AWSIncident Teardowns
Verizon Customer Records Exposed via a Vendor's S3 Bucket (July 2017)
In July 2017, UpGuard researchers reported that records belonging to millions of Verizon customers were sitting in a publicly accessible Amazon S3 bucket....
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
AWSHow-To & Hardening
How to Use S3 Bucket Policies and Access Points to Enforce Least Privilege
Bucket policies decide who can access data in Amazon S3. Written loosely, they leak data; written tightly, they make many attacks impossible. Here is how to...
AWSDetection & Response
Detecting S3 Bucket Policy Misconfiguration: CloudTrail, GuardDuty and Athena Queries
Overly broad bucket policies are a frequent root cause of S3 exposures. Detecting policy changes that widen access — and catching risky policies already in...
AWSCIO Briefings
CIO Brief: Third-Party Cloud Risk — Writing Security Into Vendor Contracts
The short version: In 2017, a Verizon vendor exposed customer records — including account PINs used for phone support — in a cloud storage folder anyone...
Microsoft 365Platform Changes
Microsoft 365 Arrives (July 2017): Security Bundled Into the Productivity Suite
In July 2017, Microsoft announced Microsoft 365: a single subscription bundling Office 365, Windows 10 Enterprise and Enterprise Mobility + Security. For...
Microsoft 365How-To & Hardening
How to Map Microsoft 365 E3 vs. E5 Security Features to Your Real Risks
Microsoft 365 E3 and E5 both include significant security capabilities, but they are packaged differently and named inconsistently over the years. Here is...
Microsoft 365How-To & Hardening
Microsoft 365 Security Baseline Checklist for New Tenants
New and long-neglected Microsoft 365 tenants share the same weaknesses. This checklist covers the baseline settings that stop the most common attacks. Treat...
Microsoft 365CIO Briefings
CIO Brief: E3 or E5? Making the Microsoft 365 Security Licensing Decision
The short version: Microsoft 365 E3 includes solid security basics. E5 adds advanced threat protection, risk-based identity controls and stronger compliance...
AzureIncident Teardowns
NotPetya (June 2017): How a Tax Software Update Wiped Out Global Networks
On June 27, 2017, a malware outbreak later called NotPetya began in Ukraine and spread to multinational companies within hours. Shipping giant Maersk had to...
AzureHow-To & Hardening
How to Tier Your Active Directory Admin Accounts to Contain Lateral Movement
NotPetya spread by stealing administrator credentials from memory and reusing them across the network. Tiering your Active Directory admin accounts stops...
AzureDetection & Response
Detecting Credential Theft Lateral Movement: Defender for Cloud and Sentinel KQL
NotPetya combined credential theft with legitimate admin tools to move across networks. Detecting that pattern early is one of the most effective ways to...
AzureCIO Briefings
CIO Brief: NotPetya and the True Cost of Flat Networks and Shared Admin Accounts
The short version: NotPetya, in 2017, entered companies through a trusted software update and then spread using administrator passwords stolen from one...
AWSIncident Teardowns
198 Million Voter Records in an Open S3 Bucket (June 2017): Anatomy of a Misconfiguration
In June 2017, researcher Chris Vickery of UpGuard found an Amazon S3 bucket containing personal data on about 198 million American voters. It belonged to...
AWSHow-To & Hardening
How to Find and Lock Down Public S3 Buckets Across Every AWS Account
Public S3 buckets were behind dozens of data leaks in 2017. AWS has since made buckets private by default, but older accounts, older buckets and deliberate...
AWSDetection & Response
Detecting Public S3 Bucket Access: CloudTrail, GuardDuty and Athena Queries
The best time to catch a public S3 bucket is the moment it becomes public. Detection rules on configuration changes close the window between a mistake and...
AWSCIO Briefings
CIO Brief: Your Vendors' Cloud Buckets Are Your Data Exposure
The short version: In 2017, a data company working for the Republican National Committee left personal details on 198 million voters in an unprotected cloud...
AzureIncident Teardowns
WannaCry (May 2017): SMBv1, Unpatched Servers and What Cloud Teams Missed
On May 12, 2017, WannaCry ransomware spread across the world in a matter of hours, encrypting files on hundreds of thousands of Windows computers in more...
AzureHow-To & Hardening
How to Disable SMBv1 and Enforce Patch Compliance on Azure VMs
SMBv1 is a decades-old file-sharing protocol with known critical flaws, and it was the doorway for WannaCry and NotPetya. Here is how to remove it from...
AzureDetection & Response
Detecting SMBv1 Exploitation: Defender for Cloud and Sentinel KQL
WannaCry and its successors exploited SMB flaws to spread across networks. Even with SMBv1 removed, detecting suspicious SMB activity is a valuable early...
AzureCIO Briefings
CIO Brief: Why Patch Management Is a Board-Level Issue After WannaCry
The short version: In 2017, WannaCry ransomware infected hundreds of thousands of computers worldwide using a Windows flaw that had been patched two months...
Multi-CloudIncident Teardowns
Cloudbleed (Feb 2017): When Your CDN Leaks Your Customers' Session Tokens
In February 2017, Google Project Zero researcher Tavis Ormandy noticed something strange in search results: fragments of private data from websites that...
Multi-CloudHow-To & Hardening
How to Rotate Sessions and Secrets After a Third-Party Provider Leak
When a provider you depend on — a CDN, identity platform, CI/CD service or SaaS tool — announces that tokens or secrets may have leaked, speed matters more...
Multi-CloudDetection & Response
Detecting Leaked Session Tokens: Sentinel and GuardDuty Detections
When a provider leaks session tokens, the question is whether anyone used them. Detection focuses on sessions that look valid but behave differently from...
Multi-CloudCIO Briefings
CIO Brief: Managing Risk When a Core Internet Provider Has a Bug
The short version: In 2017, a bug at Cloudflare, a major internet provider, leaked private data from customer websites, including login sessions. The...