Ruan Kotzé 🇳🇦

Microsoft Security | Check Point MVP | Risk Wrangler | Leader of an amazing team. Still addicted to getting hands-on with tech.

[Ruan Kotzé 🇳🇦 @namitguy]

@rafal_fitt @SwiftOnSecurity Massive fan of the Open Intune Baseline (OIB) project myself. Beats the socks of any of pre-built MS stuff IMO.

[Ruan Kotzé 🇳🇦 @namitguy]

@cjk365 @SwiftOnSecurity True. Reality is if you deploy out of the box with what one would consider fairly optimal and secure settings WITHOUT tuning there's a large chance of breaking existing software / processes. Just a decent ASR deployment alone takes months (if not> 1 year) of iterating.

[Ruan Kotzé 🇳🇦 @namitguy]

@SwiftOnSecurity MS does need to do a better job explaining requirements though, eg. Containment requires Standard Discovery, BAFS require file submission, automation configured in Device Groups, Agent protection requires Beta channel etc. Onus on us to know our tools though.

[Ruan Kotzé 🇳🇦 @namitguy]

@SwiftOnSecurity Add "Cloud Plus" protection level, enable File Submission plus a set of well tuned ASR policies (the likes of Block Executable Files with Prevalence...) and MDE P2 becomes such a formidable ally on its own. You have to see things like AAD and BAFS in action to appreciate it.

[Ruan Kotzé 🇳🇦 @namitguy]

@TheRealShiroe @NathanMcNulty You do have the ability to set seperate automation levels per device group. It's pretty surgical though in my experience, worst I've seen was a ClickFix'd RDS box where a bunch of accounts was caught in the blast radius and contained.

[Ruan Kotzé 🇳🇦 @namitguy]

@techspence Still holding out for the companion episode to the CrowdStrike one you did a while back:-)

[Ruan Kotzé 🇳🇦 @namitguy]

@techspence Back in the Cisco ASA days we'd schedule a reboot, then do the change. If the change was successful, cancel the reboot. Crude but felt like proper resilience engineering back than:-)

[Ruan Kotzé 🇳🇦 @namitguy]

@merill Probably saying the quiet part out loud now, but it also gives security teams plausible deniability when it comes to driving through big lifts like this (as in it's not us telling you to do this, it is MS). Sad, but pushback is real and we need to choose our battles.

[Ruan Kotzé 🇳🇦 @namitguy]

@IAMERICAbooted I'm not going to pretend I understood it all, but reading through @Arie_10101's research on passkey weakness is also comforting, in the sense that it illustrates just how deep a compromise needs to go for them to be abused. Happy to be corrected on this.

[Ruan Kotzé 🇳🇦 @namitguy]

@techspence You would have to consider potential liability, as in the agent not honoring the rules of engagement. Sadly we're not Big AI where insufficient guardrails and sandboxes is a marketing feature...

[Ruan Kotzé 🇳🇦 @namitguy]

@merill Definitely not enough capital letters. Should also have an AI-generated shocked face. Perhaps also consider OBLITERATED instead of bypassed. JK but it does seem a bit baity😀

[Ruan Kotzé 🇳🇦 @namitguy]

@merill Feels like I've been fighting NTLM for the longest time. Even when appropriately configured, the controls are only as strong as the apps that honor them. It's a dumpster fire - https://t.co/lLo5Am4x8v

[Ruan Kotzé 🇳🇦 @namitguy]

@rucam365 I use the DeltaPulse MCP hooked up to a CoPilot agent. Works well and it's contextual to my environment and initiatives. Previously, keeping up was a bit like drinking from a firehose. https://t.co/Yth7dImn79

[Ruan Kotzé 🇳🇦 @namitguy]

@merill To be fair to MS I think (hope!) they counted the four components in the sentence. Which in turn makes it even more hilarious / ironic given the name of the project.

[Ruan Kotzé 🇳🇦 @namitguy]

@merill @IAMERICAbooted @guiratcom Seems your suggested fix was done, as far as security defaults go at least:-) According to the docs, since 1 July. https://t.co/YY7JKtKNSD

[Ruan Kotzé 🇳🇦 @namitguy]

@techspence Everyone has a lab...it's just that not everyone has a seperate production environment (I kid, but it does feel like that sometimes with the rapid rate of change / remediation required nowadays).

[Ruan Kotzé 🇳🇦 @namitguy]

@thefullpint @techspence In my view, it can be something as simple as proactive threat hunting, creating custom alert use cases, sharing lessons learned to lift maturity etc. It's not a high bar, but sadly some SOCs are just glorified incident reflectors with some boiler plate reporting thrown in.

[Ruan Kotzé 🇳🇦 @namitguy]

@techspence Thirdly (if I may be so bold), if you're not in charge of reporting, make sure you support and influence whoever does the reporting to focus on contextual risk as opposed to pure vulnerability counts.

[Ruan Kotzé 🇳🇦 @namitguy]

@FinanceGhost I've noticed people doing this in online meetings, asking AI what questions to ask.

Hilarious to hear people say, without irony, "here is why this is important" or "it's not <abc>, it's <xyz>" in real time.

110% accurate indicator of who you can tune out.

[Ruan Kotzé 🇳🇦 @namitguy]

@readswithravi For me, there's two, for the spiritual and the material. Man's search for meaning and Richest man in Babylon.