To allow automatic installation of hotfixes in Sophos Firewall 20.0 and later, see the hotfix section under Sophos Firewall: System
This is also under console.
Thursday, July 24, 2025
RSS Feed for Security
Microsoft Security Blog:
Microsoft Security Respond Centre
FortiGuard Outbreak Alerts will be the mechanism for communicating important information to customers and partners. When a cybersecurity incident/attack/event occurs that has large ramifications to the cybersecurity industry and affects numerous organizations, this page will be updated with a link to the individual FortiGuard Outbreak Alert.
https://filestore.fortinet.com/fortiguard/rss/outbreakalert.xml
For more Fortinet RSS:
https://www.fortiguard.com/rss-feeds
Another RSS feed with list of cybersecurity feed:
GitHub - thehappydinoa/awesome-threat-intel-rss: A curated list of Awesome Threat Intelligence blogs
Tuesday, July 15, 2025
A Simple Linux. A Complete SIEM
You can download it for your test GitHub - eddiechu/Terminal-SIEM: Super light, super fast, unlimited search idea
Reference:
TencentOS Server V4正式获OpenSCAP官方支持，安全合规能力全面升级
TencentOS Server V4通过社区提案、代码适配和多轮测试，已正式列入 OpenSCAP 官方支持发行版列表
包含185条安全规则的基础版（basic）安全基线为例进行扫描，用户也可自行选择包含313条安全规则的标准版（standard）安全基线
https://mp.weixin.qq.com/s/yDN7wTouvY4GeuSnIg4G9Q
Monday, June 16, 2025
Windows SMB Client Elevation of Privilege Vulnerability - CVE-2025-33073 - actively exploited in the wild
You may know the CVE-2025-33073 being reported actively exploited in the wild now.
Exploitation depends on two key conditions:
- SMB coercion must be possible
- SMB signing must not be strictly enforced on the target system
Reference: https://learn.microsoft.com/zh-cn/windows-server/storage/file-server/smb-signing?tabs=group-policy
Wednesday, June 11, 2025
Azure AD Connect 2.0 change proxy setting
1. Go to the program files -> Microsoft Azure Active Directory Connect -> To modify the file proxy config in the file "Microsoft.ApplicationProxy.Connector.Common.dll.config
2. Netsh winhttp set proxy "<proxy IP>"
3. Restart the service "Microsoft Azure AD Sync"
Then, you can run the powershell command >Start-ADSyncSyncCycle -PolicyType Initial
To use the new proxy for the sync.
Fortinet SSL VPN customers need to be aware - Gradually transition to ZTNA while maintaining operational stability
Background on SSL VPN Deprecation in FortiOS 7.6.3
Fortinet has been advancing its Zero Trust Architecture (ZTA) strategy since 2022, introducing key Zero Trust Network Access (ZTNA) features in FortiOS 7.0. Recent versions like 7.6.3 may further prioritize ZTNA over SSL VPN. Fortinet has experienced numerous critical vulnerabilities in its SSL VPN functionality, most notably CVE-2024-21762, which allows unauthenticated remote code execution. These vulnerabilities, including older ones like CVE-2022-42475 and CVE-2023-27997, have been exploited by threat actors, leading to device compromise.
In FortiOS 7.6.3, Fortinet has deprecated and removed SSL VPN tunnel mode on all FortiGate models. This means that SSL VPN tunnel mode is no longer supported in the GUI or CLI, and existing SSL VPN configurations will not be upgraded. Users must migrate to IPsec VPN to maintain secure remote connectivity or change to use ZTNA.
If you decided to stay at FortiOS 7.4.x, it will reach end of support (EOS) on 11 May 2026. In the meantime, if you are E-series Fortigate users, you may also plan for replace your hardware to G-series when you plan for your FortiOS 7.6 journey with ZTNA.
Strategic Need to Migrate to Zero Trust (ZTNA)
Fortinet's Zero Trust Direction
- FortiOS 7.0+ integrates ZTNA with FortiClient agents, FortiAuthenticator, and FortiOS application gateways for granular access control.
- ZTNA aligns with hybrid cloud and SaaS environments, reducing attack surfaces compared to SSL VPN's "trusted perimeter" (Trust, but verify) model.
Technical Rationale for Transition
- Enhanced Security : ZTNA enforces "never trust, always verify," mitigating lateral movement risks from compromised endpoints or outdated SSL configurations.
- Performance Gains : ZTNA leverages SASE architecture, enabling low-latency, distributed access without complex tunnel management.
Options:
Short Term:
- Stay on 7.4.x (Please make sure you have hardening your SSL VPN) (Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Hardening-FortiGate-SSL-VPN-Best-Practices-for/ta-p/349193 and https://www.andrewtravis.com/blog/2024/09/30/fortigate-ssl-vpn-hardening)
- Switch to IPSec VPN if go for 7.6
Long Term:
- ZTNA
- Stay on IPSec VPN (There may hit operational issue since some public Internet may block IPSec)
Reference:
For v7.6 until v7.6.2, models with 2GB or less RAM, SSL VPN web and tunnel mode are removed from the GUI and CLI. See SSL VPN to dial-up VPN migration - FortiGate 7.4.6 administration guide.
For v7.6.3 and later, tunnel mode will be removed, and web mode only works for other devices, see Migration from SSL VPN tunnel mode to IPsec VPN 7.6.3 - FortiGate 7.6.0 new features.
Subscribe to:
Posts (Atom)