Swedish Windows Security User Group

Did you know that an attacker can be present on a network for more than 200 days before being detected? Imagine the damage that can be done to an organization during that time: Accessing sensitive data about your company, products, employees and clients. Altering the operating system on every computer in your network. Causing irreparable damage to your company – both in terms of dollars and damaged reputation – before you even know he’s there.

Hackers typically gain control of a network using a privileged account (e.g., domain admin) within 24-48 hours of initiating the attack. They move silently through the network, avoiding actions that would alert IT to their presence. If they are discovered, it’s usually by chance or an external notification.

Do you know how a security breach actually happens? How hackers get a foothold, and what they do once they’re in? Most importantly: Are you as secure as you think you are? Join me for a free webinar to learn how a breach actually happens and the steps you can take to help prevent an attack, including:

• Common ways hackers get into your network, including phishing scams and targeted search results
• How hackers set up and manage long-term attacks
• Things you can do today to help prevent an attack
• The key response phases, including incident response, tactical recovery and strategic recovery
• Tips for developing an effective communications plan that won’t compromise your data’s security

I hope you will join me and my colleague Jim Moeller, from the Enterprise Cybersecurity Group, to learn more about this critical topic. The “Anatomy of a Breach: How Hackers Break In” webinar will be held March 8, 2016. Registration is now open. http://aka.ms/Miwso9

Matt Kemelhar, Director of Incident Response and Recovery, Microsoft Enterprise Cybersecurity Group

Today Microsoft made numerous announcements about new security capabilities, products and features. These are all designed to help our customers accelerate the adoption of a more holistic security posture that helps protect, detect and respond to modern security threats.

All of the details are available in this article: Progress Report: Enterprise security for our mobile-first, cloud-first world.

Tim Rains
Director, Security

You may have seen reports of the Locky malware circulating the web; we think this is a good time to discuss its distribution methods, and reiterate some best-practice methods that will help prevent infection.

We’ve seen Locky being distributed by spam email, not in itself a unique distribution method, but this means that spreading is broad and not isolated to any particular region. This ransomware knows no borders, and we’ve seen high infection rates across the world.
The Locky email attachment usually arrives as a Word document, but could also be an Excel document, that appears to be an invoice. We’ve also seen the following downloaders distribute Ransom:Win32/Locky.A:

• TrojanDownloader:O97M/Bartallex
• TrojanDownloader:BAT/Locky.A
• TrojanDownloader:JS/Locky.A

If you open this file and allow the macro to run, the malware is downloaded and runs on your PC, encrypting your files. A ransom message is then displayed demanding payment in order to unlock your encrypted files. Note that once your files are encrypted, the only guaranteed way to restore them is from backup. Microsoft does not recommend you pay the ransom; there is no guarantee that this will give you access to your files.

While Microsoft detects and removes Locky, we recommend you disable macros to help prevent this and other macro-downloaded threats from infecting your PC, and then only enable macros that you trust, on a case-by-case basis. To help keep your enterprise secure, consider using a trusted location for files in your enterprise, then you can store documents that require macros there.  You can also use our cloud protection services to help boost your protection; this, and other advice on how to help keep your PC protected are outlined below.

 

Disable all except digitally signed macros in Microsoft Word

To help prevent malicious files from running macros that might download malware automatically, we recommend you change your settings to disable all except digitally signed macros.

To do this:

1. Open a Microsoft Word document.
2. Click the File tab.
3. Click Options.
4. In the Trust Center, click Trust Center Settings.

5. Select Disable all macros except digitally signed macros.

6. Click OK.

 

Block macros from running in Office files from the Internet in your enterprise

Office 16 provides a Group Policy setting that enables you to block macros from running in Word, Excel and PowerPoint files from the Internet. Read about how to block macros from running in Office 16 files from the Internet.

 

Only enable trusted content

If you have disabled macros, when you open a file that has macros you’ll see a message bar similar to the following:

Only click Enable Content if you trust the file, that is, you know where it’s from and are certain that running the macro is harmless.

 

Use advanced threat and cloud protection

You can boost your protection by using Office 365 Advanced Threat Protection and also enabling Microsoft Active Protection Service (MAPS).

