Blue Security

This week, friend of the pod, Shannon Fritz, fills in for Adam and he and Andy talk about the big update for Patch Tuesday, the Medibank double extortion incident, and the meltdown happening at Twitter.

-------------------------------------------

Youtube Video Link:

-------------------------------------------

Documentation:

https://support.microsoft.com/en-us/topic/november-8-2022-kb5019980-os-build-22621-819-b503e08b-b850-469a-8de9-74df8aebd5f4

https://www.9news.com.au/technology/medibank-hack-suspected-cybercriminal-releases-sample-of-australian-customer-data/26aa6096-f730-4a8c-83a1-b0d3da6519d7

https://twitter.com/leakissner/status/1590706305102381058?s=46&t=b1TkB4mKrocmPYWcffWQtg

https://www.theverge.com/2022/11/10/23451198/twitter-ftc-elon-musk-lawyer-changes-fine-warning

https://www.technologyreview.com/2022/11/08/1062886/heres-how-a-twitter-engineer-says-it-will-break-in-the-coming-weeks/

https://www.technologyreview.com/2022/11/11/1063162/twitters-imminent-collapse-could-wipe-out-vast-records-of-recent-human-history/

-------------------------------------------

Contact Us:

Website: https://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about the Dropbox and Twilio breach where old phishing tricks worked and attackers were able to get credentials. They also talk about CISA's new guidance on phish resistant MFA and Enhance Phishing Protection in Windows 11 22H2.

-------------------------------------------

Youtube Video Link: https://youtu.be/06lGGC6GSJM

-------------------------------------------

Documentation:

https://dropbox.tech/security/a-recent-phishing-campaign-targeting-dropbox

https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf

https://learn.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen?tabs=intune

-------------------------------------------

Contact Us:

Website: https://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about the SOCRadar disclosure of a misconfigured Microsoft endpoint that led to a data privacy incident. They talk about what happened and what you should know as a Microsoft customer. They also go over some of the highlights from Ignite 2022 with new features and brands for endpoint management, identity, and security.

-------------------------------------------

Youtube Video Link: https://youtu.be/mMlkJnpT9us

-------------------------------------------

Documentation:

https://msrc-blog.microsoft.com/2022/10/19/investigation-regarding-misconfigured-microsoft-storage-location-2/

https://news.microsoft.com/ignite-2022-book-of-news/

https://www.microsoft.com/security/blog/2022/10/12/5-cybersecurity-capabilities-announced-at-microsoft-ignite-2022-to-help-you-secure-more-with-less/

https://learn.microsoft.com/en-us/azure/active-directory/governance/what-are-lifecycle-workflows

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-strengths

https://techcommunity.microsoft.com/t5/tech-community-live/microsoft-technical-takeoff-windows-and-microsoft-intune/ev-p/3632740

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about IBM's Incident Responder Report. This report has some great empirical data on incident responder perceptions and how incidents impact mental health. Listen in as they discuss some of the key findings in this report.

-------------------------------------------

Youtube Video Link: https://youtu.be/hhnxHMbvASw

-------------------------------------------

Documentation:

https://www.ibm.com/downloads/cas/XKOY5OLO

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about how to look at BYOD policies in a Zero-Trust architecture. They go over a blueprint put out by Microsoft Middle East and Africa that's a little bit older but is a great reference for anyone looking for guidance.

-------------------------------------------

Youtube Video Link: https://youtu.be/pze2b0Ix8QI

-------------------------------------------

Documentation:

https://www.microsoft.com/en-us/insidetrack/transitioning-to-modern-access-architecture-with-zero-trust

https://news.microsoft.com/wp-content/uploads/prod/sites/133/2021/03/MEA-Blueprint-for-BYOD-Use-v1.0-Final-Version.pdf

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about Microsoft Defender for Endpoint's Tamper Protection. This type of feature is also available on other endpoint protection solutions. They talk about what it is, what's changing soon, and why you should turn this on.

-------------------------------------------

Youtube Video Link: https://youtu.be/ZhhlianhqgY

-------------------------------------------

Documentation:

https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/tamper-protection-will-be-turned-on-for-all-enterprise-customers/ba-p/3616478

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection?view=o365-worldwide

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/tamperprotection-macos?view=o365-worldwide

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about some tips on securing Active Directory. This was inspired by a session led by Trimarc Security at The Experts Conference.

-------------------------------------------

Youtube Video Link: https://youtu.be/7HQZQh-UzmQ

-------------------------------------------

Documentation:

https://www.trimarcsecurity.com/

https://www.quest.com/the-experts-conference/

https://www.hub.trimarcsecurity.com/post/ten-ways-to-improve-ad-security-quickly

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about kerberoasting: how it works and how to defend against it. Listen in on this unique attack technique!

-------------------------------------------

Youtube Video Link: https://youtu.be/sr75jgscnkQ

-------------------------------------------

Documentation:

https://www.linkedin.com/posts/heathadams_i-got-domain-admin-on-an-internal-pentest-activity-6976047836693966848-e3AM

https://twitter.com/_wald0/status/1562871258190348289?s=20&t=xcJOw353X-xDvHB52BKxiA

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about Microsoft Teams and the post-exploit technique that was discovered by Vetra's Project Team and the decision of Patreon to lay off their entire internal information security team. The also talk about Uber's on-going cybersecurity incident including some initial reports of how it happened as well as mitigations to prevent this type of attack in the future.

-------------------------------------------

Youtube Video Link: https://youtu.be/FWnEma4hOWQ

-------------------------------------------

Documentation:

https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens

https://techcrunch.com/2022/09/09/patreon-security-layoffs/

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-faqs

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy breakdown what led to Cloudflare dropping Kiwi Farms as a customer, why the media and Twitter were up-in-arms about the whole incident, and their thoughts about the decision.

-------------------------------------------

Youtube Video Link: https://youtu.be/NrNe_n95Tfk

-------------------------------------------

Documentation:

https://blog.cloudflare.com/cloudflares-abuse-policies-and-approach/ 

https://blog.cloudflare.com/kiwifarms-blocked/ 

https://rasbora.dev/blog/I-ran-the-worlds-largest-ddos-for-hire-empire-and-cloudflare-helped

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]