David Mosher

#infosec #financialservices #cybersecurity, CEO Rhindon Cyber, MS in Cybersecurity - current PhD student in Cybersecurity Management. vCISO

[David Mosher @dave_mosher]

86x - that's how much @ManGroup's token usage jumped this year — across finance, ops, and HR, not just engineering.

RAIC gives you the governance layer they had to build in-house: Shadow AI discovery, an AI system registry, and audit-ready evidence — live in minutes, not a 15-person platform team.

Try RAIC free for 14 days.

https://t.co/aKQ9NRCYzL #AIGovernance #SMB

[Department of State @StateDept]

SECRETARY RUBIO: "This is a distinctive and unique evil. It has always been driven by a hatred, above all else, for civilization itself."

[David Mosher @dave_mosher]

One Control, Many Frameworks: Why a Control Registry Is the Only Way Out of Compliance Sprawl - https://t.co/WSaH86oto2

[David Mosher @dave_mosher]

Check out the latest article in my newsletter: Pull One Thread: Why Business Use Cases, Not Systems, Should Drive Your Security and AI Program https://t.co/zAHDokKkwB via @LinkedIn

[David Mosher @dave_mosher]

@FastCompany Both problems are symptoms of the same root cause — no AI governance layer. No policy, no approved tool list, no visibility into what's actually being used. Shadow AI is a org-wide risk hiding in plain sight. Rhindon RAIC fixes this. https://t.co/OT01wG6JRb

[David Mosher @dave_mosher]

Passwordless Protects When It Rains Adversaries https://t.co/3rPJfVPML3

[David Mosher @dave_mosher]

Check out the latest article in my newsletter: Investors Need GREAT Cybersecurity Due Diligence https://t.co/D3EyenoEpg via @LinkedIn

[David Mosher @dave_mosher]

@hak5darren Ordered!

[David Mosher @dave_mosher]

This expiration policy is based on research that demonstrates users will simply change a letter or rearrange existing bad/compromised/easy to crack passwords if they are forced to change them regularly.

[David Mosher @dave_mosher]

Day 7 Intune MUST Have Policies- FINAL TIP

Ensure the 'Password expiration policy' is set to 'Set passwords to never expire’

Credential abuse remains a top threat in 2025.

Passkeys are promising, but passwords are still around.

[David Mosher @dave_mosher]

This policy should be paired with watching for Windows Event 4722 – which signals reactivation of a disabled account. Additionally, there have been multiple 2025 breaches involving guest accounts in EntraID as well.

[David Mosher @dave_mosher]

Day 6 Intune MUST Have Policies

Disable the Guest account.

The guest account can be used for lateral movement. It might be ignored by Security Operations Centers looking for anomalous account activity because the Guest account is a legitimate account.

[David Mosher @dave_mosher]

Day 5 Intune MUST Have Policies

Block JavaScript or VBScript from launching downloaded executable content.

The 2025 ClickFix social engineering threat uses JavaScript and VBScript to execute downloaded PowerShell payloads after deceiving users, as highlighted by Microsoft and security analysts.

[David Mosher @dave_mosher]

The impact of not having an SPF record (or misconfiguring it) includes:

1. Attackers easily sending spoofed emails claiming to be from your domain.
2. Increased risk of phishing and business email compromise.
3. Legitimate emails potentially ending up in recipients’ spam folders, hurting business communications.

[David Mosher @dave_mosher]

Day 4 InTune MUST Have Policies

Ensure that Sender Policy Framework (SPF) records are published for all Exchange Domains. Credential abuse is in the top 3 initial access vectors for 2024. Locking down Exchange with SPF is important to protect the integrity of email messages from your organization.

[David Mosher @dave_mosher]

Day 3 InTune MUST Have Policies

Enable Microsoft Entra ID Identity Protection sign-in risk policies. Conditional access policies for risky users evaluate whether a specific login request might not be initiated by the account owner.

Part of the defense against a February 2025 attack by a Russian backed threat actor (Storm-2372) was to implement risky sign-in conditional access policies.

[David Mosher @dave_mosher]

Day 2 InTune MUST Have Policies

Ensure multifactor authentication is enabled for all users.

Passwords suck – and multifactor should be required for every user in a mid-sized company. Disallow SMS/text authentication, require an authenticator app. Authenticator apps are more secure.

https://t.co/VEhRASLeq1