Microsoft 365How-To & Hardening
Copilot Oversharing Remediation Checklist
Use this checklist to remediate oversharing before and during Copilot rollout.
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
Microsoft 365CIO Briefings
CIO Brief: Scaling Copilot Safely Beyond the Pilot
The short version: In September 2024, Microsoft expanded Copilot with new features — and new tools to fix the "oversharing" problem that stalled many...
AWSIncident Teardowns
Exposed .env Files Fuel an AWS Extortion Campaign (Aug 2024)
In August 2024, researchers at Palo Alto Networks' Unit 42 described an extortion campaign that started with publicly exposed environment (.env) files on...
AWSHow-To & Hardening
How to Keep Secrets Out of Web Roots and Into AWS Secrets Manager
Exposed .env files led to an AWS extortion campaign in 2024. Here is how to keep secrets out of web-accessible locations and move them into AWS Secrets Manager.
AWSDetection & Response
Detecting Exposed Environment Variables: CloudTrail, GuardDuty and Athena Queries
Credential theft from exposed configuration files leads to predictable AWS activity. These detections target the patterns seen in .env-based extortion...
AWSCIO Briefings
CIO Brief: Leaked Configuration Files Are Leaked Keys
The short version: In 2024, attackers scanned the internet for websites accidentally publishing their configuration files — which contained cloud passwords...
Multi-CloudHow-To & Hardening
How to Recover BitLocker-Protected Azure VMs and Endpoints at Scale
The CrowdStrike outage showed how hard recovery is when thousands of BitLocker-encrypted devices won't boot. Here is how to prepare for recovering Azure VMs...
Multi-CloudHow-To & Hardening
Endpoint Agent Update Risk Checklist
Security agents and other kernel-level software can take down entire fleets. Use this checklist to manage the risk of endpoint agent updates.
Multi-CloudCIO Briefings
CIO Brief: When Your Security Tool Causes the Outage
The short version: On July 19, 2024, a faulty update to CrowdStrike's security software crashed about 8.5 million Windows computers worldwide. Airlines,...
Multi-CloudHow-To & Hardening
How to Enforce SSO and MFA on Every SaaS Data Platform
The Snowflake customer breaches happened because SaaS data platforms were accessed with stolen passwords and no MFA. Here is how to enforce SSO and MFA...
Multi-CloudDetection & Response
Detecting SaaS Credential Stuffing: Sentinel and GuardDuty Detections
Infostealer-sourced credentials are used against SaaS platforms in automated campaigns. These detections help catch SaaS account takeover and data theft.
Multi-CloudCIO Briefings
CIO Brief: SaaS Shared Responsibility — Snowflake Wasn't Hacked, Its Customers Were
The short version: In 2024, attackers stole data from about 165 companies' accounts on Snowflake, a cloud data platform — including Ticketmaster and AT&T....
Entra ID & IdentityHow-To & Hardening
How to Roll Out Device-Bound Passkeys in Entra ID
Passkeys in Microsoft Authenticator give users phishing-resistant MFA on their phones. Here is how to roll them out in Entra ID.
Entra ID & IdentityHow-To & Hardening
Passkey Rollout Checklist: Registration, Recovery and Help Desk
Use this checklist to roll out passkeys across your organization.
Entra ID & IdentityCIO Briefings
CIO Brief: Passkeys Make Phishing-Resistant MFA Affordable
The short version: Since 2024, Microsoft lets employees use passkeys on their phones to sign in — the strongest common form of authentication, and immune to...
Microsoft 365Platform Changes
The CSRB Report on Storm-0558 (Apr 2024): A 'Cascade of Security Failures' at Microsoft
On April 2, 2024, the US Cyber Safety Review Board (CSRB) published its report on the Storm-0558 intrusion, in which Chinese state actors used a stolen...
Microsoft 365How-To & Hardening
How to Hold Your Cloud Providers Accountable With Security Contract Terms
Cloud provider security failures can affect your data — but your contract often gives you little recourse. Here are security terms to negotiate or verify...
Microsoft 365How-To & Hardening
Annual Cloud Provider Security Review Checklist
Use this checklist to review each major cloud provider's security each year.
Microsoft 365CIO Briefings
CIO Brief: What the CSRB Findings Mean for Microsoft Customers
The short version: In April 2024, a US government review board concluded that a Chinese hack of Microsoft's email systems "should never have happened" and...
Multi-CloudIncident Teardowns
The XZ Utils Backdoor (Mar 2024): A Multi-Year Open-Source Supply-Chain Plot
On March 29, 2024, Microsoft engineer Andres Freund disclosed that he had found a backdoor in XZ Utils, a compression library included in many Linux...
Multi-CloudHow-To & Hardening
How to Scan Cloud Images and Containers for Compromised Packages
When a compromised package like XZ Utils is discovered, you need to know quickly whether it's in your cloud images and containers. Here is how to scan...
Multi-CloudDetection & Response
Detecting Compromised Open Source Packages: Sentinel and GuardDuty Detections
Compromised open-source packages are hard to detect by behavior — they're designed to look legitimate. Detection relies on inventory, threat intelligence...
Multi-CloudCIO Briefings
CIO Brief: Open-Source Dependencies Are Third-Party Risk
The short version: In 2024, a hidden backdoor was discovered in XZ Utils, a small but widely used piece of free software in Linux systems. Someone had spent...
Multi-CloudHow-To & Hardening
How to Enforce MFA on Every Remote Access Portal
Change Healthcare and Colonial Pipeline were both breached through remote access without MFA. Here is how to enforce MFA on every remote access portal.