On June 11, 2019, Adobe released patches for ColdFusion 11, ColdFusion 2016, and ColdFusion 2018 that addresses a critical vulnerability in these versions that allow for arbitrary code execution. More information can be can found at the following link: https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html
Adobe has labeled this patch as a priority 2 patch.
Is my server affected?
If your server is running ColdFusion 2018, ColdFusion 2016, or ColdFusion 11, your server may be affected. To check, log in to your ColdFusion admin for each instance and navigate to Server Update > Updates. From there, click Check for Updatesand check your version against the affected version table below:
Product
Affected Versions
Platform
ColdFusion 2018
Update 3 and earlier versions
All
ColdFusion 2016
Update 10 and earlier versions
All
ColdFusion 11
Update 18 and earlier versions
All
My server is affected. What needs to be done to mitigate the vulnerability?
First, it is recommended to read the release notes as ColdFusion will need to be running a specific version of Java for the patch to work properly. If Java is not updated and the patch listed above is run, your server is NOT protected. Java patching is a prerequisite to the patch. The security updates require JDK 8u121 or higher (for ColdFusion 2016) and JDK 7u131 or JDK 8u121 (for ColdFusion 11).
Once Java has been updated, navigate into each ColdFusion instance and log in. Click Server Update > Updates. From there, click Check for Updates and apply the update. This will require a ColdFusion restart. Once done, confirm that the version of ColdFusion is updated to the version listed in the below table:
DataBank has partnered with CF Webtools, an Adobe partner to help with these ColdFusion and Java updates. CF Webtools can be reached by phone at 402.932.3386 or by sending an email to databanksupport@cfwebtools.com.
For Databank customers that have subscribed to 24/7 ColdFusion Support, DataBank will honor these obligations through the CF Webtools partnership. You should expect a ticket from DataBank in the coming days requesting permission to proceed with the update, including timing. You may opt out of the update when the ticket arrives.
For those customers that have not subscribed to 24/7 ColdFusion Support from DataBank, you may contact CF Webtools directly for assistance with updates. CFWebtools will guide you through their process, including making arrangements for payment directly with CF Webtools.
A World Gone Hybrid Calls for Better Management
It’s rare to find a business that’s not running, or considering, a hybrid IT strategy. Many enterprises choose to operate a combination of deployment methods to create a flexible model that will meet a diverse range of needs. A hybrid strategy, combined with services across the spectrum, is helping businesses on the journey to digital transformation.
51% of enterprises have adopted at least 1 hybrid workload
32% of enterprises’ cloud spend is allocated to hybrid, more than any other cloud delivery model (TBR, Dell)
Hybrid has become an opportunity to reach the next step in the evolution of business, but it’s also introducing additional complexity. As enterprises grow and opt for hybrid strategies,IT teams must content with an ever more complex, variable and sprawling infrastructure.
Partnering with a seasoned managed services provider is a strategic tool for enabling this hybrid IT revolution. It’s a difficult journey to take alone. Enterprises who aren’t able to innovate are falling behind, and it calls for the help of a partner who can take the time to understand your transformational vision, and provide the geographic reach, technical acumen and range of services that will help you get there.
How Managed Services Give Your Business a Leg Up on Transformation Goals
OEMs and data center providers alike are recognizing the need to offer full solution suites rather than single components of IT infrastructure. Many are starting to offer managed services, but not all have a truly comprehensive selection.
It’s common for IT service providers to label their business as an MSP, but many are limited in their offerings.When seeking to create a full solution set to optimize your hybrid IT strategy, service providers who can cover every technology practice area will be able to accelerate your digital transformation most effectively.
AtDataBank, we manage across the full platform of IT. Our in-depth approach applies to monitoring a customer’s solution portfolio, including the platform, applications, hardware, security, recovery, and tech support 24/7/365. Managed services cover everything from the network layer to IT infrastructure, patching, and tickets. It’s a package deal.
“We become an extension of their IT team. That’s why it’s really critical to have a managed service provider that can deliver the right level of competence across the board. We want our customers to be able to focus on their core responsibilities and let us handle their platform and service.”
Security and compliance also create added pressures that can be offloaded to an MSP. Staying on top of the many moving parts of compliance requirements is difficult to achieve internally, and governance will only continue to evolve.
