​Cisco has patched two critical bugs that could allow attackers to write files and run arbitrary code on its video conferencing and collaboration products.

Each bug affects the company’s Cisco Expressway series of collaboration servers and its TelePresence Video Communication Server (VCS).

The first vulnerability, CVE-2022-20754, allows a remote attacker to write files to the system. It lies in the products’ cluster database API, which doesn’t properly validate user input. This enables attackers to authenticate as an administrative user and then submit malicious input via a directory traversal attack. They could then write their own files with root privileges, including overwriting existing operating system files.

The second flaw, CVE-2022-20755, allows an attacker to execute arbitrary code by exploiting the products’ web management interface. An attacker could log in as an admin and then craft malicious input that would let them run their own code as root.

These vulnerabilities, each of which has a 9.0 CVSS score, do not depend on each other, Cisco said in its advisory. with customers being told to install both patches to protect their systems.

Cisco Expressway is a series of devices supporting collaboration with users outside of a company’s firewall. The system, which operates without the need for a VPN client, supports video, voice, and instant messaging. Users can also see each others’ presence information.

The TelePresence VCS is a server for managing video conferencing sessions. It works as an appliance on a customer’s premises or in the cloud, and supports communication between different video conferencing platforms.

TelePresence VCS has not been sold since December 2020. Cisco will stop issuing software maintenance patches for this product on December 29 this year and will stop providing support entirely at the end of 2023.

Microsoft Defender for Cloud users can access an early preview of Defender for Azure Cosmos DB, Microsoft announced on Tuesday.

Microsoft Defender for Cloud helps organizations identify and address weak points in their cloud infrastructure through cloud workload protection (CWP) and cloud security posture management (CSPM), the company said.

Defender for Azure Cosmos DB support has now been added to Microsoft Defender for Cloud, allowing for centralized management of database security across multiple cloud environments.

“Databases are constantly evolving to handle new use cases, incorporate more intelligence, and store more data, giving developers and organizations a wide range of database types to meet their varying needs,” commented Inbal Argov, senior product manager of Microsoft Defender for Cloud.

​“Because aspects including architecture, capabilities, configuration options, and authentication methods are unique to each database type, so are the security threats—requiring custom security measures and protection capabilities to address the most common threats across databases,” added Argov.

The new Defender for Azure Cosmos DB proactively monitors Azure Cosmos DB accounts and protects them from a range of attack vectors, including attacks made from the application layer, SQL injections, unusual access patterns, compromised identities, and malicious insiders. 

Threat detections are made using Microsoft Threat Intelligence, the Microsoft Defender SQL query analysis engine, and the Microsoft Defender behavioral models.

A fully managed NoSQL database, Azure Cosmos DB also helps facilitate non-relational data models with multiple SDKs and APIs, ultra-fast response times, and instant scalability.

The service can be enabled at either the subscription level or the resource level.

​Microsoft has announced that it will be delaying the planned price increase on Office 365 and Microsoft 365 products by a few weeks due to high demand for the services in the run up to the changes.

First announced in August 2021, the “substantive” price increases across a number of Modern Work products was due to come into effect on 1 March 2022.

Microsoft said the “transitional grace period” was implemented to “provide partners with additional lead time for adapting business processes”. It added that it does not believe partners will use the additional time to pull forward demand for the products.

All new commerce transactions will need to be submitted to Microsoft by no later than 14 March 2022 at 5 PM Pacific Daylight Time, or midnight at Coordinated Universal Time (UTC), in order to be eligible for the February 2022 pricing.

The price increases range between $1-$3 per user, depending on the product, but in large companies this can amount to a sizeable increase to IT departments’ overhead costs.

The six Modern Work products affected by the price changes include: 

• Microsoft 365 Business Basic: $6 per user per month, up from $5
• Microsoft 365 Business Premium: $22 per user per month, up from $20
• Office 365 E1: $10 per user per month, up from $8
• Office 365 E3: $23 per user per month, up from $20
• Office 365 E5: $38 per user per month, up from $35
• Microsoft 365 E3: $36 per user per month, up from $32

In the initial announcement, Microsoft said it represented the first major pricing adjustment for Office 365 and Microsoft 365 since it was launched in 2011, a decade previously.

