Netwrix Blog | Insights for Cybersecurity and IT Pros

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
What is Attribute Based Access Control (ABAC)? ABAC is an access control paradigm where access rights are granted through the use of attributes associated with: Access decisions are made using policy rules that evaluate these attributes. For example, a doctor can access patient records only if they are on duty and the patient is in … Continued

This post first appeared on blog.netwrix.com and was written by Jeremy Moskowitz.
Most posts about types of endpoint security mention antivirus software, firewalls, or maybe EDR/XDR. And while those security technologies are important, they’re not enough. Cyberattacks have evolved. Today’s cyber threats target laptops, smartphones, and even IoT devices. Ransomware moves laterally. Zero-day exploits bypass signature-based defenses. Phishing attacks hit the end-user, not just the firewall. That’s … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
Endpoint security compliance isn’t just about meeting regulatory requirements—it’s about building a robust security architecture that protects your organization from advanced threats. As more businesses adopt modern management frameworks for Windows devices, ensuring compliance while enhancing security is a critical challenge. Traditional endpoint management primarily focuses on device administration and configuration with a rather reactive … Continued

This post first appeared on blog.netwrix.com and was written by Ian Andersen.
Introduction to ITDR Identity threat detection and response (ITDR) is a cybersecurity discipline focused on detecting, investigating, and responding to threats targeting identity systems like Active Directory (AD) and Entra ID, identity providers (IdPs), and authentication mechanisms. It enhances traditional identity and access management (IAM) by introducing threat intelligence, behavioral analysis, and automated response capabilities … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
People come and go within your organization, and those who remain move throughout the organization through promotions and transfers. However, the fundamental organizational structure remains relatively stable: Customer support agent, sales rep, HR manager, and software developer represent enduring functional roles, even as individual employees cycle through these positions. This organizational constant provides the perfect … Continued

This post first appeared on blog.netwrix.com and was written by Farrah Gamboa.
Understanding Personally Identifiable Information (PII) Personally identifiable information (PII) is any data that can be used on its own or in combination with other information to identify, contact, or locate an individual. Examples of PII include full name, Social Security number, passport number, driver’s license number,r and biometric data. The term “personally identifiable information” gained … Continued

This post first appeared on blog.netwrix.com and was written by Jeff Warren.
Cloud security monitoring refers to the ongoing surveillance, observation, analysis of cloud-based infrastructure and services to detect security threats, patch vulnerabilities, and address compliance gaps. As cloud environments expand, organizations need effective cloud-based security monitoring tools to ensure those resources remain secured. Although existing security standards such as SIEM, SOAR, or IAM are all essential … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
On April 15th of 2024, ISC² implemented a refreshed set of objectives for the CISSP exam. The goal of refreshing the exam objectives is to keep the exam relevant to the latest happenings in security. As things progress and new technologies are introduced, the objectives are updated to account for them as well as for … Continued

This post first appeared on blog.netwrix.com and was written by Jeremy Moskowitz.
Most IT and security teams think they already have endpoint policy management in place.They’re using Microsoft Intune. Maybe Defender. Maybe a mix of Mobile Device Management, AV, and EDR. But here’s the catch: delivering policies isn’t the same as enforcing them. Without visibility into policy drift, without enforcement at the point of risk, and without … Continued

This post first appeared on blog.netwrix.com and was written by Joe Dibley.
Introduction to Service Principal Names (SPNs) What is an SPN? Even a Windows Admin with some experience with Active Directory may be unaware of the role that Service Principal Names have in domain environments. A security principal name (SPN) is a unique identifier that links a specific service instance to the account running it, enabling … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
What Is CMMC? The Cybersecurity Maturity Model Certification (CMMC) is a framework designed by the US Department of Defense (DoD) to enhance the cybersecurity posture of companies within the Defense Industrial Base (DIB). It establishes security requirements that contractors must meet to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) from cyber threats. … Continued

This post first appeared on blog.netwrix.com and was written by Adam Turner.
In today’s competitive IT landscape, certifications serve as valuable credentials that validate technical expertise and enhance career prospects. Whether you’re entering the field or looking to advance, earning the right certification can set you apart from the competition and open doors to better jobs and opportunities. Among the most sought-after IT certifications are CompTIA Security+ … Continued

This post first appeared on blog.netwrix.com and was written by Grady Summers.
Securing a hybrid environment is complex, but uncovering possible security risks within your environment doesn’t have to be. In fact, you can do it asking simple questions without the need to log into a dashboard or dig through manual reports. It only takes you and a single AI prompt.  This isn’t some distant future scenario … Continued

This post first appeared on blog.netwrix.com and was written by Joe Dibley.
Active Directory persistence through userAccountControl manipulation I’ve been doing some research on group Managed Service Accounts (gMSAs) recently, and reading the MS-SAMR protocol specification for some information. I happened to stumbled across some interesting information in the userAccountControl section which made us drop what we were doing to test it: Effectively, when the UF_SERVER_TRUST_ACCOUNT bit … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
PowerShell Replace String    Being able to find and replace specific text within strings is useful for many tasks, including data processing, automation and file management. For instance, replacing outdated information with current data is important for data standardization. PowerShell offers two primary methods for string replacement: Handpicked related content: [Free eBook] Windows PowerShell Scripting Tutorial … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
Introduction: The Rise of AI Assistants in the Workplace Bob Dylan’s classic song The Times They Are a-Changin’ feels more relevant than ever as AI continues to transform our daily lives. Today, countless computer users rely on AI assistants to boost productivity and streamline their workflows. In many ways, these tools act as copilots, offering support and … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
Introduction to Exchange Online PowerShell Exchange Online PowerShell is a command-line management interface for administering and automating tasks in Exchange Online, which is a part of Microsoft 365. It allows administrators to manage user mailboxes, configure organizational settings, and perform bulk operations efficiently through scripting. Here are some benefits of using PowerShell for Exchange Online … Continued

This post first appeared on blog.netwrix.com and was written by Farrah Gamboa.
An Introduction to Microsoft Copilot for Security In the constantly evolving world of cybersecurity, defense teams need all the resources they can get to keep up. Fortunately, the massive advances in generative AI present SOC teams with a powerful set of tools to optimize security practices and match even fully automated adversaries using natural language … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
Introduction to PowerShell 7 PowerShell 7 is a modern, cross-platform (Windows, macOS, and Linux) automation and configuration management tool that builds on the features of Windows PowerShell. It is based on the .NET Core runtime, unlike previous versions of PowerShell that relied on the Windows-only .NET Framework. This shift has allowed for significant improvements in … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
Grep (Global Regular Expression print) command is a powerful text searching utility in Unix/Linux systems. Grep takes a pattern such as a regular expression or string and searches one or more input files for the lines that contain the expected pattern. Grep command can be significantly used for text searching and filtering, log analysis, code … Continued