Monthly Dell Date Security Technical Newsletter

Dell Data Security Technical Newsletter

Volume 81, December 2021

Important Update: Dell Endpoint Security North America Phone Number Has Changed

Dell Endpoint Security has a new number for support tickets. Customers in North America should now call +1 877.459.7304, ext. 6236710.

Netskope Version 90.1

Netskope Release 90.1 is now available, containing 31 fixes and 40 new features, including support Windows 11, Server 2022, macOS12, and iOS 15.1

Version 89.a Release Notes can be found here.

Dell Trusted Device Version 3.9

Dell Trusted Device V3.9 is now available.

New Features and Functionality for DTD v3.9:

Trusted Device v3.9 includes a new version of the Trusted Device Event Repository. See https://hub.docker.com/r/dellemc/dtd-event-repository for more information.
The Trusted Device Event Repository now includes a utility that creates the required appsettings.json file for SIEM communication. For more information, see the Trusted Device Installation and Administrator Guide.
The Trusted Device Event Repository now includes a utility that creates the client registry entries that are required to deliver results to the Event Repository. For more information, see the Trusted Device Installation and Administrator Guide.
Administrators can now retrieve browser-based results for the Trusted Device Events Repository version running. To see the version of the Event Repository running in your environment, type the following into a browser:

https:// Repository hostname or IP address>: /siem/api/v1/version
NOTE: The Event Repository container must be running for results to display.

The following link below is the DTD summary page: What is Dell Trusted Device? | Dell US.

Dell Security Management Server

Dell Security Management Server version 11.2.0 is now available. This release includes updates for both Dell Security Management Server and Dell Security Management Server Virtual.

Changes in the 11.2 release include:

A new policy, User PIN lifetime, has been added to the Operating System Volume Settings section in the Advanced Settings of the Bitlocker Encryption policy set. The User PIN lifetime policy sets the lifetime of the Bitlocker PIN, in hours, before it must be recreated. The default value of the User PIN lifetime policy is 2160 (90 days).
An issue is resolved so that all columns display in the Device Detail managed report.
A new column, Endpoint Group, has been added to several managed reports to allow administrators to view all endpoint groups that contain an endpoint. Records can be filtered based on the value of the endpoint group column.
An issue is resolved so that custom ports defined for TCP or UDP can be saved or committed in the Client Firewall policy set.
In Populations > Enterprise > Advanced Threat tab, Threat files can now be downloaded.

Dell Security Management Server 11.2 Technical Advisories
Dell Security Management Server Virtual 11.2 Technical Advisories

Dell Endpoint Security Log4J Assessment Update

Dell and its partners are currently working through validating and remediating any services that leverage vulnerable versions of Log4J.

What is the Log4Shell / Log4J vulnerability?

Log4j2 is a ubiquitous package contained in numerous Apache frameworks used by millions of applications. The vulnerability leverages JNDI, which provides an interface for different name resolution and directory services, such as DNS, LDAP, and several other services. Log4j2 insufficiently sanitizes user-supplied data, potentially allowing an attacker to provide a string that is interpreted as a variable that, when expanded, results in the loading and invocation of a remotely hosted executable or service. Whether a particular service is exploitable depends on its specific usage of Log4j2.

Below is a list of all active Dell Endpoint Security products and their status, as well as any mitigation needed:

NetSkope – Not affected
- Report - https://www.netskope.com/blog/netskope-threat-coverage-apache-log4j-rce-cve-2021-44228
Absolute – Vulnerability has been patched
- Report - https://community.absolute.com/s/article/Absolute-Security-Bulletin-Apache-Log4j-vulnerability-CVE-2021-44228
Carbon Black Cloud – Not vulnerable
- Report - https://www.vmware.com/security/advisories/VMSA-2021-0028.html
Carbon Black Workloads – Vulnerability is present, mitigation available with administrator action required.
- Report - https://www.vmware.com/security/advisories/VMSA-2021-0028.html
- Mitigation - https://community.carbonblack.com/t5/Threat-Research-Docs/Log4Shell-Mitigation-Steps-for-VMware-Carbon-Black-Cloud/ta-p/109167?emcs_t=S2h8ZW1haWx8Ym9hcmRfc3Vic2NyaXB0aW9ufEtYMVpHMkdMSTJLMkVPfDEwOTE2OXxTVUJTQ1JJUFRJT05TfGhL
Workspace ONE – Workspace ONE Access is Vulnerable, mitigation available with administrator action required. Other Workspace ONE editions are not impacted.
- Report - https://www.vmware.com/security/advisories/VMSA-2021-0028.html
- Mitigation - https://kb.vmware.com/s/article/87090
Secureworks – Vulnerability has been patched
- XDR customers can access their report at SCWX-ADVISORY 332.
Dell Encryption – Not affected
- Report - https://www.dell.com/support/kbdoc/000194496
Dell Endpoint Security Infrastructure – Vulnerabilities have been identified, services are currently quarantined while they are being remediated.
- Report - https://www.dell.com/support/kbdoc/000194496

KB Article Updates for Dell Encryption Activation Issues

Dell Support has updated various KB articles to assist with troubleshooting activation issues with Dell Encryption. KB article has been updated with several tips and information to help with troubleshooting.

Windows 11 Support

Dell and its partners have been busy preparing for Windows 11. Various products within the Dell Endpoint Security umbrella have been updated to support Windows 11.

Windows 11 is supported in the following product versions:

Dell Encryption (all editions) – 11.2.0
Dell Endpoint Security Suite Enterprise - Web Protection and Client Firewall – 3.2.0
VMware Carbon Black – 3.7.0
Absolute Device and Data Security – 7.17.0.2
NetSkope - 89

For full listings of Windows version compatibility, see: https://www.dell.com/support/kbdoc/000156050

Dell Data Security Chat

For U.S. customers only, Chat support is now available Monday through Friday, 7 a.m. to 7 p.m. CST.

-----

Dell Data Security ProSupport for Software

24x7 support and issue resolution from a team of technicians.
Within the U.S., the dedicated number is 877.459.7304, ext. 6236710.
For a list of in-country phone numbers, click here.

-----

NEW: Dell Data Security Advanced Support for Software

Direct and easy access to your own dedicated security expert.
Support for all of your Dell endpoint security software.
Personalized support including customized communication plans, health checks and more!