AWSPlatform Changes
AWS Control Tower Goes GA (June 2019): Guardrails for Multi-Account AWS
In June 2019, AWS Control Tower became generally available. It automated the creation of a secure multi-account AWS environment — a landing zone — with...
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
AWSHow-To & Hardening
How to Set Up AWS Control Tower With Preventive and Detective Guardrails
AWS Control Tower sets up a governed multi-account environment with guard rails. Here is how to set it up and choose the right controls.
AWSHow-To & Hardening
Control Tower Guardrail Selection Checklist
Control Tower offers hundreds of controls. Use this checklist to choose a practical starting set.
AWSCIO Briefings
CIO Brief: Governance at Scale — Why Control Tower Matters
The short version: AWS Control Tower, released in 2019, sets up your AWS cloud as a well-organized group of accounts with security rules built in. It is the...
AzureIncident Teardowns
BlueKeep (May 2019): Wormable RDP and the Risk of Internet-Exposed Azure VMs
In May 2019, Microsoft patched CVE-2019-0708, a critical vulnerability in Remote Desktop Services that became known as BlueKeep. It affected older Windows...
AzureHow-To & Hardening
How to Replace Public RDP With Azure Bastion and Just-in-Time Access
Exposed RDP and SSH ports are among the most attacked entry points in the cloud. Azure Bastion and just-in-time (JIT) VM access let administrators reach...
AzureDetection & Response
Detecting Exposed RDP Exploitation: Defender for Cloud and Sentinel KQL
Even with patches, exposed RDP invites brute force, credential stuffing and exploitation. Detecting both the exposure and attacks against it is essential...
AzureCIO Briefings
CIO Brief: Exposed Remote Access Is Still the Front Door for Ransomware
The short version: In 2019, Microsoft warned about BlueKeep, a flaw that could let attackers take over older Windows computers through remote desktop...
Microsoft 365Incident Teardowns
Outlook.com Support Agent Account Compromised (Apr 2019): The Help Desk Attack Surface
In April 2019, Microsoft notified some users of its consumer email services — Outlook.com, Hotmail and MSN — that a support agent's credentials had been...
Microsoft 365How-To & Hardening
How to Secure Help Desk and Support Roles in Microsoft 365
Help desk and support staff can reset passwords, change MFA methods and see user data. Here is how to scope those roles tightly in Microsoft 365 and Entra ID.
Microsoft 365Detection & Response
Detecting Help Desk Account Compromise: Defender XDR and Sentinel Hunting Queries
A compromised help desk account — or a manipulated help desk agent — can reset credentials across your organization. Detecting unusual support activity...
Microsoft 365CIO Briefings
CIO Brief: Your Help Desk Is a Target — Protecting Support Workflows
The short version: In 2019, attackers got into Microsoft's consumer email support systems by compromising a single support agent's account. Help desks are...
Microsoft 365Incident Teardowns
Citrix Breached via Password Spraying (Mar 2019): Weak Passwords at Enterprise Scale
In March 2019, Citrix disclosed that the FBI had informed it of a breach of its internal network. The FBI's assessment, according to Citrix, was that...
Microsoft 365How-To & Hardening
How to Use Entra ID Smart Lockout and Identity Protection Against Spraying
Entra ID includes two built-in defenses against password spraying: smart lockout and Identity Protection. Here is how to configure both.
Microsoft 365Detection & Response
Detecting Password Spray Attacks: Defender XDR and Sentinel Hunting Queries
Password spray attacks distribute attempts to avoid detection. Combining Entra ID's built-in detections with your own queries gives you the best chance of...
Microsoft 365CIO Briefings
CIO Brief: Your Security Vendor Can Be Breached — Plan for It
The short version: In 2019, Citrix — a company that sells remote access technology to enterprises — was breached, likely through attackers trying common...
AzurePlatform Changes
Azure Sentinel Preview (Feb 2019): Microsoft Enters the Cloud SIEM Market
On February 28, 2019, Microsoft announced Azure Sentinel in preview — a cloud-native security information and event management (SIEM) service built on Azure...
AzureHow-To & Hardening
How to Plan a Microsoft Sentinel Deployment: Workspaces, Connectors and Costs
A good Microsoft Sentinel deployment starts with planning workspaces, data sources and costs before turning anything on. Here is the sequence Microsoft's...
AzureHow-To & Hardening
Sentinel Data Connector Priority Checklist
Data connectors determine both what Microsoft Sentinel can detect and what it costs. Use this checklist to prioritize them.
AzureCIO Briefings
CIO Brief: Cloud-Native SIEM vs. Legacy SIEM — The Cost and Coverage Trade-Off
The short version: In 2019, Microsoft released Sentinel, a security monitoring service that runs in the cloud. It made centralized security monitoring...
AWSPlatform Changes
S3 Block Public Access Launches (Nov 2018): The Feature That Should Have Existed Day One
In November 2018, AWS launched S3 Block Public Access, a set of four settings that override bucket policies and access control lists to prevent public...
AWSHow-To & Hardening
How to Enforce S3 Block Public Access at the AWS Organization Level
Account-level S3 Block Public Access protects every bucket in an account. With AWS Organizations, you can apply it everywhere and prevent anyone from...
AWSHow-To & Hardening
S3 Public Access Audit Checklist
Use this checklist to audit S3 public access across your AWS organization.
AWSCIO Briefings
CIO Brief: One Setting That Prevents the Most Common Cloud Breach
The short version: In 2018, AWS added a setting that prevents cloud storage from being made public at all. Turned on across an account, it stops the most...