partner, and public developers.

Azure API Management is available in more than 50 regions worldwide. Thousands of global enterprise customers across every major industry vertical use Azure API Management including Alaska AirlinesCEMEXSwissReChipotleFinastraBoschZeissLegrand.

Magic Quadrant for Full Life Cycle API Management

Disclaimer: This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available by visiting this Microsoft site. Gartner does not endorse any vendor, product, or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

API management is an essential component of digital transformation: Microsoft Power Platform empowers professional and citizen developers with no and low code app development tools to rapidly build business applications and provides a complete solution for digital transformation with bi-directional integration with Azure API Management. With Azure API Management, you can create, design, test, and quickly publish APIs to Power Platform to enable easy discovery and consumption. Once exported as a connector to the Power Platform, the APIs are accessible for anyone to use. For example, low code developers at T-Mobile rapidly built an internal initiative tracking app with Power Apps and a custom API connector built by their professional developers, using Azure API Management and existing internal APIs.

API management across clouds and on-premises: Azure API Management offers high throughput, low latency API gateway on Azure. With the self-hosted version of the gateway, customers can deploy a containerized version of API Management’s runtime component anywhere they host their APIs, on-premises or in the cloud, to support hybrid, multi-cloud API scenarios securely and efficiently. Self-hosted gateways are managed from Azure, enabling centralized visibility and unified management across internal and external APIs, regardless of where they are hosted.

API discovery and onboarding: Azure API Management offers a built-in developer portal for customers to effortlessly publish APIs for discovery and consumption by internal employees, partners, or external application developers. API consumers can use the portal to browse an always up-to-date API reference, request API access, interactively test APIs, and view their API consumption reports. The developer portal can be styled to reflect custom branding and extended for additional business logic, such as integration with support systems.

#developer #cloud strategy

What is GEEK

Buddha Community

Microsoft is a Leader in the 2020 Gartner Magic Quadrant
Brain  Crist

Brain Crist


Citrix Bugs Allow Unauthenticated Code Injection, Data Theft

Multiple vulnerabilities in the Citrix Application Delivery Controller (ADC) and Gateway would allow code injection, information disclosure and denial of service, the networking vendor announced Tuesday. Four of the bugs are exploitable by an unauthenticated, remote attacker.

The Citrix products (formerly known as NetScaler ADC and Gateway) are used for application-aware traffic management and secure remote access, respectively, and are installed in at least 80,000 companies in 158 countries, according to a December assessment from Positive Technologies.

Other flaws announced Tuesday also affect Citrix SD-WAN WANOP appliances, models 4000-WO, 4100-WO, 5000-WO and 5100-WO.

Attacks on the management interface of the products could result in system compromise by an unauthenticated user on the management network; or system compromise through cross-site scripting (XSS). Attackers could also create a download link for the device which, if downloaded and then executed by an unauthenticated user on the management network, could result in the compromise of a local computer.

“Customers who have configured their systems in accordance with Citrix recommendations [i.e., to have this interface separated from the network and protected by a firewall] have significantly reduced their risk from attacks to the management interface,” according to the vendor.

Threat actors could also mount attacks on Virtual IPs (VIPs). VIPs, among other things, are used to provide users with a unique IP address for communicating with network resources for applications that do not allow multiple connections or users from the same IP address.

The VIP attacks include denial of service against either the Gateway or Authentication virtual servers by an unauthenticated user; or remote port scanning of the internal network by an authenticated Citrix Gateway user.

“Attackers can only discern whether a TLS connection is possible with the port and cannot communicate further with the end devices,” according to the critical Citrix advisory. “Customers who have not enabled either the Gateway or Authentication virtual servers are not at risk from attacks that are applicable to those servers. Other virtual servers e.g. load balancing and content switching virtual servers are not affected by these issues.”