Using resources on IT operations when it isn’t a core competency doesn’t make much sense in today’s business environment. MSPs are a great option for redirecting efforts and identifying the right strategy for excelling at digital transformation.
Making IT Easy with DataBank Managed Services
Knowing that managed services are a way to quicken the path to a hybrid IT strategy, we’ve put a great deal of effort into extending our managed services offerings and fortifying them with compliance support that can meet even the most stringent requirements—FedRAMP included.
Our managed service offerings include:
Monitoring
Recovery
Tech support
Patching
Backups
Security
“Through Databank’s robust managed services, we enable our customers to transition to a true hybrid cloud model. Instead of a one size fits all philosophy, we help align the platform, the technology stack and customer’s technology goals. Our customers buy across the spectrum: colocation, public cloud, dedicated private cloud, our virtual private cloud, and we enhance those offerings with visibility, connectivity, 24/7 operations, security and compliance. It’s all about enabling our customers to innovate”.
-Vlad Friedman, CTO, DataBank
One Year Passes Post-GDPR
The EU’s General Data Protection Regulation(GDPR) took effect on May 25, 2018. Announced in 2016, the EU gave organizations two years to shore up privacy processes in preparation of the deadline, upon which some of the most robust personal privacyprotection laws created would be put into effect.
What ensued was a mad rush to achieve compliance, often without due diligence or professional consult. Today, compliance professionals across industries are reflecting on what’s changed since GDPR went into effect.
Four Ways GDPR Has Changed How Companies Do Business in the U.S.
There are four primary ways GPPR has changed, or not changed, the way companies do business in the U.S., as well as its impact upon consumers.
1. GDPR has spurred a renewed privacy debate, leading to a new outlook on the subject by the general populace.
The back-and-forth on privacy is nothing new in the media. After all, the U.S. has had privacy laws since the 1960s. However, GDPR, coupled with the major mishaps of social media data sharing in 2016, have significantly influenced how the American populace views and thinks about what businesses are doing to protect consumers.
GDPR has given way to a new mindset, whereby consumers and end users have a strong sense of ownership over their personal data. People are very aware that companies use and retain their personal data in order to profit from what some would consider personal or intellectual property.
2. New laws are being written.
Most notably are the privacy laws in California. There are now increasing efforts to enact a person-centric, U.S. national privacy law, much like GDPR, although this is stumbling in the halls of Congress and meeting great opposition by business lobbyists in Washington.
3. Companies rushed to comply with GDPR. Enterprises across industries have put forth more budget, as well as new processes and procedures, to ensure compliance.
Have you noticed the uptick in websites requesting permission, or informing visitors of their use of cookies in popup ads? This is a prime example of the changes being made within businesses to ensure compliance with GDPR. Many of the companies impacted by GDPR were in a mad rushto comply, but without a complete understanding as to which elements of business required compliance, or why—and many still don’t. Decision makers commonly read media reports and lean on compliance professionals who say GDPR is the law, but it seems that few in the U.S. stopped to determine whether they’re under the jurisdiction of the EU.
4. An area unchanged: some companies have done their research, effectively determining they’re not required to comply.
For the companies who did take the time to conduct adequate research and consult legal counsel, ultimately determining that compliance isn’t required, not much has changed. At present, the question of whether EU law has jurisdiction inside the U.S. for a solely U.S.-based company is still in deliberation, and will be for years until a U.S. court determines the answer officially.
Bringing it Back to Basics: Privacy Laws Aren’t New
“For now, GDPR has not changed one thing we do. Companies rushed to comply as a result of media attention in late 2017 and early 2018. Since June of 2018, I have not had one compliance questionnaire or entity come to me to validate my GDPR compliance. This may change as GDPR matures and court cases determine jurisdiction and even practical implementation.”
-Mark Houpt, CISO
GDPR as a catalyst for privacy laws and compliance changes is often confounded with the social media data sharing revelations that took place in 2017. While it’s true that GDPR serves as a model for California law, and may for U.S. national privacy law as well, it didn’t initiate the real push. If anything, GDPR has demonstrated the consequences to American enterprises of failing to lead on the issue of privacy. We’ve all witnessed the damage data mishandling, leaks, and breaches inflicts upon marketing and sales efforts, as well as business overall. American businesses are used to owning the data they spend billions of dollars annually to collect. GDPR, and similar laws, have turned the tables.