Authors/Presenters: # Vikas Khanna
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – Unlocking the Gates: Understanding Authentication Bypass Vulnerabilities appeared first on Security Boulevard.
In a recent podcast interview with Cybercrime Magazine's host, Charlie Osborne, Heather Engel, Managing Partner at Strategic Cyber Partners, discusses reports from OpenAI that hackers are trying to use its tools for malicious purposes. The podcast can be listened to in its entirety below.
The post AI in Cybercrime: Hackers Exploiting OpenAI appeared first on Security Boulevard.
Operational Technology (OT) and Industrial Control Systems (ICS) are critical components of many industries, especially those within the 16 critical […]
The post Building and Enhancing OT/ICS Security Programs Through Governance, Risk, and Compliance (GRC) appeared first on Security Boulevard.
Introduction One of the most powerful things to do with data is to visualize it. Being able to see the data in various contexts can help executives and security professionals alike understand their cyber environment better and identify their strengths and weaknesses. Dashboards in Splunk are fairly easy to make but sometimes you may [...]
The post Let’s Build A Dashboard! appeared first on Hurricane Labs.
The post Let’s Build A Dashboard! appeared first on Security Boulevard.
The hard truth is that security breaches often happen because of human mistakes from simple, everyday actions. It's not just employees unknowingly using unsecured Wi-Fi – it's phishing, weak passwords and a lack of awareness that open the door to attackers.
The post The Crucial Influence of Human Factors in Security Breaches appeared first on Security Boulevard.
Ransomware attacks are increasingly targeting critical infrastructure — essential systems like energy, water, transportation and finance. In 2023 alone, over 40% of attacks hit these sectors, according to the FBI. Meanwhile, agencies like CISA and the UK’s NCSC warn infrastructure companies of mounting threats from state-sponsored adversaries or other malicious actors. The recent American Water..
The post Protecting Critical Infrastructure with Zero-Trust and Microsegmentation appeared first on Security Boulevard.
If you’re familiar with platforms like Drata, you may appreciate their streamlined compliance processes and integrations. But if you’re ready for something beyond automation and integration (think powerful AI-driven risk management, live visual dashboards, and extensive framework mappings), Centraleyes delivers in ways Drata just can’t match! Let’s take a closer look at both platforms and […]
The post 10 Best Drata Alternatives to Consider for Compliance Management in 2024 appeared first on Centraleyes.
The post 10 Best Drata Alternatives to Consider for Compliance Management in 2024 appeared first on Security Boulevard.
Discover how servant leadership and a human-centric approach to IAM drive trust, resilience, and impactful results in today’s complex business landscape.
The post Sentient IAM: Unlocking Success Through Human-Centric Leadership first appeared on Identient.
The post Sentient IAM: Unlocking Success Through Human-Centric Leadership appeared first on Security Boulevard.
Smart SOAR’s automated grouping reduces the noise by filtering out irrelevant alerts, enabling a faster and more efficient response.
The post Respond to Fewer Alerts with Automated Grouping appeared first on D3 Security.
The post Respond to Fewer Alerts with Automated Grouping appeared first on Security Boulevard.
Are you a service organization seeking an audit to gain customers’ trust? Or maybe you are looking to attract prospective clients by proving how serious you are with customers’ data. If that is the case, you have come to the right place. Introducing the SOC 2 audit – think of it as a thorough check-up […]
The post SOC 2 Compliance Audit: Safeguarding Your Business’s Data appeared first on Security Boulevard.
How Robust Are Your Machine Identity Solutions? As cybersecurity threats and data breaches continue to soar, the question becomes inevitable: how robust are your machine identity solutions? For many organizations, the answer remains shrouded in ambiguity, leaving them vulnerable to data breaches and non-compliance penalties. However, a new frontier of Non-Human Identity (NHI) and Secrets […]
The post Build Confidence with Robust Machine Identity Solutions appeared first on Entro.
The post Build Confidence with Robust Machine Identity Solutions appeared first on Security Boulevard.
Authors/Presenters: Pete Stegemeyer
Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – A Treasure Trove of Failures: What History’s Greatest Heist Can Teach Us About Defense In Depth appeared first on Security Boulevard.
For IT teams, managing certificates can feel like a relentless cycle of tracking expiration dates, renewing certificates, and monitoring CA chains. Without automation, it’s easy to miss renewals, leading to costly outages and downtime. As your organization scales, manually managing hundreds—or even thousands—of certificates quickly becomes unsustainable. With the imminent shortening of certificate validity periods […]
The post How to Move from Manual to Certificate Automation with ACME first appeared on Accutive Security.
The post How to Move from Manual to Certificate Automation with ACME appeared first on Security Boulevard.
Cybersecurity impacts us all. Third parties process and handle data every day, whether they’re tapping your phone to pay via near-field communication (NFC) or processing a transaction while you pay your utility bill online. The importance of keeping your data private is growing every day: worldwide, cybercrime costs are expected to hit $10.5 trillion annually...
The post How to Motivate Employees and Stakeholders to Encourage a Culture of Cybersecurity appeared first on Hyperproof.
The post How to Motivate Employees and Stakeholders to Encourage a Culture of Cybersecurity appeared first on Security Boulevard.
Microsoft this week launched a raft of cybersecurity initiatives that address everything from making Windows platforms more secure to adding platforms that are more secure by design.
The post Microsoft Adds Raft of Zero-Trust Tools and Platforms appeared first on Security Boulevard.