A final vulnerability has been found in Citrix Gateway Plug-in for Linux that would allow a local logged-on user of a Linux system with that plug-in installed to elevate their privileges to an administrator account on that computer, the company said.

#vulnerabilities #adc #citrix #code injection #critical advisory #cve-2020-8187 #cve-2020-8190 #cve-2020-8191 #cve-2020-8193 #cve-2020-8194 #cve-2020-8195 #cve-2020-8196 #cve-2020-8197 #cve-2020-8198 #cve-2020-8199 #denial of service #gateway #information disclosure #patches #security advisory #security bugs

Grace  Lesch

Grace Lesch


Microsoft named a Leader in Gartner’s 2020 Magic Quadrant for Cloud DBMS Platforms

Cloud and data technologies have been the focal point of digital transformation as organizations democratize and modernize their data platforms to turn data into a strategic asset. Our customers have shown tremendous resilience as entire industries have shifted under a landscape of economic uncertainty and they rely on Azure for a full range of use cases. Gartner evaluated these use cases across a wide range of industries and deployment sizes for this Magic Quadrant.

#database #microsoft #magic quadrant #cloud dbms platforms

Top Microsoft big data solutions Companies | Best Microsoft big data Developers

An extensively researched list of top Microsoft big data analytics and solution with ratings & reviews to help find the best Microsoft big data solutions development companies around the world.
An exclusive list of Microsoft Big Data consulting and solution providers, after examining various factors of expert big data analytics firms and found the equivalent matches that boast the ace qualities with proven fineness in data analytics. For business growth and enterprise acceleration getting inputs from the whole data of the organization have become necessary, thus we bring to you the most trustworthy Microsoft Big Data consultants and solutions providers for your assistance.
Let’s take a look at the List of Best Microsoft big data solutions Companies.

#microsoft big data solutions development companies #microsoft big data analytics and solution #microsoft big data consultants #microsoft big data developers #microsoft big data #microsoft big data solution providers

Ron  Cartwright

Ron Cartwright


Election Systems Under Attack via Microsoft Zerologon Exploits

U.S. government officials have warned that advanced persistent threat actors (APTs) are now leveraging Microsoft’s severe privilege-escalation flaw, dubbed “Zerologon,” to target elections support systems.

Days after Microsoft sounded the alarm that an Iranian nation-state actor was actively exploiting the flaw (CVE-2020-1472), the Cybersecurity Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) published a joint advisory warning of further attacks.

The advisory details how attackers are chaining together various vulnerabilities and exploits – including using VPN vulnerabilities to gain initial access and then Zerologon as a post-exploitation method – to compromise government networks.

“This recent malicious activity has often, but not exclusively, been directed at federal and state, local, tribal and territorial (SLTT) government networks,” according to the security advisory. “Although it does not appear these targets are being selected because of their proximity to elections information, there may be some risk to elections information housed on government networks.”

With the U.S. November presidential elections around the corner – and cybercriminal activity subsequently ramping up to target election infrastructure and presidential campaigns – election security is top of mind. While the CISA and FBI’s advisory did not detail what type of elections systems were targeted, it did note that there is no evidence to support that the “integrity of elections data has been compromised.”

Microsoft released a patch for the Zerologon vulnerability as part of its August 11, 2020 Patch Tuesday security updates. Exploiting the bug allows an unauthenticated attacker, with network access to a domain controller, to completely compromise all Active Directory identity services, according to Microsoft.

Despite a patch being issued, many companies have not yet applied the patches to their systems – and cybercriminals are taking advantage of that in a recent slew of government-targeted attacks.

The CISA and FBI warned that various APT actors are commonly using a Fortinet vulnerability to gain initial access to companies. That flaw (CVE-2018-13379) is a path-traversal glitch in Fortinet’s FortiOS Secure Socket Layer (SSL) virtual private network (VPN) solution. While the flaw was patched in April 2019, exploitation details were publicized in August 2019, opening the door for attackers to exploit the error.

