Netwrix Blog | Insights for Cybersecurity and IT Pros

This post first appeared on blog.netwrix.com and was written by Kevin Joyce.
Ransomware attacks are faster and more targeted than ever. This guide explores how attackers gain access, move laterally, and encrypt data—and how to spot early warning signs like privilege escalation or suspicious logins. Includes best practices for response, containment, and improving cyber resilience. In 2024, the average ransom payment surged to nearly $4 million, more … Continued

This post first appeared on blog.netwrix.com and was written by Tatiana Severina.
Introduction Windows Server 2025 introduced delegated managed service accounts (dMSAs) to improve security by linking service authentication to device identities. But attackers have already found a way to twist this new feature into a dangerous privilege escalation technique. The BadSuccessor attack lets adversaries impersonate any user — even domain admins — without triggering traditional alerts. … Continued

This post first appeared on blog.netwrix.com and was written by Farrah Gamboa.
We’re thrilled to announce that Netwrix Access Analyzer has been named a Visionary in Data Security Posture Management (DSPM) at the 2025 Global InfoSec Awards, presented by Cyber Defense Magazine during this year’s RSA Conference. This recognition underscores Netwrix’s commitment to pushing the boundaries of what modern data security solutions can do — especially in … Continued

This post first appeared on blog.netwrix.com and was written by Jeff Warren.
Artificial intelligence is no longer a distant vision—it’s a present-day force reshaping how enterprises manage, process, and secure their data. Among the most influential innovations driving this transformation is Microsoft Copilot. Marketed as an AI-powered productivity enhancer, Copilot integrates seamlessly with Microsoft 365 applications, unlocking new levels of efficiency across industries. However, as with any … Continued

This post first appeared on blog.netwrix.com and was written by Jeremy Moskowitz.
Zero Trust Endpoint Security enforces continuous verification, least privilege, and real-time monitoring at the device level. It addresses threats like privilege abuse, drift, and lateral movement by integrating identity, posture, and behavior data. Key controls include EDR, PAM, DLP, and configuration integrity. Zero Trust extends to OT/IoT, aligning with compliance mandates and modern remote work … Continued

This post first appeared on blog.netwrix.com and was written by Farrah Gamboa.
Data Security Posture Management (DSPM) helps organizations discover, classify, and protect sensitive data across cloud and hybrid environments. With rising AI threats and cloud adoption, DSPM offers real-time visibility, risk prioritization, and policy enforcement. It complements IAM and DAG by revealing exposure and sensitivity, enabling proactive defense against evolving data-centric attacks. Introduction As the cyber … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
Attribute-Based Access Control (ABAC) uses attributes of users, resources, actions, and context to make dynamic access decisions. It enables fine-grained, policy-driven control ideal for complex, regulated environments. ABAC separates enforcement from decision logic via components like PEP, PDP, PIP, and PAP, supporting scalability, auditability, and real-time adaptation across cloud, SaaS, and hybrid infrastructures. What is … Continued

This post first appeared on blog.netwrix.com and was written by Jeremy Moskowitz.
Traditional endpoint security often overlooks critical layers like privilege control, automated policy enforcement, real-time visibility, compliance assurance, and modular scalability. To reduce risk, organizations must enforce least privilege, detect drift, monitor devices, prove compliance, and integrate tools that adapt to evolving threats across all endpoint types and configurations. Most posts about types of endpoint security … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
Modern endpoint security compliance in Windows relies on hybrid management, continuous monitoring, automated patching, and policy enforcement. Migrating from GPOs to CSPs improves scalability and supports remote devices. Integrating with IAM enforces least privilege. Automation, real-time analytics, and role-based controls help reduce risk, ensure compliance, and support evolving management needs. Endpoint security compliance isn’t just … Continued

