Category: Security

Microsoft Purview: Endpoint DLP Part 2

/ / 0 Comments / Azure, Azure Purview, MDE, SecurityTagged: , ,

In the previous article on Endpoint DLP, I presented the basic functionality of Endpoint DLP with real life examples.

In this blog post, I will now go into more depth of the different features.

I present the individual protection options with examples and screenshots.

Use case:

A member of the supervisory board, Dr. Ludwig K., works with sensitive data of level C-4.

C-4 is the most sensitive data and any leakage can severely harm the enterprise.

The naming could be different in other companies or enterprises, but the bottom line is, everything boils down to “strictly confidential”.



Continue reading

Windows Defender ATP: the lost boys – Mac & Linux

/ / 0 Comments / MDE, Security

At RSA 2019 I’ll be speaking about the Lost Boys: How Linux and Mac Intersect in a Windows-Centric Security World. We often see that Windows has such a large market share as the platform of choice, it can render Linux and Mac the Lost Boys in the world of security. This is also reinforced by the fact that the management of the two platforms for enterprise environments is simply not comparable to the administration of Windows client or server operating systems. But from the perspective of a security officer, this is as important as necessary. In November 2017, Microsoft announced that it will extend Windows Defender ATP partners across platforms. With that, the public availability of the WDATP integration of Ziften, Bitdefender and Lookout went live. With this comprehensive approach, Microsoft unites forces against cyber threats and adds lack of knowledge about behavior-based security solutions on these platforms through the industry expertise of its partners. This integration has now been extended to include two additional platforms, SentinelOne and Corrata. In this blog post I’ll give you a first introduction how the integration with Ziften can be done. Later we will have a look how the agent behaves on Mac and Linux machines with two different examples of real world attacks, that we have seen in the past couple of months.

Continue reading

Azure ATP: Golden Ticket Attack – Understanding Kerberos

/ / 0 Comments / Azure, MDI, Security

Pirate,

many enterprise IT departments these days are afraid of golden ticket or pass the ticket attacks -which is good because privilege escalation and privileged account exploitation are at the center of cyber attacks as we see them. Attackers crash through the network perimeter, hijack credentials and use them to move laterally throughout the network, taking additional credentials and escalating privileges along the way to accomplish their goals. In this blog series we will have a look at kerberos golden ticket and silver ticket attacks. I’ll try my best to explain how it works and how Azure ATP / Advanced Threat Analytics can help to detect.

 

Continue reading

Microsoft Cybersecurity Reference Architecture

/ / 0 Comments / Security

Pirate,

in June 2018, Mark Simos who works as Lead Architect, Enterprise Cybersecurity Group at Microsoft published the updated “Cybersecurity Reference Architecture”. I find this a very valuable collection of architectural information as it often gives a good impression of the big picture approach. As there is a webcast coming up, where Mark is going to explain the design and how you as a architect or systems engineer can use this reference architecture, I decided to wrap that information up in a blogpost.

Continue reading

Attack Simulator for Office 365 Threat Intelligence – Password Spray Attack

/ / 0 Comments / Office365, Security

Pirate,

the third attack simulation method is a password spray attack. In a password-spray attack, a hacker tests a single password against multiple user accounts at an organization. The method often involves weak passwords, such as Winter2018 or Password123!, and can be an effective hacking technique against organizations that are using single sign-on (SSO) and federated authentication protocols, but that haven’t deployed multi factor authentication.

 

 

Continue reading

Attack Simulator for Office 365 Threat Intelligence – Brute Force Password Attack

/ / 0 Comments / Office365, Security

Pirate,

A Brute Force Attack is the simplest method to gain access to a site or server. It is an automated, trial-and-error method of generating multiple password guesses from a dictionary file against a user’s password. Automated software is used to generate a large number of consecutive guesses as to the value of the desired data. An attack of this nature can be time- and resource-consuming. Hence the name “brute force attack;” success is usually based on computing power and the number of combinations tried rather than an ingenious algorithm.

 

Continue reading

Attack Simulator for Office 365 Threat Intelligence – Spear Phishing Attack

/ / 0 Comments / Office365, SecurityTagged: , ,

Pirate,

in the first part we had a look into attack simulator and the included scenarios. We discussed which scenario does what in detail and what you need to set up as a preparation. In this blog post we will check out the spear phishing attack that is meant to harvest credentials. Spear phishing is a very common e-mail spoofing attack scenario that targets a specific individual or organization with the goal to get access to sensitive information. Furthermore I have seen this attack method with the intend to install malware on a targeted user’s computer.

 

Continue reading

Attack Simulator for Office 365 Threat Intelligence – Overview and Preparation

/ / 0 Comments / Office365, SecurityTagged: , ,

Pirate,

Email spam is once again the most popular choice for sending out malware. Spam has been one of the main infection vectors for decades. During the past few years, it’s gained more popularity against other vectors, as systems are getting more secure against software exploits and vulnerabilities. A recent report of F-Secure reports that spam email click rates have gone up from the 13.4% recorded in the second half of 2017 to 14.2% recorded in the first half of the year. To protect against these attack vectors is nearly impossible as a majority of attacks leads to web pages never seen before and due to the the sheer infinite range of these attack vectors. The only thing that really improves our security level is permanent education of our users.

On ‎02-21-2018  Microsoft has announced the Public Preview of Attack Simulator for Office 365 Threat Intelligence. In preparation of some customer workshops I had a first look into the product that I want to share with you.

Continue reading

© 2022 IT-Pirate