Public infrastructure can lead to private information. Organizations that need part of their IT infrastructure to interact with the outside world use cybersecurity controls like having a DMZ (Demilitarized Zones) to manage threat exposure to the internet. Even though DMZs are useful for managing traffic from outside the organization, they are not a complete solution …
Enhance incident response with new automated tools. In the previous Essential Microsoft Sentinel Automations blog we discussed the most important automations a SOC should have. Many automations have been created since then, and now we are going to share the newest automations that your Microsoft Sentinel SIEM instance should have. In this blog we will …
Help your users help you protect data. Social engineering is one of the most prevalent ways a malicious actor can gain access to your data because of how easy it is. Phishing emails are so common that they are the initial cause for 80-90% of security incidents. It only takes one user clicking on something …
Discover How to Monitor All Your Email Incidents. Analysts at CyberMSI had recently set up a test environment for Defender for Office 365 with roughly 10 users in it. They found that the test environment was receiving as high as 40 phishing emails a day without any of them generating an incident in the 365 …
Why Am I Not Getting Alerts in Defender for Office 365? Read More »
Planning Helps You Have a Prepared Response in a Crisis. Last December the public and private sectors were both shaken by the Solorigate zero-day attack. Like other zero-day attacks, this type of attack had not been seen before, so it was stressful for everyone involved to put it mildly. Ever since then, cybersecurity analysts at …
Addressing Solorigate and Other Zero-Day Attacks Read More »
One man’s trash is another man’s breach. The term “dumpster diving” is used to refer to looking through discarded items from the organization to get additional information. A malicious actor does not necessarily have to go through a literal dumpster to find information discarded by the organization, but it is a good place to start. …
Spend 30 minutes deciding instead of months researching. Microsoft is delivering best-in-class cloud security products that are being held back by a very complex licensing system. Industry research organizations like Gartner stated this point explicitly in its most recent Magic Quadrant evaluation for endpoint protection platforms. CyberMSI routinely explains Microsoft licensing to its customers. In …
Get more value out of your Microsoft Sentinel incidents with entities. Microsoft Sentinel has a limited set of entities that it will recognize while gathering information about a security incident. We discussed some of these entities in our blog about Alert Enrichment, but we did not get an opportunity to go over the recognized entities …
Entities Recognized by Microsoft Sentinel and the Investigation Graph Read More »
Poor configuration could lead to malicious actors knowing your network better than your admins. Network scanning is an essential active reconnaissance tool used when looking for avenues to breach an organization. If network and security admins do not have a solid understanding of network scanning and how to reduce the impact of the scans, malicious …
Stay on top of a SIEM that is constantly evolving. Microsoft Sentinel is constantly being updated by Microsoft security engineers. This is great for security analysts because they are constantly getting new features to work with. It is also good for admins, but the constant updates also create challenges because there is no formal change …