Matt Swann

VP & Distinguished Engineer, Security at Microsoft. Chief Security Architect, OneDrive + SharePoint. Likes = bookmarks not endorsements

[Matt Swann @MSwannMSFT]

Version 0.4 of the Incident Response Hierarchy of Needs, now on GitHub: https://t.co/NECCTxMDG4 cc @nselby @FeMaven @NateBeachW

[John Lambert @JohnLaTwC]

It started with an X on a map.

I had hiked this valley many times before, but this was new. The map showed routes leading to this place. What was it?

[Matt Swann @MSwannMSFT]

@JohnLaTwC Nicely done! Slides look great, looking forward to the recording.

[Matt Swann @MSwannMSFT]

AMSI integration is now enabled by default on SharePoint Server 2016, 2019, and Subscription Edition: https://t.co/rPld3oUa6Y

[Matt Swann @MSwannMSFT]

Security is like retirement:
- you need to be investing monthly,
- the best time to start investing is now,
- investments bear compound interest over time,
- the effectiveness of “catch up contributions” is limited

[John Breth (JB) | CyberInsight® on YouTube @JBizzle703]

What's your unpopular cybersecurity opinion that gets a reaction like this?

[Matt Swann @MSwannMSFT]

@JohnLaTwC Love that bridge!

[Florian Roth ⚡️ @cyb3rops]

Once you have seen which events are delivered in #ETW channels, the events from the normal event logs will never be enough, no matter how verbose the audit policy is set

[Matt Swann @MSwannMSFT]

@NCSC @ollieatnowhere Congratulations Ollie!!

[Ram Shankar Siva Kumar @ram_ssk]

📢The Microsoft AI Red Team is hiring across all levels!
Your area can be Adversarial ML or Responsible AI or Pen testing, and you will fit right in!

Questions? DM always open

Junior: https://t.co/LhUulLU27C

Senior: https://t.co/2wSxoQiBuu

Principal: https://t.co/6NkKUkVPzX

[Matt Swann @MSwannMSFT]

@radicalbyte @dwizzzleMSFT This is the way ⬆️

[Matt Swann @MSwannMSFT]

@HackingLZ Would the dynamics change if red didn’t have to spend time gaining an initial foothold?

Unless the focus is explicitly on finding new ways in, I’m a big fan of giving red an implant in whatever system they want and letting them go from there.

[Matt Swann @MSwannMSFT]

@JohnLaTwC @royalhansen John and I kept an eye out for Yamadori bonsai on the trail — this one is clearly too big but the natural twist is kind of fascinating. No idea how this happens in nature!

[Matt Swann @MSwannMSFT]

@JohnLaTwC This was an adventure of a lifetime! Couldn’t have done it without you. And thank you @ram_ssk for supporting and encouraging us!

[John Lambert @JohnLaTwC]

Today @MSwannMSFT and I completed our hike of a section of the Pacific Crest Trail. Huge thanks to @ram_ssk for giving us a lift to the trailhead. Here is what we experienced 👇

[Matt Swann @MSwannMSFT]

1/ A few weeks ago I gave a talk about how Security Fundamentals functions across the OneDrive + SharePoint organization. A short thread 🧵 on how we framed this topic and what we believe success looks like in our engineering organization:

[Matt Swann @MSwannMSFT]

@SwiftOnSecurity @philvenables The final thing I’d leave you with: detection is a compensating control. “Compensating” implies that it’s in lieu of something better!

Don’t settle for a highly-monitored environment full of risk. DO detect a cut finger in milliseconds, but also - remove the sharp edges!

[Matt Swann @MSwannMSFT]

@SwiftOnSecurity I have lots to say about controls, but @philvenables has covered it in great deal. This is a fabulous place to start: https://t.co/XInWt6waRQ