Mark Sewell

I work as an InfoSec and Infrastructure specialist living in the U.K. In my spare time, I enjoy football and boxing! All views expressed here are my own.

[Mark Sewell @MarkSewe]

@techspence @KeithRamphal @UK_Daniel_Card Silver fort is one example, you can use Entra GSA to MFA on AD RDP etc

[Mark Sewell @MarkSewe]

@techspence Companies need to evolve VM to be exposure management! With an expectation not everything can be patched and it shouldn’t need to be, focus on attack paths and where you can cut off attacks most effectively. Then review compensating controls and risk acceptance!

[Mark Sewell @MarkSewe]

@Olexio1 @BowenBoxing So washed

[Mark Sewell @MarkSewe]

@lucky_tunchi @Mobolaji_Abdul1 Madrid created chances for sure, but the xG for Bayern is much higher as they created better chances. Hence my comment.

[Mark Sewell @MarkSewe]

@GelosSnake @UK_Daniel_Card @mthcht2 It’s not in E5, you need the VM management addon which is an E5 bolt on…

[Mark Sewell @MarkSewe]

@IAMERICAbooted Can you find a partner in crime, someone like minded from a team that also likes to get stuff done? I’ve found that works, also raising issues to your CISOs or boss, if it’s a niche no one is owning can you claim it and drive resolution?

[Mark Sewell @MarkSewe]

@UK_Daniel_Card @akses_0x00 Turn off all the automated summaries in settings / copilot. We had it summarising everything for all SOC analysts every time someone entered an incident.. thankfully they fixed it.

[Mark Sewell @MarkSewe]

@ainp0t @NathanMcNulty @IAMERICAbooted How are you monitoring this via entra idp or XDR? I think they gave some options to suppress lower fidelity detections within XDR. Which could explain what you are seeing.

[Mark Sewell @MarkSewe]

@NathanMcNulty @duosec @IceSolst @CRXaminer It's a real shame that Microsoft paywall the browser extension controls, behind the VM addon...

[Mark Sewell @MarkSewe]

@UnitedStandMUFC I wonder how much hinges on a top 4 finish..

[Mark Sewell @MarkSewe]

@_xDeJesus @NathanMcNulty @merill @fabian_bader Feels like a step in the right direction, sadly its too broad and captures all app consent granted within the tenant. I struggled to see any identifier that highlighted the consent came from Implicit grant flow :-s

[Mark Sewell @MarkSewe]

I'm trying to determine how widespread usage of Implicit Grant flow is, has anyone determined a good way to identify this from the entra portal / KQL? @NathanMcNulty @merill @fabian_bader any ideas?

[Mark Sewell @MarkSewe]

@Vincent_Teoh Sony are broke I guess 🤷‍♂️

[Mark Sewell @MarkSewe]

@Kostastsale Totally get it, my point was more collecting data is great. But it’s only useful if insightful and usable. Ticking a collection box is one thing, it leading to a detection, response action or supporting an investigation are somewhat different.

[Mark Sewell @MarkSewe]

@Mister_MDM @itlararenJesper what about MDE-Attach managed devices, any experience with policy updates there?

[Mark Sewell @MarkSewe]

@techspence Needs buy in from top down. Passwordless w/ Authenticator and WhfB super simple and a rare win.. for both usability and security. Level set it’s less passwords initially with passwordless the destination

[Mark Sewell @MarkSewe]

@IAMERICAbooted APT just goes to the file server and picks up someone’s password from the password.txt they shared on the drive to EVERYONE

[Mark Sewell @MarkSewe]

@techspence Totally, however inspection is becoming harder and harder with TLS1.3. Also devices are less frequently on corp networks due to hybrid working. Of course you still need to have inspections there too