Mike Burns

Defend it and they will come. CISSP. CEH. @Mandiant Blueteam.

[Mike Burns @mburns7]

@Hall8Jack @Elijahjstacy really would be nice, wouldn't it?

[spencer @techspence]

Required reading for all sysadmins 🙏

[Mike Burns @mburns7]

@GergelyOrosz Weird take for a guy whos company literally profits from the fact the more we work the more we use his software. Wonder if Zoom will come out with a license model that only lets you use it 3 days a week….

[Mike Burns @mburns7]

@arekfurt Was having this same exact conversation with a co-worker last week

[Florian Roth ⚡️ @cyb3rops]

Reading Microsoft’s new Void Blizzard report, one thing stands out (again): Everything is about credential theft, phishing, and tokens. Initial access comes from buying or stealing creds - often through low-effort phishing. All the real action happens in the cloud, not on endpoints.

Gone are the days of multi-stage attacks where you’d see lateral movement, privilege escalation, or fancy malware on file servers. Now it’s just: steal creds, log in to cloud, exfiltrate data, repeat. Detection? Only possible if you have access to expensive cloud logs. No logs, no chance.

The perimeter has shifted from endpoints to identity. The detection surface shrank from your whole network down to some logs you might get from your cloud provider if you pay extra. Honestly, not sure if that’s “progress” or just shifting the visibility problem somewhere else.

[Mike Burns @mburns7]

@systemdesignone @swapnakpanda If you take notes, at what point do you go back to read them? I try to do the same but then I rarely go back and read them

[Mike Burns @mburns7]

@justin_fenton I find this impossible to believe. Palmer played Triple A ball in Rochester…an hour east of Buffalo…and never had a chicken wing?!

[Mike Burns @mburns7]

@MarcOverIP @techspence https://t.co/61qEXCAXOl

[Mike Burns @mburns7]

@merill Is it to late to rename it to “Entra the Chat”

[Mike Burns @mburns7]

@wangbin579 It’s no different than why we say hello/hi when talking on the phone . It’s to confirm receive of message and sending of message to establish communication

[Mike Burns @mburns7]

@merill I think the answer is yes based on replies, just wanna make sure :)

[Mike Burns @mburns7]

@merill To be clear, would you recommend even breaking-glass GA to use a security key?

The guidance was/is GA should be password only incase MFA or other controls are are down.

[Mike Burns @mburns7]

@cyb3rops This is how I feel about SSH Keys (long lived)

Pop a workstation, grab priv key, use everywhere

[Mike Burns @mburns7]

@NathanMcNulty I been looking for this video! I gave it a shout out in a presentation I did providing about using winfw for network segmentation https://t.co/61qEXCAXOl

[Mike Burns @mburns7]

@D_eezus @_MLFootball Source?

[Mike Burns @mburns7]

@DebugPrivilege Why even store the password? If the service breaks, simply reset the password with another GA account. Ideally the app would be set it and forget it, so no reason to record the password in a vault/pass mgr.

[Mike Burns @mburns7]

@DebugPrivilege Discussed the topic plenty of times, but advised against it. Steered them character count + dictionary checks

[Mike Burns @mburns7]

@MikeTalonNYC @matthew_d_green @jsrailton And they take security very seriously

[Mike Burns @mburns7]

@ChadWst Trust nothing. Even required either domain joined or azure ad joined devices. Still require MFA