Office 365 helps by blocking dangerous email threats; see the Overview of Advanced Threat Protection in Exchange: new tools to stop unknown attacks, for details.

MAPS uses cloud protection to help guard against the latest malware threats. You should check if MAPS is enabled on your PC.

 

Help prevent malware infections on your PC

There are a number of other things you can do to help prevent malware infections, for example:

• Use up-to-date security software
• Keep your software up to date
• Turn on your firewall
• Limit user privileges
• Use trusted locations for files in your enterprise

 

So to wrap this up: this ransomware is bad, but infection is preventable! Microsoft detects and removes this threat, but by ensuring that you only run known, trusted macros, you’ll help prevent a Locky infection – and any other malware that relies on malicious macros. Generally, a good approach is to only allow digitally signed macros that you trust to run on any of your documents.

Stay safe, from all of us at the MMPC.

-Jasmine Sesso, MMPC

Revision Note: V3.1 (February 24, 2016): Added a Known Issues reference to the Executive Summaries table for MS16-014. For more information, see Microsoft Knowledge Base Article 3126041. Please also note that a second Known Issue, which includes workarounds, has been added to Microsoft Knowledge Base Article 3126587.
Summary: This bulletin summary lists security bulletins released for February 2016.

Severity Rating: Important
Revision Note: V1.1 (February 24, 2016): Corrected the Updates Replaced for Windows Server 2012 and Windows Server 2012 R2 to 3124001 in MS16-005. This is an informational change only.
Summary: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker convinces a user to visit a malicious website.

Severity Rating: Important
Revision Note: V1.1 (February 24, 2016): Corrected the Updates Replaced for Windows Server 2012 and Windows Server 2012 R2 to 3124001 in MS16-005. This is an informational change only.
Summary: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker convinces a user to visit a malicious website.

Revision Note: V3.1 (February 24, 2016): Added a Known Issues reference to the Executive Summaries table for MS16-014. For more information, see Microsoft Knowledge Base Article 3126041. Please also note that a second Known Issue, which includes workarounds, has been added to Microsoft Knowledge Base Article 3126587.
Summary: This bulletin summary lists security bulletins released for February 2016.

Severity Rating: Critical
Revision Note: V1.1 (February 19, 2016): Removed update 3141092 from the Affected Software table. For Internet Explorer 11, to be fully protected from the vulnerabilities described in this bulletin, customers must also install update 3141092. Microsoft recommends to first install update 3134814, and then install update 3141092. For more information about the 3141092 update, see Microsoft Knowledge Base Article 3141092. This is an informational change only.
Summary: This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Severity Rating: Critical
Revision Note: V1.1 (February 19, 2016): In the Affected Software table, removed the severity and impact entries for Internet Explorer on all applicable versions of Microsoft Windows. Internet Explorer 7 is not affected by the vulnerabilities discussed in this bulletin; however, customers running Internet Explorer 7 will still be offered the 3124275 update. Microsoft recommends that customers install update 3124275 on systems that are running Internet Explorer 7 to receive the applicable non-security fixes listed in Microsoft Knowledge Base Article 3124275. This is an informational change only.
Summary: This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Revision Note: V1.3 (February 19, 2016): For MS16-001, removed update 3124275 for Internet Explorer 7 from the Affected Software table because it is not affected by the vulnerabilities described in the bulletin. See Microsoft Knowledge Base Article 3124275 for more information. For MS16-004, added Known Issues references to the Executive Summaries table. For more information, see the following:◦Microsoft Knowledge Base Article 2920727, Microsoft Knowledge Base Article 2881029, Microsoft Knowledge Base Article 2881067, Microsoft Knowledge Base Article 3039794, Microsoft Knowledge Base Article 3124585.
Summary: This bulletin summary lists security bulletins released for January 2016.

