Defence
Recently this subject has come up again, so thought I would create a post.
By default Windows comes with Quick assist, an RDP based service with is encapsulated in HTTPS, it allows users to both offer and request assistance between two Windows machines (remote control). You can read more here:
https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
Read more “Disable and Remove Windows Quick Assist”
Education
If we look at the reality of cyber security on a personal level, it’s insanely complex. There are hundreds if not thousands of details that matter, under the microscope security is incredibly complex and contextual. Which makes it a nightmare outside of simple abstractions, because things get complex fast.
Read more “Making cyber security relatable to people”
Defence
Ok this morning I woke up really really early! I then went on a bit of a KQL thread on twitter, and then IRL work destroyed my plans to play in the lab. However I’m publishing this in its current state [use at own risk etc.] because I think it might help people! So let’s get to it:
These queries can help you identify 3 common active directory attack techniques from logs on a domain controller (this does not rely on ADCS logs etc.)
Read more “Hunting for common Active Directory Domain Services Exploitations”
Leadership
A massively common analogy I see in security is the idea that security is like paying for insurance incase something goes wrong. I think this is great if you have 3 seconds only to describe security, but that’s not really how I have conversations with people. A sound bite isn’t reality, and to be honest I personally find that rather meaningless. I also know that many people don’t like or even pay for a range of insurance so when we look at how we try and improve digital security from a whole of society perspective, I think this phrase doesn’t work, it’s too narrow…
Read more “The business ‘value’ of Cyber Investments”
Defence
Ok that subject is massive…so this is a bit more of a targeted thought process to consider.
Each network is unique and technology deployments vary. One time I was in a network that was almost entirely Apple MacBooks and a door control panel…. which was ‘fun’.
So this is a general list of some things to consider if you have tech deployed such as:
Defence
Ok so here’s the thing, I do NOT like getting pwn3d! I think you probably would rather your organisation does not too!
What I really don’t want to occur is a ransomware event! They suck, they are like a digital bomb going off.
So I’ve knocked up a quick list to get people thinking (these are NOT all the vulnerabilities I networks you should care about.. but they are some that could lead to a ransomware event!)
Read more “What are the top Active Directory Security vulnerabilities I care about?”
Threat Intel
I’ve not blogged in a while, but I wanted to put down a note of some useful tools people can use to help them combat cyber crime.
This isn’t going to be an in depth look at each tool, however I do want to, in the near future, try and do some demos/videos etc. of how to investigate potential/suspected or identified threats. I’ll drop a list of some of the useful tools below and also do a quick demo of investigating an event (from this blog)
Read more “Threat Analysis Tools”
Education
The digital world is complex and cyber threats appear to be around every corner. What we need to do however is look at how we can enable people and keep them safe from common (realistic) threats that they will almost certainly face (rather than saying everything is a risk!), The intent of this post is to tackle key common threats, risks and vulnerabilities (and countermeasures). It is high level, it is a generic and general, it is not a bespoke tailored guide for each person. It does not cover every single risk scenario someone may face, it simply looks at what I think people may want to focus on (given what I see). (I’m having to caveat this loads to try and stop the tin foil hat loonies making a scene about edge cases I haven’t covered)
Read more “Cyber Tips for Normies (without the FUD)”
Education
This week NCSC have begun accepting UK schools for access to the PDNS.
https://www.ncsc.gov.uk/blog-post/introducing-pdns-for-schools
to register (if you are eligible) use this URL: https://www.protectivedns.service.ncsc.gov.uk/pdns
you can view the terms and conditions here: https://www.signin.service.ncsc.gov.uk/terms-and-conditions
PDNS is a protective DNS service which helps protect public sector organisations (and private sector services who deliver government services)
https://www.ncsc.gov.uk/information/pdns
PDNS is delivered by Nominet. Read more “Protective DNS (PDNS) by NCSC UK adds UK schools”
Defence
I talk to hundreds or maybe even thousands of people online. I work in the Cyber security industry, I worked previously with central government, local authorities, finance, third sector, healthcare, defence and well most verticals of business. I often see people comment online about how “GCHQ has failed” or some other silly nonsense when it comes to an organisation (not GCHQ) being victim to a cyber incident.
I fear the world has watched a few too many Bond and Bourne films and let’s their imaginations run wild! The true reality of defending cyberspace is frankly vastly different to what I think people believe it is.
Read more “No one is responsible for your OWN Cyber Defences other than you! “