Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/12/2019
02:45 PM
50%
50%

German Schools Ban Office 365, Cite Privacy Concerns

The ruling follows years of debate over whether German schools and institutions should use Microsoft tools and services.

The German state of Hesse has ruled it's illegal for its schools to use Office 365 after years of debate over whether the country's schools and institutions should use Microsoft tools at all.

The Hesse Office for Data Protection and Information Freedom says the standard configuration in Office 365 could potentially make students' and teachers' personal data available to US officials, ZDNet reports. In addition to the information that users provide when they're working in Office 365, the platform sends telemetry data back to the US. Germany's Federal Office for Information Security also has expressed concern about telemetry data sent by the Windows OS.

European concerns about data transmitted to the US are not new. The Dutch government has already found Microsoft software in violation of the General Data Protection Regulation (GDPR) and published a report citing concerns about data collection in Microsoft Office ProPlus. Germany's federal association of municipal IT service providers also has complained that citizen information recorded in Office 365 could fall under surveillance when in the US.

It's difficult for Germany to abandon Microsoft products because there aren't many alternative options. Government officials are calling for the development of domestic cloud services, and ongoing lawsuits will determine the future of rules regarding the transfer of data to the US.

While those move through the courts, and while the German government works with Microsoft on a potential solution, German schools will not be using Office 365. Hesse's privacy commissioner suggests they instead adopt similar tools with on-premise licenses.

Read more details here.

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
7/12/2019 | 7:39:08 PM
Disable Telemetry information sent to Microsoft
I think it is a simple fix:

PowerShell Registry changes to disable data collection


$dc = "HKLM:/SOFTWARE/Policies/Microsoft/Windows/DataCollection"

$regname = "AllowTelemetry"

$at = (Get-ItemPropertyValue -Path $dc -Name $regname)

$loc = Test-Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry

if ( ($loc -eq 'True' ) -and ( $at -eq 1 ) ) {
Write-Host "AllowTelemetry setting is set correctly: " $at
} else {
New-Item -Path $dc -Name $regname -Value 1 -Type "Dword" -Force -ErrorAction SilentlyContinue
Set-ItemProperty -Path $dc -Name $regname -Value 1 -Type "Dword" -Force -ErrorAction SilentlyContinue
$atval = Get-ItemPropertyValue -Path $dc -Name $regname -ErrorAction SilentlyContinue
}

Todd
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...