Severity Rating: Critical
Revision Note: V1.1 (February 19, 2016): In the Affected Software table, removed the severity and impact entries for Internet Explorer on all applicable versions of Microsoft Windows. Internet Explorer 7 is not affected by the vulnerabilities discussed in this bulletin; however, customers running Internet Explorer 7 will still be offered the 3124275 update. Microsoft recommends that customers install update 3124275 on systems that are running Internet Explorer 7 to receive the applicable non-security fixes listed in Microsoft Knowledge Base Article 3124275. This is an informational change only.
Summary: This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Severity Rating: Critical
Revision Note: V1.1 (February 19, 2016): Removed update 3141092 from the Affected Software table. For Internet Explorer 11, to be fully protected from the vulnerabilities described in this bulletin, customers must also install update 3141092. Microsoft recommends to first install update 3134814, and then install update 3141092. For more information about the 3141092 update, see Microsoft Knowledge Base Article 3141092. This is an informational change only.
Summary: This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

RSA Conference 2016 is fast approaching. The conference agenda is packed to cover the rapidly evolving issues in information security, with trust in cloud computing at the forefront. We’ll be there to lead industry discussions about trust in keynotes, deep-dive sessions and the expo hall.

Since planning your itinerary is a must to get the most out of RSA, here’s a preview of where and when Microsoft Security and Trusted Cloud activities are happening.

Preconference at the CSA Summit

Monday, Feb. 29, 2 p.m.

Leap Day, leap event — if you’re attending the ancillary Cloud Security Alliance (CSA) Summit, check out Microsoft GM Doug Hauger’s Trusted Cloud keynote. He’ll share the results of a recent survey on the “trust gap” between on-premises and cloud services, and examine the factors that drive trust in security leadership thought processes when making trust decisions.

Brad Smith’s keynote

Tuesday, March 1, 8:50 a.m.

Trust in the Cloud in Tumultuous Times

We are living in extraordinary times. While the evolution of cloud computing has transformed the way we work, recent geopolitical events have precipitated debates on the roles that governments and industry should play in defending and securing society, and the appropriate balance between security, privacy and the freedom of expression. Join Microsoft President and Chief Legal Officer Brad Smith as he puts modern events into context and discusses a path forward.

Trusted Cloud in North Expo, booth 3505  

Come chat with the Trusted Cloud team at the Microsoft booth in the North Expo. We’ll be there throughout the conference to discuss trust in cloud computing and answer your questions about security, privacy, compliance and transparency.

Microsoft and Trusted Cloud sessions at RSA 2016

Monday, Feb. 29

TCG: Securing the IoT With Trusted Computing 8:30 a.m.–12:30 p.m.

The root of security in the Internet of Things begins with trust, including trusted device identity and secure communications with protection of sensitive information. These foundational elements must come together to provide a more secure IoT solution. In this half-day RSA Conference session, you’ll hear from Microsoft Software Architect Paul England and industry leaders and see demonstrations of IoT security in action.

Wednesday, March 1

Hot Topics in Privacy: A Conversation with Adobe, Google and Microsoft  1:10 PM – 2:00 PM

Rapid expansion of social media, mobile devices, sharing culture and the Internet of Things pushed privacy to the top of consumers’ minds. With a pending European Data Protection Regulation, consumers want control of their data and breaches. There is no end to privacy issues facing society. Join privacy leaders from Google, Adobe and Microsoft as they explore the hot topics facing the industry.

Bringing Cybersecurity to the Boardroom 3:30 PM – 4:20 PM

As cybersecurity becomes a more pressing issue to the enterprise, security leaders are finding themselves presenting cybersecurity risks and strategies to a new group: the board of directors. Microsoft CVP and CISO Bret Arsenault will share his learnings on working with boards to provide the right level of risk awareness and to drive informed investments for an enterprise-level cybersecurity program.

Wednesday, March 2

Machine Learning and the Cloud: Disrupting Threat Detection and Prevention 10:20–11:10 a.m.

Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Mark Russinovich, chief technology officer for Microsoft Azure, will explain how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers. Learn about the application of data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services.

SaaS Attacks Happen: How cloud scale changes the security game 10:20 AM – 11:10 AM

Gain insights into how cloud security engineering is evolving to not only meet the unique risks of SaaS, but to leverage the advantages that this scale and uniformity can offer. Take a behind-the-scenes look at how Office 365 applies these unique SaaS security principles to protect hosted users and organizations from breach

Tracking Hackers on Your Network With Sysinternals Sysmon 11:30 a.m.–12:20 p.m.