Higher demand for cloud services brought on by the ongoing trend of home and hybrid working prompted the tech giant to make the change, said Jared Spataro, corporate vice president at Microsoft 365.

In December 2021, four months after the announced price increases, Microsoft also said it would be raising the prices of pay-monthly Microsoft 365 products by 20% unless partners chose to be billed on an annual basis.

Managed Service Providers (MSPs) complained at the time that they could stand to lose money if a customer went bankrupt or chose to decrease the number of licenses they needed if they opted for an annual subscription.

The move prompted heated online discussions and a Change.org petition lobbying Microsoft to reconsider the decision, which garnered more than 2,000 signatures.

AT&T and IBM have partnered to offer simulated environments for enterprises to test out AT&T’s 5G network capabilities alongside IBM’s artificial intelligence (AI) and hybrid cloud technologies.

The firms noted businesses across all industries, including the public sector, manufacturing, and financial services can leverage IBM-AT&T’s strategic alliance to improve business outcomes and boost customer satisfaction. 

Enterprises can also address critical challenges such as supply chain disruptions and cyber threats through the jointly offered simulation centre located at IBM Bethesda Lab.  The environment is envisioned to serve as a testbed for varied technologies including secure cellular and cloud computing.

For instance, manufacturers can implement “safety zones” through video intelligence to identify product anomalies and improve inventory management.

Furthermore, IBM Yorktown, the headquarters for IBM Research, is now integrated with AT&T 5G to facilitate a co-branded customer showcase and 5G innovation centre, incorporating IBM and Red Hat industry solutions and offerings.  

At AT&T’s 5G Innovation Studio in Plano, TX, IBM and AT&T are working together to bring AI and machine learning (ML) to network insights to improve IT, OT, IoT, and 5G network visibility.

Open hybrid cloud computing in a low-latency, private cellular network edge environment is yet another joint offering by AT&T and IBM.

According to AT&T’s blog post, “using the network strength of AT&T and IBM Cloud Satellite, the two companies are helping enterprise clients get faster, improved data analysis by accessing data where it resides. As workloads shift to the edge, IBM Cloud Satellite will help clients deliver low latency, while still maintaining security, data privacy, interoperability and open standards found in hybrid cloud environments.” 

Zoom reported impressive earnings for the fourth quarter of 2021 on Monday, but shares of the company fell precipitously following its weak outlook for Q1.

In contrast to the impressive growth the video conferencing firm recorded at the beginning of the COVID-19 pandemic, Zoom’s latest earnings pale even as it pursues larger enterprise clients. 

Zoom reported a non-GAAP net income per share of $1.29 for Q4 2021. Revenue for the full fiscal year totalled $4,099.9 million, up 55% year over year, while revenue for the fourth quarter amounted to $1,071.4 million, up 21%.

Zoom’s board of directors also authorized a program to buy back up to $1 billion of Zoom’s outstanding Class A common stock.

Acquisition of new customers and expanding sales across existing customers accounted for the bulk of Zoom’s Q4 revenue. By the end of the quarter, the firm had 2,725 customers contributing over $100,000 in trailing 12-month revenue, up approximately 66% from the previous quarter.

However, enterprise clients take centre stage. Zoom served approximately 191,000 enterprise customers at the end of Q4, a 35% year-over-year increase. 

For Q1 2023, Zoom expects total revenue to range from $1.07 billion to $1.075 billion. Non-GAAP diluted earnings per share (EPS) are expected to range from 86 to 88 cents with approximately 309 million non-GAAP-weighted average shares outstanding.

For the full fiscal year 2023, total revenue is expected to range between $4.530 billion and $4.550 billion, and non-GAAP income from operations is expected to vary between $1.430 billion and $1.450 billion. A non-GAAP diluted EPS of approximately $3.45 to $3.51 is expected for the entire fiscal year based on approximately 312 million non-GAAP weighted average shares outstanding.

 “Looking forward, we are addressing a large opportunity as we expect customers will continue to transform how they work and engage with their customers,» said Zoom founder and CEO, Eric S. Yuan. «It is apparent that businesses want a full communications platform that is integrated, secure, and easy to use.