This post first appeared on blog.netwrix.com and was written by Ian Andersen.
Introduction to ITDR Identity threat detection and response (ITDR) is a cybersecurity discipline focused on detecting, investigating, and responding to threats targeting identity systems like Active Directory (AD) and Entra ID, identity providers (IdPs), and authentication mechanisms. It enhances traditional identity and access management (IAM) by introducing threat intelligence, behavioral analysis, and automated response capabilities … Continued

This post first appeared on blog.netwrix.com and was written by Jonathan Blackwell.
People come and go within your organization, and those who remain move throughout the organization through promotions and transfers. However, the fundamental organizational structure remains relatively stable: Customer support agent, sales rep, HR manager, and software developer represent enduring functional roles, even as individual employees cycle through these positions. This organizational constant provides the perfect … Continued

This post first appeared on blog.netwrix.com and was written by Farrah Gamboa.
Understanding Personally Identifiable Information (PII) Personally identifiable information (PII) is any data that can be used on its own or in combination with other information to identify, contact, or locate an individual. Examples of PII include full name, Social Security number, passport number, driver’s license number,r and biometric data. The term “personally identifiable information” gained … Continued

This post first appeared on blog.netwrix.com and was written by Jeff Warren.
Cloud security monitoring refers to the ongoing surveillance, observation, analysis of cloud-based infrastructure and services to detect security threats, patch vulnerabilities, and address compliance gaps. As cloud environments expand, organizations need effective cloud-based security monitoring tools to ensure those resources remain secured. Although existing security standards such as SIEM, SOAR, or IAM are all essential … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
On April 15th of 2024, ISC² implemented a refreshed set of objectives for the CISSP exam. The goal of refreshing the exam objectives is to keep the exam relevant to the latest happenings in security. As things progress and new technologies are introduced, the objectives are updated to account for them as well as for … Continued

This post first appeared on blog.netwrix.com and was written by Jeremy Moskowitz.
Most IT and security teams think they already have endpoint policy management in place.They’re using Microsoft Intune. Maybe Defender. Maybe a mix of Mobile Device Management, AV, and EDR. But here’s the catch: delivering policies isn’t the same as enforcing them. Without visibility into policy drift, without enforcement at the point of risk, and without … Continued

This post first appeared on blog.netwrix.com and was written by Joe Dibley.
Introduction to Service Principal Names (SPNs) What is an SPN? Even a Windows Admin with some experience with Active Directory may be unaware of the role that Service Principal Names have in domain environments. A security principal name (SPN) is a unique identifier that links a specific service instance to the account running it, enabling … Continued

This post first appeared on blog.netwrix.com and was written by Dirk Schrader.
What Is CMMC? The Cybersecurity Maturity Model Certification (CMMC) is a framework designed by the US Department of Defense (DoD) to enhance the cybersecurity posture of companies within the Defense Industrial Base (DIB). It establishes security requirements that contractors must meet to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) from cyber threats. … Continued

This post first appeared on blog.netwrix.com and was written by Adam Turner.
In today’s competitive IT landscape, certifications serve as valuable credentials that validate technical expertise and enhance career prospects. Whether you’re entering the field or looking to advance, earning the right certification can set you apart from the competition and open doors to better jobs and opportunities. Among the most sought-after IT certifications are CompTIA Security+ … Continued

This post first appeared on blog.netwrix.com and was written by Grady Summers.
Securing a hybrid environment is complex, but uncovering possible security risks within your environment doesn’t have to be. In fact, you can do it asking simple questions without the need to log into a dashboard or dig through manual reports. It only takes you and a single AI prompt.  This isn’t some distant future scenario … Continued

This post first appeared on blog.netwrix.com and was written by Joe Dibley.
Active Directory persistence through userAccountControl manipulation I’ve been doing some research on group Managed Service Accounts (gMSAs) recently, and reading the MS-SAMR protocol specification for some information. I happened to stumbled across some interesting information in the userAccountControl section which made us drop what we were doing to test it: Effectively, when the UF_SERVER_TRUST_ACCOUNT bit … Continued