Ethical Threat Insights

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-024-three-places-to-shrink-attack-surface

In this episode of Ethical Threat Insights, Spencer Alessi explores reducing attack surface in Active Directory and Windows.

Unnecessary permissions, delegation settings, and endpoint privileges can leave attackers room to move. Spencer explains why identity is a useful place to start and how restricting services, PowerShell, and application execution can reduce opportunities on Windows endpoints.

What you'll learn:

• Start with Active Directory permissions and delegation paths you can trace.
• Recognize that auditing legacy protocol dependencies can be harder than tracing permissions.
• Look for endpoint privilege escalation caused by excessive permissions or service misconfiguration.
• Use execution restrictions and application control to constrain attacker options.

Source: The Cyber Threat Perspective (SecurIT360).
Episode 192: Subtractive Security — Stop Adding Tools and Start Deleting Attack Paths

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-023-delete-before-you-optimize

In this episode of Ethical Threat Insights, Spencer Alessi explores questioning requirements before optimizing security.

Before you secure another system, ask whether it needs to exist. Spencer applies a question, delete, and simplify approach to attack surface, explaining why optimizing an unnecessary system can preserve the very problem you need to remove.

What you'll learn:

• Question requirements even when they are longstanding or came from leadership.
• Look for unnecessary systems, components, and access before adding controls.
• Put deletion and simplification ahead of optimization.
• Use the framework to challenge the habit of solving every security problem with another tool.

Source: The Cyber Threat Perspective (SecurIT360).
Episode 192: Subtractive Security — Stop Adding Tools and Start Deleting Attack Paths

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-022-four-deception-traps-that-match-real-attacker-habits

In this episode of Ethical Threat Insights, Spencer Alessi explores deception traps that match real attacker habits.

Attackers look for credential files and backups because those artifacts have paid off on real engagements. Spencer discusses turning those habits into detection opportunities, keeping real credentials out of decoys, and exploring free and commercial deception resources.

What you'll learn:

• Understand why unattended Windows deployment files attract attackers.
• Use believable backup artifacts as decoys without exposing real credentials.
• Start small and expand your deception approach as it matures.
• Find the deception resources and researchers discussed in the recording.

Source: The Cyber Threat Perspective (SecurIT360).
Episode 188: Guaranteed Way to Catch Threat Actors

Resources mentioned:
Spencer's cyber-deception webinar: https://go.spenceralessi.com/deceptionwebinar
Thinkst: https://thinkst.com/
Thinkst Canary: https://canary.tools/
Free Canarytokens: https://www.canarytokens.org/
Tracebit: https://tracebit.com/
Casey Smith on X: https://x.com/_subtee
Haroon Meer on X: https://x.com/haroonmeer
Spencer's deception posts on X: https://x.com/search?q=from%3Atechspence%20deception&f=live

The recording states that the deception product mentions are not sponsored.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-021-how-to-build-believable-deception

In this episode of Ethical Threat Insights, Spencer Alessi explores building deception that fits your environment.

An obvious password file is easy to dismiss. Spencer explains how realistic names, folders, and connected clues can make a deception campaign more believable, with examples involving remote-access configuration files, decoy accounts, and certificate templates.

What you'll learn:

• Build a consistent story across several decoy files and folders.
• Match decoy account names to your real naming conventions.
• Choose lures that reflect the credentials and information attackers already seek.
• Keep decoy accounts and certificate templates from becoming usable attack paths.

Source: The Cyber Threat Perspective (SecurIT360).
Episode 188: Guaranteed Way to Catch Threat Actors

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-020-deception-changes-attacker-psychology

In this episode of Ethical Threat Insights, Spencer Alessi explores how deception creates uncertainty for attackers.

A believable decoy can change how an attacker moves through your environment. Spencer explains how deception has slowed his own pentests, forced extra actions, and created more opportunities for defenders to detect an intrusion.

What you'll learn:

• Use believable lures to draw attention during reconnaissance.
• Understand how discovering one decoy can make an attacker question what comes next.
• Create friction that gives defenders more chances to detect activity.
• Treat deception as a detection layer alongside your other controls.

Source: The Cyber Threat Perspective (SecurIT360).
Episode 178: Internal Security Controls That Actually Frustrate Attackers; Episode 188: Guaranteed Way to Catch Threat Actors

The recording states that the deception product mentions are not sponsored.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-015-measure-security-by-the-attack-paths-you-close

In this episode of Ethical Threat Insights, Spencer Alessi explores security metrics tied to attacker outcomes.

Counting fixed vulnerabilities does not always explain how risk changed. Spencer proposes tracking concrete attack paths that have been removed so leaders can connect technical work to a meaningful outcome.

What you'll learn:

• Describe the route from a compromised user to a high-impact target.
• Track paths that have actually been closed over time.
• Explain the limitations of the metric while using it to communicate progress.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-014-four-questions-to-prioritize-your-security-work

In this episode of Ethical Threat Insights, Spencer Alessi explores harm, likelihood, improvement, and risk acceptance.

Security work competes with a finite budget, a finite team, and a finite number of hours. Spencer shares a practical way to choose the changes that matter and make explicit decisions about the risks a team cannot address now.

What you'll learn:

• Ask what could cause the greatest harm and what is most likely to be exploited.
• Choose improvements that are realistic with current resources.
• Make risk acceptance an explicit part of prioritization.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-013-stop-adding-tools-delete-attack-paths

In this episode of Ethical Threat Insights, Spencer Alessi explores subtractive security.

What could you remove from your environment that would make an attack materially harder? Spencer discusses deleting unnecessary paths, constraining what remains, and monitoring residual risk with tools a team may already have.

What you'll learn:

• Apply deletion, constraint, and monitoring in that order.
• Look for unnecessary privileges and legacy protocols.
• Focus on foundational exposure while assessing new threats.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-012-catch-the-recon-before-the-malware

In this episode of Ethical Threat Insights, Spencer Alessi explores behavioral detection and deception during reconnaissance.

Renaming a tool or changing a signature can defeat a narrow detection rule. Spencer discusses abnormal discovery activity, network telemetry, and believable decoys as ways to notice an intruder before the attack reaches its later stages.

What you'll learn:

• Understand the limits of detections tied only to tool names or static signatures.
• Look for unusual volumes of discovery and file-share activity.
• Use deception as an early warning during the recon phase.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.

Download your free Active Directory Security Resource Kit: https://spenceralessi.com/adsecuritykit/?utm_source=ethical_threat_insights&utm_medium=podcast&utm_campaign=ad_security_kit&utm_content=ep-011-segment-the-network-before-recon-starts

In this episode of Ethical Threat Insights, Spencer Alessi explores network segmentation and attacker reconnaissance.

A compromised endpoint is much less useful when it cannot reach the systems an attacker wants to enumerate. Spencer discusses host firewall rules, segmentation, jump hosts, and reducing unnecessary outbound access.

What you'll learn:

• Connect network reachability to reconnaissance and lateral movement.
• Consider the built-in Windows Firewall alongside other segmentation options.
• Review which servers actually need internet access.

More from Spencer:

https://spenceralessi.com/

Follow @techspence for more practical cybersecurity insights.