Microsoft has reported two new vulnerabilities (CVE-2022-41040 & CVE-2022-41082) affecting on-premises Microsoft Exchange Server 2013, 2016, and 2019.

Microsoft has observed limited, targeted attacks exploiting these vulnerabilities to compromise target systems.

Mitigations for this vulnerability are available; however, a patch is not available at this time.

CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability while CVE-2022-41082 is a Remote Code Execution (RCE) vulnerability.

Vulnerabilities of this nature have been exploited in the past (such as with ProxyShell) to deliver web shells and perform further attacks including lateral movement within target networks and delivery of malicious payloads (such as ransomware). 

Topics: Technology Consulting, Alerts, cybersecurity, Microsoft

Litera recently created a video we believe you will find informative and helpful in planning for the many upcoming end-of-life dates for iManage and related solutions (e.g., cleanDocs, compareDocs, MS Server 2012R2, MS Basic Authentication). The video also speaks to the benefits of moving to iManage Cloud.

Topics: iManage, Infographic, End of Support, End of Life, EOL, Litera

Cybersecurity Awareness Month is a great time to educate yourself and your users.

Topics: Security, cybersecurity, Cybercrime, KnowBe4

We're looking forward to seeing Association of Legal Administrators' chapter leaders from around the continent this week in Las Vegas for the 2022 Chapter Leadership Institute!

Topics: ALA, Association of Legal Administrators, Chapter Leadership Institute

Microsoft has released workaround guidance to address a critical zero-day vulnerability — CVE-2022-30190, known as "Follina." This affects the Microsoft Support Diagnostic Tool (MSDT) in Windows. A remote, unauthenticated attacker could exploit this vulnerability to take control of an affected system. Microsoft has reported active exploitation of this vulnerability in the wild.

Topics: Alerts, cybersecurity, Microsoft

Read our latest case study about a law firm that had its data held for ransom and how Innovative Computing Systems helped them recover without paying the criminals. 

Topics: cybersecurity, Ransomware, Articles

We're happy to announce our recent partnership with 8x8 to bring clients the best business communications solutions available. 

Topics: Unified Communications, Cloud Communications, VoIP

There are a number of important iManage and related solutions requiring upgrades or patching over the coming months. We created the below infographic to help you in your legal technology planning. Please be certain to add these dates to your calendar.

Topics: iManage, Infographic, End of Support, End of Life

United States, Australia, Canada, New Zealand and United Kingdom cybersecurity authorities, including the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), New Zealand National Cyber Security Centre (NZ NCSC) and United Kingdom’s National Cyber Security Centre (NCSC-UK) issued a joint Cybersecurity Advisory yesterday detailing the most exploited technology vulnerabilities from 2021. The advisory provides details on the top 15 Common Vulnerabilities and Exposures (CVEs) routinely exploited by malicious cyber actors in 2021, as well as other CVEs frequently exploited.

U.S., Australian, Canadian, New Zealand, and UK cybersecurity authorities report that malicious cyber actors aggressively targeted newly disclosed critical software vulnerabilities against broad target sets, including public and private sector organizations worldwide in 2021. To a lesser extent, malicious cyber actors continued to exploit publicly known, dated software vulnerabilities across a broad spectrum of targets.

Important to note is that three of the top 15 routinely exploited vulnerabilities were also routinely exploited in 2020. As the agencies note, their continued exploitation indicates that many organizations fail to patch software in a timely manner and remain vulnerable to malicious cyber actors.

Topics: cybersecurity, Cybercrime, Patching

Innovative Legal Technology News Just as legal professionals were becoming acclimated to the latest public health and economic upheavals, geopolitical tensions emerged to undermine any sense of stability. Proving once again our interdependence and vulnerability to seemingly far-off challenges, the U.S. government has issued repeated warnings over the past months that cybersecurity attacks against Western businesses and organizations could be part of any attack by Russia on Ukraine. Despite little evidence of any widespread success with such attacks against U.S.-based businesses so far, such warnings only further reiterate to legal professionals the necessity of carefully managing their cybersecurity. Read the rest of our advice for legal professionals as they confront continued uncertainty in the Association of Legal Administrators' Legal Management Extra.

Topics: iManage, cybersecurity, Newsletter

Apple has released two patches for two zero-day vulnerabilities affecting macOS and iOS. The vulnerabilities could allow threat actors to disrupt or access kernel activity and may be under active exploit.

 

Topics: Alerts, cybersecurity, Apple

With more than two years of a pandemic behind us, many law firms – and many other businesses, for that matter – had expected to be back to the office more fully by now. The latest variant of COVID-19 changed those plans. Now, law firms are facing the fact that they must be prepared to be flexible for the foreseeable future. Indeed, the latest geopolitical disruptions in Eastern Europe demonstrate just how deeply uncertain our world remains. In the face of myriad challenges, how can law firm administrators and IT professionals remain nimble? Let's briefly look at key aspects of accessibility, hardware, software, and data security that will help law firms maintain continual operation in the new reality.

Topics: Technology Consulting, cybersecurity, Cybercrime, COVID-19, Work from Home

As a reminder, Microsoft is officially increasing the price of many of their Office products by 15% effective March 1, 2022:

Topics: Alerts, Microsoft, Licensing

Topics: SMB, Microsoft, Office 365

Innovative Legal Technology News Data security at law firms continued to be a challenge in 2021, with professionals working from home, trickling back into the office, then being sent home again to wrap up the year. New threats to data security emerged, along with new best practices for protecting law firm and client data. This past year’s developments can be used as a forecast for upcoming law firm data security. Read the rest of Innovative Computing Systems' CEO Michael Kemps' advice for law firms as they prepare for 2021 in Legaltech News.

Anatomy of a Cyberattack Read CTO Michael Paul's recent dissection of a phishing and ransomware attack in Cybersecurity Law & Strategy. Read now

Holiday Hours Please note the following holiday hours we will be observing in December 2021:   Innovative Computing Systems, Inc. will be closed:   🎇 Friday, December 31, 2021   However, our on-call support will still be available.    Should you need support on the above days, please use our 24-hour phone number: 1-800-541-0450.   Our support@innovativecomp.com mailbox is not monitored after hours or on holidays.

Thank you, Cheri! Welcome, Mary! After over a decade with Innovative, Cheri Walker is leaving to enjoy retirement. We thank her for her work and will miss her.    We welcome Mary Wands to the Innovative team as Logistics Specialist. Based in Phoenix, Mary has considerable business solutions experience, including project coordination for a managed services provider. Those of you familiar with Cheri will soon enjoy working with Mary. Welcome aboard, Mary!

Innovative Insights From our blog:

iManage: More Than Just Document Management Don't miss our latest series of blog posts by engineers Sharee Schuchardt and Elizabeth DeLuna on the many overlooked features of iManage. Read now

⚠️ Cybersecurity Tip Keep current with the latest cybersecurity news and our most recent technical alerts to clients on our Technical Alerts page.

Innovative Resources

Important iManage End-of-Life Dates

Topics: cybersecurity, Articles, Newsletter