«We are proud to lead the charge of the digital transformation for communications. To sustain and enhance our leadership position, in fiscal year 2023 we plan to build out our platform to further enrich the customer experience with new cloud-based technologies and expand our go-to-market motions, which we believe will enable us to drive future growth.”

Amazon Web Services (AWS) has announced its new customer carbon footprint tool as part of The Climate Pledge.

The move builds on the firm’s commitment to achieving net zero carbon emissions by 2040, ten years ahead of the Paris Agreement. 

AWS’ customer carbon footprint tool, available for free, will help its cloud customers keep track of, measure, review, and forecast the carbon emissions associated with their use of AWS services. 

Enterprises can also monitor changes in emissions levels as they migrate workloads to AWS, upgrade applications, or retire obsolete resources. As a general rule, emissions are measured in metric tons of carbon dioxide equivalent, or MTCO2e. Carbon emissions data in the customer carbon footprint tool adhere to the Greenhouse Gas Protocol and ISO standards.

Emissions data is available from January 2020 onwards, according to AWS’ customer carbon footprint user guide.  There is a quarterly interval between data updates as AWS gathers and processes new information. The customer carbon footprint tool rounds all values to the nearest tenth of a metric ton.

To estimate emissions savings versus an equivalent on-premises workload, AWS draws upon data from 451 Research, which is a part of S&P Global Market Intelligence.

“After I share information about our efforts to decarbonize with our customers, they tell me that their organization is on a similar path, and that they need to know more about the carbon footprint of their cloud infrastructure,» commented Jeff Barr, chief evangelist for AWS. 

«Today I am happy to announce the new Customer Carbon Footprint Tool. This tool will help you to meet your own sustainability goals, and is available to all AWS customers at no cost,.

Cloudflare has announced that it is acquiring US-based email security provider Area 1 for $162 million (£120.8 million) in cash and stocks combined.

The deal is expected to close in the second quarter of 2022, and comes five months after the web infrastructure and website security company announced its foray into the email security market.

​

Founded in 2013, Area 1 employs 97 staff members and has been credited with blocking over 40 million malicious phishing campaigns in 2021.

Commenting on the news, Area 1 Security CEO and president Patrick Sweeney said that phishing can be attributed as a cause of “more than 90% of cyber security damages”.

«By combining our leading phishing protection and threat intelligence capabilities with Cloudflare’s global network, data capabilities, and Zero Trust platform we truly believe that together we can help companies of any size better secure their entire network infrastructure and better protect against the most destructive cyber risks,” he added.

Cloudflare co-founder and CEO Matthew Prince described email as “the largest cyber attack vector on the Internet”, before adding that the acquisition of Area 1 will allow Cloudflare to become a “clear leader in Zero Trust”.

“To us, the future of Zero Trust includes an integrated, one-click approach to securing all of an organisation’s applications, including its most ubiquitous cloud application, email. Together, we expect we’ll be delivering the fastest, most effective, and most reliable email security on the market,” he said.

The $162 million acquisition, out of which 40-50% is estimated to be paid in class A stocks, is expected to be one of the most expensive deals in Cloudflare company history. The company has made eight acquisitions to-date – financial details of which hadn’t been made publicly available.

The purchase of Area 1’s business comes only two weeks after Cloudflare announced the acquisition of Vectrix for an undisclosed amount, in an effort to bolster its Zero Trust software-as-a-service security offering.

In September 2021, Cloudflare announced two new services, which marked its entrance into the email security industry: custom domain tool Cloudflare Email Routing and the Email Security DNS Wizard, which protects businesses from phishing and spoofing attacks.

​

The global cloud computing market is projected to reach a valuation of $1.95 trillion by 2032, according to a new report from market intelligence firm Fact.MR.

A compound annual growth rate (CAGR) of 15% is anticipated for the market between 2022 and 2032, owing to the rapid digitization of workplaces and the increasing demand for software as a service (SaaS) applications.

Commenting on the 12% CAGR of cloud-based services from 2015 to 2021, Fact.MR said the COVID-19 pandemic spurred the adoption of cloud computing, as enterprises enforced widespread work from home policies. 

With the proliferation of infrastructure as a service (IaaS), platform as a service (PaaS), and SaaS-based solutions, the market for cloud computing has grown significantly. Adobe, Alibaba Group, and Amazon are among the top market players. 