Sysinternals Sysmon is an advanced system monitoring service that logs file manipulation, process and image loading, and other events that can be used to identify the presence of an attacker. Microsoft Azure CTO Mark Russinovich continues his RSA teaching tour with tips and tricks that will help you get the most out of this powerful hacker hunting tool.

Using Cloud-Scale Intelligence to Address Security Challenges 11:30 a.m.–12:20 p.m.

The rise of the cloud brings a new wave of evolution in security challenges. Microsoft CVP and CISO Bret Arsenault and Julia White, Cloud Platform general manager, will suggest new approaches that users and providers of cloud services can take to secure cloud platforms. They’ll examine Microsoft’s role in the world of cloud security, explain how to use cloud-scale security intelligence to improve protection, and discuss how to work with partners to enable additional security tools.  

Thursday, March 3

Managing Complex M&A Security Risks — A Detailed Case Study 9:10–10 a.m.

In this informative talk, Microsoft Director of Information Security & Risk Management Ahmad Mahdi will walk through the step-by-step approach one information security organization took to secure a massive acquisition with a global footprint. The acquisition included thousands of new employees and a myriad of technical, geopolitical and financial considerations.

Deconstructing Identity in Security 9:10–10 a.m.

Identity experts from across the industry — including Kim Cameron, Microsoft chief identity architect and distinguished engineer — will tackle tough questions and offer unique points of view on the role identity plays in security. They will deconstruct what identity means to security by sharing how their companies are building identity into the most popular cloud services in the world, and by showing what can be done to strengthen identity in a borderless world.

Data Classification—Reclaiming Infosec’s Redheaded Stepchild   9:10 AM – 10:00 AM

This session will explore the changing role data classification plays in data centric security and why security teams need to own the process.

Cloud Attacks Illustrated: Insights From the Cloud Provider 11:30 a.m.–12:20 p.m.

The past five years has seen remarkable growth in cloud services, and the trend is only growing stronger. As expected, attackers have been fast to respond and adapt attacks to cloud computing trends. Microsoft’s Craig Nelson, Azure security response manager, and Tomer Teller, senior security research PM, will show you the latest attack surfaces, trends, statistics and vectors that Microsoft has gathered from its own public cloud infrastructure.

Cloud Attacks Illustrated: Insights From the Cloud Provider (Focus-On) 2:10–3 p.m.

Continue the Cloud Attacks Illustrated: Insights from the Cloud Provider topic in a smaller group discussion and Q&A with Craig and Tomer. Note that this discussion-based session is limited to 50 attendees and no new slides will be presented. Admission to this session is first come, first served, so make sure to check the RSA program for scheduling details.

Managing Complex M&A Security Risks — A Detailed Case Study (Focus-On) 2:10–3 p.m.

Continue the earlier Managing Complex M&A Security Risks conversation in a smaller group with Q&A with Ahmad Mahdi. As noted in the Focus-On session above, attendance is limited to 50 and no new slides will be presented. Check the RSA program for details about Focus-On sessions.

Managing Complex M&A Security Risks – A Detailed Case Study (Discussion Session)  2:10 PM – 3:00 PM

Continue the Managing Complex M&A Security Risks – A Detailed Case Study conversation in a smaller group discussion and Q&A with the presenter. This session will be discussion based—no new slides will be presented. This session is limited to 50 attendees. Adding a session to your Schedule does not guarantee you a seat. Admission to this session is on a first come, first served basis.

RSA Conference 2016 is fast approaching. The conference agenda is packed to cover the rapidly evolving issues in information security, with trust in cloud computing at the forefront. We’ll be there to lead industry discussions about trust in keynotes, deep-dive sessions and the expo hall.

Since planning your itinerary is a must to get the most out of RSA, here’s a preview of where and when Microsoft Security and Trusted Cloud activities are happening.

Preconference at the CSA Summit

Monday, Feb. 29, 2 p.m.

Leap Day, leap event — if you’re attending the ancillary Cloud Security Alliance (CSA) Summit, check out Microsoft GM Doug Hauger’s Trusted Cloud keynote. He’ll share the results of a recent survey on the “trust gap” between on-premises and cloud services, and examine the factors that drive trust in security leadership thought processes when making trust decisions.

Brad Smith’s keynote

Tuesday, March 1, 8:50 a.m.

