Mike Guy

What does Darktrace partnership with Microsoft actually mean if you were part of the cyber team managing managing M365 apps? Let me explain… • Imagine, you've invested in M365 Apps, which is the productivity backbone of the public sector.    • But in the shadow of utility, security threats can lurk unseen.    👉 Here's how you bring them to light + reinforce your app armor with Darktrace: ⃗→ Deploy Darktrace AI to monitor for anomalies across all 365 apps, offering a bird’s-eye view of your digital environment ⃗→ Utilize Darktrace’s capability to act instantly on threats, maintaining operational integrity and trust 𝗥𝗲𝗺𝗲𝗺𝗯𝗲𝗿, 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝟯𝟲𝟱 𝗸𝗲𝗲𝗽𝘀 𝘆𝗼𝘂𝗿 𝗱𝗲𝗽𝗮𝗿𝘁𝗺𝗲𝗻𝘁 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝘃𝗲; 𝗗𝗮𝗿𝗸𝘁𝗿𝗮𝗰𝗲 𝗸𝗲𝗲𝗽𝘀 𝗶𝘁 𝗽𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱. Found this helpful? Comment below and share with colleagues who value both efficiency and security in their app use. #m365 #cyberai #darktrace

47

3 Comments

Today appears to be a lesson in why NIS2/DORA is required - any early stress test that has showed a complete reliance for some organisations on one ICT vendor. It is positive that the vendor took quick responsibility, but at what cost? Understanding your thirdparty ICT dependencies and the contractual obligations, or lack, thereof, is an important part of risk management.

6

News from a vendor that I'm a HUGE fan of - Oligo Security Andrew Joseph "A new #criticalvulnerability (#CVE20246387) was announced yesterday, impacting a large number of #OpenSSH servers worldwide. LinkedIn hates links now so just google it or DM me for the blog link. The vulnerability, named RegreSSHion, allows full system compromise and remote code execution. Our latest blog post provides a full rundown of how to know if you’re impacted, remediation and mitigation steps (including what to do if you can’t upgrade to OpenSSH 9.8 right now), and how the #OligoPlatform makes it easier to detect #RegreSSHion. Oligo policies can help you detect and locate against RegreSSHion:"

11

2 Comments

Thought for Monday: Are you securing your Linux infrastructure? Again today I was speaking to a client about securing their Linux infrastructure. This includes creating an Ansible central configuration repository to allow for multiple Replication of tasks. Some aspects of external firewall configurations leave concerns when this is the only defence. With recommendations for server specific security enhancements along with user access controls and a more controlled and regulated update and patching methodology. Opting for a newer version of RHEL over thier existing versions is something to consider however with older applications; some thought to the capability of these running on new operating systems should not be taken lightly. A further recommendation of a deeper server review with a prioritised list split between rebuild over migration report to align timeframes and project goals to put in place be for further movement can take place. With many of the applications in twined with each other and linked by Apache and Postgres along with API connections will add to the complexity of the project. This is certain to be an exciting and complex project and one that I am keen to move forward. If you or your clients are in a similar situation, please reach out to myself directly or contact me through KJD IT Solutions Limited Where I am happy to discuss your requirements.

1

#Office365 is an ever-evolving powerhouse, and with Soteria - Security Solutions & Advisory Inspect, you no longer have to speculate where vulnerabilities might lie in your tenant. We're thrilled to introduce Inspect to the #CaymanIslands, enhancing security for all our clients. Discover how we can help safeguard your operations—contact us today! #CyberSecurity #DataProtection

