Netsec

Bank-grade Security - Next Gen Thought Leader

[Netsec @NetsecSE]

@TenantIQ checklist

[Netsec @NetsecSE]

@fabian_bader @N805DN Do you know if CA policies can be set to only allow TAPs for 1) Pwd/MFA resets and 2) Autopilot fresh machine and set up WHfB? (Don't see why you would ever want to allow TAPs for anything else)

[Netsec @NetsecSE]

@stokfredrik Are you on YesWeHack?

[Netsec @NetsecSE]

@weggles @SwiftOnSecurity Victim blaming users for clicking links is ridiculous and a misdirected effort of spreading "awareness".

[Netsec @NetsecSE]

@HackingLZ But if someone snatches passwords via some infostealer having yearly password rotations is a very very slim mitigation for lacking MFA. On average the attacker will have 6 months to use that password. MFA is a must for everything unless access is severely limited somehow.

[Netsec @NetsecSE]

Windows Server 2028 will include mandatory "Azure NTP", giving you modern cloud time sync capabilities for only $1/month/server.

[CJ @N805DN]

So long WSUS!

Hope everyone has $5/month/server in their budget for Azure patch management. A service that previously was available for $0/server through Azure Automation.

https://t.co/giBet5GqMz

[Netsec @NetsecSE]

@PyroTek3 @MCTTP_Con Fantastic, thanks!

[Netsec @NetsecSE]

@fabian_bader @JanVidarElven Any video available?

[Netsec @NetsecSE]

@duanegran @wimremes Don't think the question refers to TOTP (which is an open standard), but to the 2-digit code used when doing passwordless sign in with MS Authenticator.

[Netsec @NetsecSE]

@HackingLZ I understand why those titles are red flags for him since they are usually the type of people most able to see through the type of junk he seems to peddle.

[Netsec @NetsecSE]

@coulls @SwiftOnSecurity This doesn't filter for binaries but will include all files file writes MDE registers. Also only shows most recent file during the time window of the search. Not first time ever a file was seen.

[Netsec @NetsecSE]

@WellKnitTech @GossiTheDog Yeah. I'm not affected, just pointing out that a cyber insurance can potentially cover various types of outages, not only those due to attacks. But considering the scale I have a feeling insurance companies will find ways to avoid payments.

[Netsec @NetsecSE]

@WellKnitTech @GossiTheDog Cyber insurances can cover various outages and disruptions, not only attacks.

[Netsec @NetsecSE]

@0x44dt Could you specify the SMTP part? You got outbound connection from target?

[Netsec @NetsecSE]

@jeremymoskowitz @MEM_MVP Would requiring third party kernel drivers to be written in Rust be an unreasonable ask? (Know this would only solve one type of bugs, but still)

[Elli @ellishlomo]

While #CrowdSrtike had a massive outage, CISOs and many security managers asked me about delaying updates in Microsoft Defender.

This article discusses these possibilities in MDAV and MDI. Still, you should decide what is best for your organization and technological environment.

https://t.co/hhHXOwiI33

[Netsec @NetsecSE]

@jfslowik Well, see lots of articles blaming MSFT for the CRWD issues. Azure was bad but at least fixed by MS themselves.

[Netsec @NetsecSE]

@JimSycurity @SamErde Good point. I guess setting prod servers to 'Critical' and most pre-prod to 'Current Channel (Broad)' with a few at '(Staged)' could be good. Hope is that MS would identify and fix bad updates before reaching our servers.

[Netsec @NetsecSE]

@IPv6_mannen Finns en del argument för SPF softfail om DMARC är korrekt konfigurerat:

https://t.co/AOyqsazidP