Trust in the Cloud in Tumultuous Times

We are living in extraordinary times. While the evolution of cloud computing has transformed the way we work, recent geopolitical events have precipitated debates on the roles that governments and industry should play in defending and securing society, and the appropriate balance between security, privacy and the freedom of expression. Join Microsoft President and Chief Legal Officer Brad Smith as he puts modern events into context and discusses a path forward.

Trusted Cloud in North Expo, booth 3505  

Come chat with the Trusted Cloud team at the Microsoft booth in the North Expo. We’ll be there throughout the conference to discuss trust in cloud computing and answer your questions about security, privacy, compliance and transparency.

Microsoft and Trusted Cloud sessions at RSA 2016

Monday, Feb. 29

TCG: Securing the IoT With Trusted Computing 8:30 a.m.–12:30 p.m.

The root of security in the Internet of Things begins with trust, including trusted device identity and secure communications with protection of sensitive information. These foundational elements must come together to provide a more secure IoT solution. In this half-day RSA Conference session, you’ll hear from Microsoft Software Architect Paul England and industry leaders and see demonstrations of IoT security in action.

Wednesday, March 1

Hot Topics in Privacy: A Conversation with Adobe, Google and Microsoft  1:10 PM – 2:00 PM

Rapid expansion of social media, mobile devices, sharing culture and the Internet of Things pushed privacy to the top of consumers’ minds. With a pending European Data Protection Regulation, consumers want control of their data and breaches. There is no end to privacy issues facing society. Join privacy leaders from Google, Adobe and Microsoft as they explore the hot topics facing the industry.

Bringing Cybersecurity to the Boardroom 3:30 PM – 4:20 PM

As cybersecurity becomes a more pressing issue to the enterprise, security leaders are finding themselves presenting cybersecurity risks and strategies to a new group: the board of directors. Microsoft CVP and CISO Bret Arsenault will share his learnings on working with boards to provide the right level of risk awareness and to drive informed investments for an enterprise-level cybersecurity program.

Wednesday, March 2

Machine Learning and the Cloud: Disrupting Threat Detection and Prevention 10:20–11:10 a.m.

Machine learning with large data sets gives unprecedented insights and anomaly detection capability. Mark Russinovich, chief technology officer for Microsoft Azure, will explain how Microsoft uses the agility and scale of the cloud to protect its infrastructure and customers. Learn about the application of data mining and machine learning algorithms and security domain learnings to the vast amounts of data and telemetry gathered by its many different systems and services.

SaaS Attacks Happen: How cloud scale changes the security game 10:20 AM – 11:10 AM

Gain insights into how cloud security engineering is evolving to not only meet the unique risks of SaaS, but to leverage the advantages that this scale and uniformity can offer. Take a behind-the-scenes look at how Office 365 applies these unique SaaS security principles to protect hosted users and organizations from breach

Tracking Hackers on Your Network With Sysinternals Sysmon 11:30 a.m.–12:20 p.m.

Sysinternals Sysmon is an advanced system monitoring service that logs file manipulation, process and image loading, and other events that can be used to identify the presence of an attacker. Microsoft Azure CTO Mark Russinovich continues his RSA teaching tour with tips and tricks that will help you get the most out of this powerful hacker hunting tool.

Using Cloud-Scale Intelligence to Address Security Challenges 11:30 a.m.–12:20 p.m.

The rise of the cloud brings a new wave of evolution in security challenges. Microsoft CVP and CISO Bret Arsenault and Julia White, Cloud Platform general manager, will suggest new approaches that users and providers of cloud services can take to secure cloud platforms. They’ll examine Microsoft’s role in the world of cloud security, explain how to use cloud-scale security intelligence to improve protection, and discuss how to work with partners to enable additional security tools.  

Thursday, March 3

Managing Complex M&A Security Risks — A Detailed Case Study 9:10–10 a.m.

In this informative talk, Microsoft Director of Information Security & Risk Management Ahmad Mahdi will walk through the step-by-step approach one information security organization took to secure a massive acquisition with a global footprint. The acquisition included thousands of new employees and a myriad of technical, geopolitical and financial considerations.

Deconstructing Identity in Security 9:10–10 a.m.

