Multi-CloudIncident Teardowns
CircleCI Secrets Breach (Jan 2023): Rotate Everything
On January 4, 2023, CircleCI, a widely used continuous integration and delivery platform, told customers to rotate all secrets stored in its platform...
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
Multi-CloudHow-To & Hardening
How to Run a Secrets Rotation Fire Drill Across AWS and Azure
When a provider tells you to rotate everything, the hardest part is knowing what "everything" is. A rotation fire drill — practiced in advance — makes it...
Multi-CloudDetection & Response
Detecting CI/CD Secrets Theft: Sentinel and GuardDuty Detections
After a CI/CD provider breach, attackers use stolen secrets to access your cloud. Detecting that use — and use of secrets after rotation — tells you whether...
Multi-CloudCIO Briefings
CIO Brief: When a Dev Tool Breach Forces a Company-Wide Credential Reset
The short version: In January 2023, CircleCI — a service many companies use to build and deploy software — told every customer to change every password and...
Multi-CloudIncident Teardowns
LastPass (Disclosed Dec 2022): Vault Backups Stolen From Cloud Storage
In August 2022, password manager LastPass disclosed that an attacker had accessed its development environment. In December 2022, it revealed that the...
Multi-CloudHow-To & Hardening
How to Protect Cloud Backup Storage With Separate Credentials and Immutability
In the LastPass breach, attackers stole backups from cloud storage using credentials taken from an engineer's home computer. Backups need their own...
Multi-CloudDetection & Response
Detecting Cloud Backup Theft: Sentinel and GuardDuty Detections
Attackers increasingly target backups — to steal data or to delete it before ransomware. These detections watch for unusual backup access and changes.
Multi-CloudCIO Briefings
CIO Brief: Password Manager Breaches and Your Enterprise Secrets
The short version: In 2022, attackers stole encrypted copies of LastPass customers' password vaults by hacking an engineer's home computer and using it to...
AWSPlatform Changes
re:Invent 2022: Amazon Security Lake and Verified Access Previews
At AWS re:Invent in November 2022, AWS announced previews of Amazon Security Lake and AWS Verified Access, alongside other security updates.
AWSHow-To & Hardening
How to Centralize AWS Security Logs With Amazon Security Lake
Amazon Security Lake centralizes and normalizes security logs from AWS and other sources into OCSF format in your own S3 buckets. Here is how to set it up.
AWSHow-To & Hardening
Security Lake Source and Retention Planning Checklist
Use this checklist to plan which data goes into Amazon Security Lake and how long you keep it.
AWSCIO Briefings
CIO Brief: Owning Your Security Data — The OCSF Shift
The short version: In 2022, AWS introduced Security Lake, which stores your security logs in your own cloud account, in a standard format any security tool...
Microsoft 365Platform Changes
Exchange Online Basic Auth Turned Off (Oct 2022): The End of an Era
Beginning October 1, 2022, Microsoft started permanently disabling Basic Authentication in Exchange Online for Exchange ActiveSync, POP, IMAP, Remote...
Microsoft 365How-To & Hardening
How to Verify Legacy Authentication Is Fully Blocked in Your Tenant
Microsoft retired Basic Authentication for most Exchange Online protocols in 2022, but legacy authentication can still appear through SMTP AUTH, other...
Microsoft 365How-To & Hardening
Post-Basic-Auth Cleanup Checklist: SMTP AUTH, Service Accounts and Scripts
After Basic Authentication was turned off in Exchange Online, many organizations found lingering dependencies. Use this checklist to clean up.
Microsoft 365CIO Briefings
CIO Brief: What Broke When Basic Auth Died — and What Got Safer
The short version: In October 2022, Microsoft permanently turned off older sign-in methods for its cloud email after a three-year warning. Some printers,...
AzureIncident Teardowns
BlueBleed (Oct 2022): Misconfigured Azure Blob Storage Exposes Microsoft Customer Data
In October 2022, threat intelligence company SOCRadar reported a data leak it called BlueBleed: a misconfigured Microsoft-owned Azure Blob Storage container...
AzureHow-To & Hardening
How to Audit Azure Storage Accounts for Public Access and Shared Keys
Azure Storage accounts can be exposed through anonymous blob access, overly permissive shared keys and SAS tokens, or public network endpoints. Here is how...
AzureDetection & Response
Detecting Azure Blob Public Access: Defender for Cloud and Sentinel KQL
Public Azure Blob access is often discovered by outsiders scanning for open containers. Detecting both the configuration and anonymous access helps you find...
AzureCIO Briefings
CIO Brief: Storage Misconfiguration Is a Cloud-Agnostic Problem
The short version: In 2022, researchers reported that a misconfigured Microsoft storage location exposed business documents involving Microsoft's customers....
Entra ID & IdentityIncident Teardowns
Uber Breached via MFA Fatigue (Sept 2022): A Contractor, a Push Storm and Hardcoded Admin Secrets
On September 15, 2022, Uber disclosed a network security incident. An attacker had gained access to internal systems including its Slack workspace, cloud...
Entra ID & IdentityHow-To & Hardening
How to Write Conditional Access Policies for Contractors and Guests
Contractors and guests often have less oversight than employees but similar access. Conditional Access lets you apply consistent — or stricter — controls....
Entra ID & IdentityDetection & Response
Detecting MFA Push Bombing: Entra Sign-In Logs and Sentinel KQL
MFA push bombing generates bursts of MFA requests. Even with number matching, attackers try variations. These detections help catch attempts early.
Entra ID & IdentityCIO Briefings
CIO Brief: Contractors Need the Same Security as Employees
The short version: In 2022, Uber was breached through a contractor whose password had been stolen and who eventually approved one of many login prompts....