Sebocat

#InfoSec #Bluehat #SystemEngineer - loves #Deep #Tech #House #Techno

Mastodon:

[Sebocat @Sebocat]

Some #deep #tech #house #music from my last gig @ Superfreak - Club Auslage, Vienna - enjoy ☺️ https://t.co/YYP2syoavG #SoundCloud

[AppControl.ai @Appcontrolai]

This is a weekly reminder that users (nor agents) should hold the privilege to run unvetted code from anywhere. It's the single biggest mistake orgs have made and keep making against the principle of least privilege. The time to start controlling what code to allow is now! #acfb

[Sebocat @Sebocat]

@NathanMcNulty I also like the built-in browser rendering, no need for Adobe, PDF X-Change would also be an alternative ☺️ but if Adobe is in use, wouldn't App Control mitigate an attack with that CVE? Not sure if AppLocker could do it, too

[Sebocat @Sebocat]

@wdormann @NathanMcNulty @TheWMIGuy @arekfurt Are these VMs Domain-Joined or EntraID-Joined? "Smart App Control is disabled on devices enrolled in enterprise management. We suggest enterprises running line-of-business applications continue to use App Control for Business." https://t.co/VJWWM7W0eJ

[Sebocat @Sebocat]

@TheWMIGuy @NathanMcNulty So without the ISG option it would be blocked or would Store Apps still be able to be installed (supposing that winget is not deactivated/controlled per GPO)? As i remember there is the additional option "Enforce Store Applications" in App Control Policies?

[Sebocat @Sebocat]

@techspence Would be awesome if every company would just implement the official MS Edge Security baseline, where browser extensions are blocked by default ☺️

[Sebocat @Sebocat]

@UK_Daniel_Card UnigetUI is excellent - i use it as managed installer in App Control (fka WDAC) ☺️

[Sebocat @Sebocat]

@UK_Daniel_Card @therealshodan Yeah, good advice, thank you!

[Sebocat @Sebocat]

@UK_Daniel_Card @therealshodan One question - if DEVs only updated over WinGet, should it be safe? Because Winget always got it from GitHub, but not sure if that was a 'safer' update path? 😵‍💫

[Sebocat @Sebocat]

@UK_Daniel_Card @therealshodan Thanks for all the infos here, and very interesting and excellent conclusion 😎 i use VS Code instead of Notepad++ for nearly 2 years, did not regret it...

[Sebocat @Sebocat]

@KI_NunoCarvalho @IAMERICAbooted It's still possible with Intune as Managed Installer and the default baseline from MS, Pahrules Supplemental Policy to Program Files, Program Data and Windows Folders, and installing software with a managed installer like Intune, ConfigManager, UnigetUI - depends on usecases ☺️

[Sebocat @Sebocat]

@IAMERICAbooted From my AppLocker experience since nearly 12 years i can confirm, that it was a very painful and long way to get it in enforced state 😄 the most important thing is to have a dedicated team for packaging and deployment

[Sebocat @Sebocat]

@UK_Daniel_Card @m0bilej0n @Mister_MDM @en4rab You're right 😄 seems that security baselining for Windows is not his favorite topic 😅

[Sebocat @Sebocat]

@UK_Daniel_Card @m0bilej0n @Mister_MDM @en4rab Wow, does this guy in the video really recommend to basically turn off secure boot, credential guard, HVCI or Windows Hello (for Business) in Windows 11? Or device based PKI-certificates binded to TPM for Always-On VPNV2? Very interesting 😃

[Sebocat @Sebocat]

@UK_Daniel_Card @KeithRamphal @IAMERICAbooted @DebugPrivilege OMG - wrong 🤣🤣🤣🤣

[Sebocat @Sebocat]

@UK_Daniel_Card @IAMERICAbooted @DebugPrivilege Yeah, i know that DAs hate PAWs and worldwide not many will use them 😂 it was very hard work to implement this in our company, but after years passed by, they learned to cope with it ☺️

[Sebocat @Sebocat]

@UK_Daniel_Card @IAMERICAbooted @DebugPrivilege Well, at least every AD Domain Admin should also know how to use and implement a Tier0 PAW - if he wants to get hired 😋

[Sebocat @Sebocat]

@NathanMcNulty And with App Control you're safe because of the default enabled feature 'Runtime FilePath Rule Protection' ☺️

[Sebocat @Sebocat]

@MyNameIsMurray @CyberCakeX @NathanMcNulty @CynicLib App Control with managed installer is one of the best features, ISG is interesting, too. We additionally test UnigetUI as another managed installer for a DEV scenario, works perfect. And App Control Manager from @CyberCakeX is an amazing tool, highly recommended 👌🏻

[Sebocat @Sebocat]

@NathanMcNulty Hello is one of the best things Microsoft ever invented ☺️ i read that ESS should also be possible for external devices (only fingerprint i suppose) in the future 😊 https://t.co/OtEV7DppgQ