Identity experts from across the industry — including Kim Cameron, Microsoft chief identity architect and distinguished engineer — will tackle tough questions and offer unique points of view on the role identity plays in security. They will deconstruct what identity means to security by sharing how their companies are building identity into the most popular cloud services in the world, and by showing what can be done to strengthen identity in a borderless world.

Data Classification—Reclaiming Infosec’s Redheaded Stepchild   9:10 AM – 10:00 AM

This session will explore the changing role data classification plays in data centric security and why security teams need to own the process.

Cloud Attacks Illustrated: Insights From the Cloud Provider 11:30 a.m.–12:20 p.m.

The past five years has seen remarkable growth in cloud services, and the trend is only growing stronger. As expected, attackers have been fast to respond and adapt attacks to cloud computing trends. Microsoft’s Craig Nelson, Azure security response manager, and Tomer Teller, senior security research PM, will show you the latest attack surfaces, trends, statistics and vectors that Microsoft has gathered from its own public cloud infrastructure.

Cloud Attacks Illustrated: Insights From the Cloud Provider (Focus-On) 2:10–3 p.m.

Continue the Cloud Attacks Illustrated: Insights from the Cloud Provider topic in a smaller group discussion and Q&A with Craig and Tomer. Note that this discussion-based session is limited to 50 attendees and no new slides will be presented. Admission to this session is first come, first served, so make sure to check the RSA program for scheduling details.

Managing Complex M&A Security Risks — A Detailed Case Study (Focus-On) 2:10–3 p.m.

Continue the earlier Managing Complex M&A Security Risks conversation in a smaller group with Q&A with Ahmad Mahdi. As noted in the Focus-On session above, attendance is limited to 50 and no new slides will be presented. Check the RSA program for details about Focus-On sessions.

Managing Complex M&A Security Risks – A Detailed Case Study (Discussion Session)  2:10 PM – 3:00 PM

Continue the Managing Complex M&A Security Risks – A Detailed Case Study conversation in a smaller group discussion and Q&A with the presenter. This session will be discussion based—no new slides will be presented. This session is limited to 50 attendees. Adding a session to your Schedule does not guarantee you a seat. Admission to this session is on a first come, first served basis.

Severity Rating: Critical
Revision Note: V2.0 (February 16, 2016): Bulletin revised to announce that the 3134241 update is available for Microsoft Office 2016 for Mac, and the 3137721 update is available for Microsoft Office for Mac 2011. For more information, see Microsoft Knowledge Base Article 3134241 and Microsoft Knowledge Base Article 3137721.
Summary: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Revision Note: V3.0 (February 16, 2016): For MS16-015, added the 3134241 update for Microsoft Office 2016 for Mac, and the 3137721 update for Microsoft Office for Mac 2011, which are available as of February 16, 2016. For more information, see Microsoft Knowledge Base Article 3134241 and Microsoft Knowledge Base Article 3137721.
Summary: This bulletin summary lists security bulletins released for February 2016.

Revision Note: V3.0 (February 16, 2016): For MS16-015, added the 3134241 update for Microsoft Office 2016 for Mac, and the 3137721 update for Microsoft Office for Mac 2011, which are available as of February 16, 2016. For more information, see Microsoft Knowledge Base Article 3134241 and Microsoft Knowledge Base Article 3137721.
Summary: This bulletin summary lists security bulletins released for February 2016.

Severity Rating: Critical
Revision Note: V2.0 (February 16, 2016): Bulletin revised to announce that the 3134241 update is available for Microsoft Office 2016 for Mac, and the 3137721 update is available for Microsoft Office for Mac 2011. For more information, see Microsoft Knowledge Base Article 3134241 and Microsoft Knowledge Base Article 3137721.
Summary: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Severity Rating: Critical
Revision Note: V1.1 (February 12, 2016): Revised bulletin to add links to update 3135782 on the Download Center for Windows 8.1 for 32-bit Systems, Windows 8.1 for x64-based Systems, Windows Server 2012, and Windows Server 2012 R2. This is an informational change only. Customers who have already successfully installed the update do not need to take any further action.
Summary: This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows 10 Version 1511. For more information, see the Affected Software section. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10, Internet Explorer 11, and Microsoft Edge.