Dor Fledel’s Post

Did you know? Microsoft Entra ID Protection helps organisations detect, investigate, and remediate identity-based risks. Leveraging signals from various sources, it identifies risky behaviors like anonymous IP usage, password spray attacks, and leaked credentials. It generates real-time risk levels for each sign-in, triggering automatic remediation actions through Conditional Access policies. Entra ID Protection also provides detailed reports on risky sign-ins and users, enabling administrators to take manual actions if needed. Data can be exported to Microsoft Sentinel for deeper analysis, enhancing overall security and compliance. Licensing requirements for Entra ID Protection is a Microsoft Entra ID P2 license. #microsoftsecurity #entraid #RyansRecaps

With the CrowdStrike mishap is just happened, and the world is on the recovery mode. On the other side, with higher financial and legal implications areincoming, there is a debate ongoing wheather this major outage is just an incident due to its awful CI/CD practice or it's a security incident either by an Insider threat or an external threat actors are responsible. With #TheCyberThrone has decoded the technical analysis of Crowdstrike aftermath details. This is happened due to the logic error resides within the C291 channel file that related to named pipes helps in preventing the C2 communication has crashed the OS which resulted in BSOD. However with respect to few of important frameworks the outage must be definitely a security incident, since it's disturbed the Availability criteria of CIA Triad. National Institute of Standards and Technology (NIST) says an incident is described as an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. European Union Agency for Cybersecurity (ENISA) says an incident occurrs and in which the availability also can be affected by local actions (destruction, disruption of power supply, etc.) – or by Act of God, spontaneous failures or human error, without malice or gross neglect being involved. Since CrowdStrike is operating in USA as HQ and it will be subjected to SEC jurisdiction, 8-K filling is imminent within 72 Hours of the incident. CrowdStrike CEO George Kurtz outplayed this incident as not a security incident, the investigation and other development are still in progress. It's wait and watch situation. But the legal battle is inline. Open for Thoughts!!!. Also in wake of this mishap, other breaches are successfully got submerged from the limelight AT&T ... 😊 #Crowdstrike #Bsod #Outage #Microsoft.

Even though it's an APT, it's often the basic stuff that gets the threat actor into the environment. While the details are not yet disclosed, APT 29, responsible for the Microsoft breach six months ago, is implicated again. This highlights a critical point: the simple things will get you. In Microsoft’s case: 1. Neglected, unused tenant with no MFA. 2. Password spray. 3. Clear text secrets in collaborative platforms. When you're as big as Microsoft, you're going to miss some things. But just because it's an APT doesn’t mean it's highly sophisticated, novel, or unavoidable. I am waiting for the details regarding this one, but my bet is it won’t be much different. Maybe some of the secrets shared over email were between TeamViewer’s IT and this Microsoft tenant 🤔 [TeamViewer's Corporate Network Was Breached in Alleged APT Hack](https://lnkd.in/dMqTZhHp)

What I learnt: Microsoft Purview can address concerns around data protection and compliance that you might have when it comes to implementing Copilot for Microsoft 365. Some key use cases include protection against Insider Threats, Data Exfiltration (possibly by a disgruntled worker), and Threat Actors. You have the flexibility to choose WHO has access to WHAT with controls and permissions, and define what "sensitive data" means to your organization. #copilotformicrosoft365 #datasecurity #purview #compliance https://lnkd.in/dKUPyEPv

In 2023, there was a dramatic spike in the number of attacks on account passwords, meaning it’s more important than ever to enable MFA. In fact, Microsoft found that with MFA enabled, you can prevent 99.9% of attacks on your accounts. Don’t wait – visit the link below to protect your data with MFA! 🔗 https://ow.ly/Y0fp50RUgLa

"According to Microsoft, the group managed to access the account in November after subjecting it to a password spray attack, a type of brute force attack where the attacker tries a large amount of logins until they succeed. The group used this foothold to access some of Microsoft’s corporate email accounts and steal some emails and attached documents." https://lnkd.in/e2miyVXB #MicrosoftHack #CybersecurityInsights #ITSecurityReads #Yourpartnerinsuccess

Microsoft has published a short, easy-to-read description of the attack chain that caused Storm-0558 to be able to create access for themselves to emails of several high-profile targets earlier this year. They went to great lengths to gain access, and this is a beautiful example of how a series of events can bypass the most advanced security guardrails. https://lnkd.in/dtJDjFqe The full blog post relating to the threat actor Storm-0558 and the incident can be found here: https://lnkd.in/dDRdHhEq #storm0558

In a new roundup of recent information security incidents, we examine two more cases of inadvertent data disclosure 🔹 Microsoft data leak due to employee error exposes 38TB of private information 🔹 Century Evergreen kept applicant data publicly available on its website for 7 years. Read more, https://lnkd.in/ekBGAvbk #SearchInform #InformationSecurit #dataleak

Did you know?...💭 Human error is still the number one cause of a data breach... But, according to Microsoft, by simply turning on MFA you can prevent 99.9% of account compromise attacks 🤯 This simple layer of extra security makes a successful attack much more difficult for malicious actors. Traditional MFA methods (like SMS) have evolved, and authenticator apps are now the go-to authenticator solution for secure access to accounts. Naturally, we recommend using the Microsoft Authenticator App🔒 📣 For organisations that want to build a strong security-first culture in their business, why not check out our up-to-date User Awareness and Training Courses: bit.ly/41S9Abm #MFA #multifactorauthentication #userawareness

Abnormal Security has broadened its scope from email protection to human behavior defense to address emerging threats around social engineering and fraud, according to CEO Evan Reiser: https://lnkd.in/ef6PynF2 "The core of our platform is understanding human behavior. We need to understand human behavior better than humans and use that to protect people. By understanding the behavioral norms of who people talk to, what time of day they work, what apps they use, and what business processes they run, that helps us identity malicious emails coming in and provide continuous monitoring of usage," Reiser told Information Security Media Group (ISMG). #ISMGnews