The software supply chain is under siege. Threat actors increasingly exploit weaknesses in code repositories, dependencies and mismanaged secrets to infiltrate and disrupt software development processes. In response, organizations are turning to robust strategies to safeguard their supply chains, including tools like SCA scanning, AI and container security, secrets detection and repository health monitoring. Checkmarx’s..
The post Securing the Software Supply Chain: Checkmarx One Expands its Offerings appeared first on Security Boulevard.
In today’s security landscape, the concept of a hardened perimeter is increasingly insufficient. With the rise of hybrid and multi-cloud environments, lateral movement attacks, where attackers move through internal systems once a breach has occurred, have emerged as a significant threat.
The post Shift Left and Shift Up Workload Attack Surface Protection appeared first on TrustFour: Workload Identity and Interaction Security - mTLS Workload MFA.
The post Shift Left and Shift Up Workload Attack Surface Protection appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Kedging Cannon’ appeared first on Security Boulevard.
This post details the existing and new functions in BARK that support adversarial tradecraft research relevant to the Azure Key Vault service. The latter part of the post shows an example of how a red team operator may use these commands during the course of an assessment.
AuthenticationAzure Key Vault is one of the few services in Azure with a dedicated API for data plane operations. When performing calls to the Azure REST API and the Azure Key Vault REST API, you must provide authentication in the form of a bearer token. That token must have the correct audience.
BARK has the following functions for requesting tokens for use with the Azure REST API:
BARK has the following functions for requesting tokens for use with the Azure Key Vault REST API:
BARK has the following function for enumerating key vaults via the Azure REST API:
BARK has the following functions for enumerating key vault items via the Azure Key Vault REST API:
BARK has the following functions for manipulating permissions on key vaults and key vault items via the Azure REST API:
BARK has the following function for collecting key vault secret values via the Azure Key Vault REST API:
BARK has the following functions for encrypting and decrypting data via the Azure Key Vault REST API:
During a red team assessment, the operator may find they have read access into one or more Azure Resource Manager (ARM) subscriptions, giving them the ability to enumerate resources in the subscription(s). The operator wants to find all key vaults under a given subscription.
First they must request a token with ARM REST API as the audience. There are several ways to do this and all depend on what level of access the operator has. We will go with a simple example: the operator has plaintext credentials for a valid user. With those credentials, the operator can use BARK’s Get-AzureRMTokenWithUsernamePassword to request a token:
$ARMToken = (Get-AzureRMTokenWithUsernamePassword `Next, the operator can identify all subscriptions they have read access into with BARK’s Get-AllAzureRMSubscriptions function:
$Subscriptions = Get-AllAzureRMSubscriptions -Token $ARMTokenTo find all key vaults under each subscription, the operator can use PowerShell to loop through each subscription and pass its ID to BARK’s Get-AllAzureRMKeyVaults:
$KeyVaults = $Subscriptions | %{Now the operator can attempt to enumerate secrets, keys, and certificates under each key vault; however, the Azure Key Vault REST API serves these operations, so they must first get a token with the correct audience. They can do that with BARK’s Get-AzureKeyVaultTokenWithUsernamePassword:
$KeyVaultToken = (Get-AzureKeyVaultTokenWithUsernamePassword `Now the operator can use that token in conjunction with BARK’s key vault item enumeration functions to list those items under each key vault:
$KeyVaultSecrets = $KeyVaults | %{An example of what these variables look like from our research environment:
PS /> $KeyVaultSecretsThe operator can attempt to read the value of a secret using BARK:
Get-AzureRMKeyVaultSecretValue `Here is an example of what the output looks like from our research environment:
PS /Users/andyrobbins/Documents/SpecterOps/BHE/bloodhound-enterprise> Get-AzureRMKeyVaultSecretValue `In the above example, “secret1value” is the plaintext value of the secret.
The operator can also attempt to encrypt data using the key vault keys with BARK:
Protect-StringWithAzureKeyVaultKey `An example of the command running and its output:
PS /> Protect-StringWithAzureKeyVaultKey `The operator can also decrypt this data or any other data encrypted using this particular key:
Unprotect-StringWithAzureKeyVaultKey `An example of the command running and its output:
PS /> Unprotect-StringWithAzureKeyVaultKey `Key Vault certificates store their public portion within the certificate object and their private portion within a secret. The operator can correlate the certificate and secret identifiers to identify certificate private keys:
PS /> $KeyVaultCertificatesOnce identified, the operator can attempt to extract the certificate’s private key with BARK’s Get-AzureRMKeyVaultSecretValue:
Get-AzureRMKeyVaultSecretValue `An example of the command running and its output:
PS /> Get-AzureRMKeyVaultSecretValue ` >> -KeyVaultSecretID 'https://keyvaultazurerbac.vault.azure.net/secrets/MyCertificate' `We use these commands primarily to validate Microsoft’s documentation on how these APIs function, in particular how ARM and Azure Key Vault APIs make authorization decisions. Defenders can use and build upon these functions to automate key vault inventory and audit processes. Professional red team operators can use and build upon these functions to perform authorized assessment-related actions like reconnaissance, credential access, and payload encryption and decryption.
Azure Key Vault Tradecraft with BARK was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Azure Key Vault Tradecraft with BARK appeared first on Security Boulevard.
BSODs begone! Redmond business leaders line up to say what’s new in Windows security.
The post Microsoft Veeps Ignite Fire Under CrowdStrike appeared first on Security Boulevard.