Accordingly, cloud computing solutions in North America are expected to account for 40% of the global revenue in 2022. The region is dominated by global technology giants like Microsoft, Oracle, and Amazon, who have been early adopters of cloud technology, including big data analytics, Internet of Things (IoT), additive manufacturing, artificial intelligence (AI), virtual reality (VR), augmented reality (AR), and machine learning, all of which have vastly impacted the market.

With a CAGR of 18%, the APAC market is forecast to grow the fastest during the forecast period. Emerging economies such as India and China are likely to contribute to the growth in the region.

For instance, Alibaba Group’s fast-paced expansion and Make in India initiatives have been notable factors facilitating market size growth in the APAC region. A number of cloud computing service providers, including Amazon, Microsoft, and Google LLP, have also initiated plans to strengthen their presence in Thai and Indonesian markets.

​

Microsoft has unloaded a range of new security controls for multi-cloud customers that include updates to its Defender for Cloud platform and the first service to come from its CloudKnox acquisition.

The first of the new capabilities is a change to Microsoft Defender for Cloud which is aimed at multi-cloud customers that have Google Cloud services.

Defender for Cloud, which was announced at last year’s Ignite conference, is a security posture management console that identifies configuration weaknesses across other providers’ services. And, with the addition of Google Cloud, Microsoft says it is now the only cloud provider to offer a «native» multi-cloud protection service for the top three platforms (Google Cloud, AWS and Azure).

Support for Google Cloud will come with a simplified onboarding experience, according to Microsoft. This will feature more than 80 «out-of-the-box» recommendations for users to secure their environments. It will include a central «multi-cloud view» that lets users see and compare compliance status against critical benchmarks, such as the Center of Internet Security (CIS).

The next capability comes from last year’s acquisition of cloud infrastructure management firm CloudKnox and deals with permission management. Microsoft is launching a public preview of ‘CloudKnox Permissions Management’, which will give companies «complete visibility» into user and workload identities across the cloud services. This will be largely undertaken by automated features and machine learning-powered monitoring functions.

There are also new functions for Microsoft Sentinel, which is another cloud-native platform that deploys AI to analyse large data sets for security issues. The services will have new basic logs, which will see it sift through high volumes of data and find «low-visibility» threats, according to Microsoft.

This is in addition to new archiving functions that extends data retention to seven years, instead of the current two, and also new search functions for security analysts.

Microsoft is also extending its Azure Active Directory beyond its core capabilities by adding safeguards for workload identities. And, the tech giant has also announced a new secure payment processing function for Azure Payment HSM, which is a public preview.

Kyndryl has signed a cloud partnership with Amazon Web Services (AWS) to offer joint consultancy on cloud workloads.

IBM’s former infrastructure unit has also confirmed that it will use AWS as one of its preferred cloud providers for its own internal workloads. 

The partnership will focus on building a global practice for AWS skills, services and expertise to deliver a «best-in-class» customer experience. This will include an AWS Cloud Center of Excellence (CCOE) where customers will be able to access services that support mission-critical infrastructure, new technologies, and applications that work across workflows and industries.

With the Global Center of Excellence, Kyndryl said it will be able to optimise customer migration journey’s with AWS technology.

The partnership will also deal with VMware workloads on AWS, with skilled practitioners from all three companies delivering deep expertise for custom services. AWS already has an extensive partnership with AWS, but the new deal with Kyndryl will help to boost any existing customer investments on VMware. 

«Our ability to freely explore and unleash the combined benefits of AWS cloud services with Kyndryl’s deep industry-specific managed services and expertise will provide an unprecedented level of knowledge and innovation,» said Martin Schroeter, CEO of Kyndryl. «Together, we will invest in enhancing Kyndryl’s expertise in AWS to help companies modernise, innovate, and compete.»

 This is the latest in a string of cloud-based announcements Kyndryl has made since its split from IBM. The company now has deals in place with the three biggest cloud providers – AWS, Microsoft and Google Cloud – which it believes will enable it to tap into an estimated $150 billion from the IT services market by 2025.
 
All of these deals would not have been possible, according to the company, had it still been a part of IBM, with the spilt allowing it to play an active role in the $90 billion cloud services market.