4

Who actually delivers your security monitoring? I see a lot of other #msps starting to outwardly market the fact that they deliver '24/7 security monitoring' yet find that when assessing the scale of the business, it's not practically possible to deliver that capability in-house which means that they themselves outsource security to a third party. Now, there's nothing inherently wrong with outsourcing, heck, customers outsource their IT and Security to us so I'm in no place to disagree with outsourcing but what aggravates me is when the same MSPs lie in marketing about where their security is actually coming from. Some of the many reasons our SOC is built, run and delivered by us as opposed to outsourcing; 1. Customers get to actually talk to people who know about security, and can build relationships with the people actually responsible for looking after their environment. 2. We can be incredibly dynamic to market changes or customer asks. Want some content built? Done. Need a report from some weird-ass data source that isn't in a prebuilt dashboard? Easy. You want it? Our team can do it. Probably. 3. When the shit hits the fan, we have TOTAL control over the situation (within reason) and aren't relying on someone else doing something. 4. We have TOTAL control over the team and their training. If I need the team to train up on the latest and greatest - that's within our grasp to enable that. 5. Don't like how something works? Great! We love feedback and we can change things to improve those areas. Good luck getting that from your outsourced IT providers outsourced security company. That's just to name a few. Next time you're speaking to an IT provider about their security services/offerings. Please ask EXACTLY who is delivering it and how that impacts you. #mssp #msp #marketing #dontbullshitabullshitter

37

10 Comments

Interesting to see that major cloud providers and tools like cloudflare get to face disruption due to again and again, BGP hijack. "Cloudflare blames recent outage on BGP hijacking incident" I wonder if people rushing blindly in digital transformation and cloud actually realize that BGP is not properly secured (RPKI anyone ? !) and this means that cloud is inherently a huge issue (not even considering the CPU security leaks allowing to steal encryption keys....but you know, at this point...) cloud=leak #cybersecurity failure, is the definition of public cloud. #clowd #bgp https://lnkd.in/eeCiHhKp

19

5 Comments

Just renewed 'Azure Security Engineer' certification for one more year, took a bit of time to go through all recommended modules. Looks like, changes related to MS Entra ID are huge. #azure #security #certification #neverstoplearning #architect

53

4 Comments

2 Posts on TSA in 1 week, does this mean I'm an influence now?! Absolutely Slaying giving pure Sigma Energy. Ooo this is an interesting one. I have to take the vector of attack with a slight pinch of salt, as I can't confirm the evidence. However from a TSA Angle, this very much gives focus to time bound Role Base Access Control, and proper 3rd party supply chain management. https://lnkd.in/e6EKvvtC

4

4 Comments

If you're planning on any form of DC or Internet edge firewall refresh in the near future, ✋ STOP WHAT YOU'RE DOING! 🤚 Please please have a look at the new FirePower 4200s. I've been working with a customer over the last few week on a firewall refresh project and have been blown away by the performance vs cost of the new Cisco 4200s. I put a post up a few weeks ago around the new 1200 Series appliance, but these are like taking the new chipsets and crypto accelerators and sticking them on steroids! 🔥 up to 140Gbps throughput with all NGFW features enabled (YES 140!!!) 🔥 up to 140Gbps for IPsec VPN 🔥 up to 45Gbps for TLS (Hardware Decryption) Loads of different options around network modules too really flexible on deployment options. Considering shipping times etc and implementation windows, you'll likely also be running this with the upcoming 7.6 FTD software (I'll put some more info out about this soon) so you'll also be getting: • SnortML for ML-based zero-day threat blocking • EVE 2.0 for enhanced threat detection and application visibility into TLS1.3 and QUIC traffic without decryption • SD-WAN • AI Security Assistant in Cisco Secure Firewall & FMC • Policy Analyser & Optimiser As I've said before, and I'll say again......The amount of development going into the Cisco Security portfolio at the moment is astronomical, and the "Firewall" underpins almost everything Cisco are doing in some way or another. Do this part right, and the capabilities that are going to be open to you in the future will blow your mind. As always, if you'd like to discuss anything around Cisco Security or projects that you're looking towards. Please drop myself or any of the team here at CAE Technology Services Limited a message or a call and we would love to help. Stela Maricic Akash Syed, CISSP Youssef Nhari, CISSP Gisli Helgason Dave Altass Alastair McCallum Alan Cottom Ashley Pilbeam Cisco Insider