Other initial vulnerabilities being targeted in the attacks include ones in Citrix NetScaler (CVE-2019-19781), MobileIron (CVE-2020-15505), Pulse Secure (CVE-2019-11510), Palo Alto Networks (CVE-2020-2021) and F5 BIG-IP (CVE-2020-5902).

After exploiting an initial flaw, attackers are then leveraging the Zerologon flaw to escalate privileges, researchers said. They then use legitimate credentials to log in via VPN or remote-access services, in order to maintain persistence.

#critical infrastructure #vulnerabilities #web security #alert #apts #chaining #cisa #citrix netscaler #cve-2018-13379 #cve-2019-11510 #cve-2019-19781 #cve-2020-1472 #cve-2020-15505 #cve-2020-2021 #cve-2020-5902 #election security #election systems #exploit chain #f5 big-ip #fbi #government attacks #microsoft #mobileiron #palo alto networks #pulse secure #vpn #warning #zerologon

Shawn  Durgan

Shawn Durgan


Qualcomm Bugs Open 40 Percent of Android Handsets to Attack

Researchers identified serious flaws in Qualcomm’s Snapdragon SoC and the Hexagon architecture that impacts nearly half of Android handsets.

Six serious bugs in Qualcomm’s Snapdragon mobile chipset impact up to 40 percent of Android phones in use, according research released at the DEF CON Safe Mode security conference Friday.

The flaws open up handsets made by Google, Samsung, LG, Xiaomi and OnePlus to DoS and escalation-of-privileges attacks – ultimately giving hackers control of targeted handsets. Slava Makkaveev, a security researcher with Check Point, outlined his discoveryand said while Qualcomm has provided patches for the bug, most OEM handset makers have not yet pushed out the patches.

Click to register!

The faulty Qualcomm component is the mobile chip giant’s Snapdragon SoC and the Hexagon architecture. Hexagon a brand name for Qualcomm’s digital signal processor (DSP), part of the SoC’s microarchitecture. DSP controls the processing of real-time request between the Android user environment and the Snapdragon processor’s firmware – in charge of turning voice, video and services such GPS location sensors into computationally actionable data.

Makkaveev said the DSP flaws can be used to harvest photos, videos, call recordings, real-time microphone data, and GPS and location data. A hacker could also cripple a targeted phone or implant malware that would go undetected.

The six flaws are CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207, CVE-2020-11208 and CVE-2020-11209. Using a fuzzing technique against handsets with the vulnerable chipset, Check Point was able to identify 400 discrete attacks.

The prerequisite for exploiting the vulnerabilities is the target would need to be coaxed into downloading and running a rogue executable.

Qualcomm declined to answer specific questions regarding the bugs and instead issued a statement:

“Providing technologies that support robust security and privacy is a priority for Qualcomm. Regarding the Qualcomm Compute DSP vulnerability disclosed by Check Point, we worked diligently to validate the issue and make appropriate mitigations available to OEMs. We have no evidence it is currently being exploited. We encourage end users to update their devices as patches become available and to only install applications from trusted locations such as the Google Play Store.” – Qualcomm Spokesperson

The flaws were brought to Qualcomm’s attention between February and March. Patches developed by Qualcomm in July. A cursory review of vulnerabilities patched in the July and August Google Android Security Bulletins reveal patches haven’t been yet been pushed to handsets. For that reason, Check Point chose not to reveal technical specifics of the flaws.

What technical details that are available can be found in a DEF CON Safe Mode video posted to online. Here Makkaveev shares some technical specifics.

#hacks #mobile security #vulnerabilities #cve-2020-11201 #cve-2020-11202 #cve-2020-11206 #cve-2020-11207 #cve-2020-11208 #cve-2020-11209 #def con safe mode #digital signal processor #dos #dsp #escalation of privileges attack #google #hexagon architecture #lg #oneplus #qualcomm #samsung #snapdragon #soc #xiaomi