213

16 Comments

💭🦅🔐 A few thoughts as the chaos of today dies down. 🔐🦅 💭 - The Protos Networks SecOps team have been absolute heroes today. A particular shoutout to Robert Zabel, who was on shift at 6 am when calls and alerts started coming in, and he has continued grafting all day. - Likewise, the IT teams at our customers and partners have been outstanding. Most of our customers had their critical systems back before 9 am due to their efforts, and our partner MSPs have been helping our team remediate customer issues. Thank you to all of you - you know who you are 😍 - Apart from the odd opportunistic ambulance-chasing ghoul, seeing the industry support each other has been great. Every MSP, IT Manager, SysAdmin, and vendor hopes this never happens to them, but eventually, everyone has a turn. 🤓💻 - This stuff happens😟; I have seen many other bits of security (and non-security) software BSOD devices over the years. If technology never broke things, many of us wouldn't have jobs. - I send my best wishes to the IT and security teams that are still working to fix these issues. At times like this, organisations often realise how important IT is. In a world where everything is connected, and supply chains rely on IT, days like today are inevitable. However, fixing these issues can often become life-or-death in industries such as healthcare and emergency services. 👨‍🏭 - Finally, we should all spare a thought for CrowdStrike's fantastic staff. This incident is significant because so many organisations use CrowdStrike—and with good reason. We put several EDRs through their paces when we selected one as part of our MSSP services, and CrowdStrike came top for us. We also have an incredible partner support team who have been helpful and responsive all day. Yes, the reputation and share price have taken a knock today, but CS still offers fantastic solutions disrupting the cyber security market. 🦅 #GlobalOutage #BSOD #CrowdStrike #Microsoft #P1Friday #CyberSecurity #IT #Tech Jack Hobden Rhia Jenkins Joe Joinson Damien Sansom Luke Martin Gareth Guest Sophie Mossman Sean Kinsella Jamie Barnes-Hockings Luke Payne Hollie Joinson Tom Heard Phil Lewis David Lenagh

71

5 Comments

Reading IBM's Cost of a Data Breach Report: https://lnkd.in/eDN_CHkb "Only one-third of companies discovered the data breach through their own security teams" If there ever were a stat that spoke to the inadequacy of current security models, that is it. #cybersecurity #cloudsecurity #security

16

Investigation Scenario 🔎 You've discovered that a Windows file server on your network has RDP enabled. It should not have RDP enabled. What do you look for to determine if a compromise has occurred? #InvestigationPath #DFIR #SOC

74

25 Comments

Check out another great EPSS presentation from Chris Madden

4

A time of crisis is the ultimate test of resilience. Last week’s #Crowdstrike issue is a timely reminder of how reliant our world is on digital technology. A single point of failure that can cause global turmoil in business, travel, and everyday life. Stress. Hardship. And complications for so many around the world. A simple error that could happen again. To any vendor. In any situation. It was also the ultimate test in Data Resilience. In a world where Data powers every single organization, it is constantly under threat. It must be protected. Recovered rapidly. No matter what happens. Team #Veeam has been working with customers around the clock. Helping recover impacted Windows machines on VMware VMs, Hyper-V, AHV, Azure, AWS, GCP and several other hypervisors/platforms. Many have used our Veeam Data Platform to restore all their Windows machines simultaneously, while others performed a quick rollback for VMware and Hyper-V instances bringing the machines back to the state they were before the update was applied. Data Resilience in action. Recovering production systems quickly. Putting critical services back online. Getting business back to normal. Thank you Veeam Software and all our partners for your incredible work with our customers. It’s been humbling to hear customers' great recovery stories like Pavel Lechenko's firsthand. So many lessons on how Data Resilience keeps every business running!

165

2 Comments

I will be implementing an Open Source firewall on our public network - the primary goal is to restrict access to some certain inappropriate websites especially for kids. What Open Source Firewall do you suggest and why ? I'm thinking of Pfsense please let me know in the comment

3

2 Comments

🚨 If you are suffering from the outages today and you are building on AWS, details on getting your #EC2 instance back up and running are below 👇

10