Ivan Fonseca

Identifying and containing potential threats in the cloud can be a complex task, especially when dealing with shared roles and visibility gaps into who assumed those shared roles. Permiso has a new approach that you might not know about! We monitor and construct the full session of events performed in your IaaS, PaaS, SaaS, CI-CD, IdP environments by the human/ vendor identity and the machine identity assumed by the human/ vendor identity. Then, we apply advanced TTPs by our P0 Labs team to quickly, easily, and confidently tell you if there is a legitimate threat or risky behavior. Security and IAM teams get the full picture of what is happening at runtime and know the exact human, machine, and vendor identities involved. Bonus: alert volume reduction 500 to 1 If you're interested in learning more about our approach, feel free to DM me for a no-commitment overview.

7

I wrote about the various rule combinations I’ve been testing in this post to block known bad and reduce load on the firewall. ~~ Are Your pfSense Filters Really Working? ~~ Too many rules and logs (?) makes them randomly fail ~~ To spot this you need to be monitoring your logs. I have been testing various combinations of rules and noticed this issue in certain scenarios. https://lnkd.in/eknrE6zG

3

Jobs list, details below

2

#NetworkSecurity #EdgeDevices The increase in mass exploitation involving edge services and devices is likely to worsen. The post Edge Devices: The New Frontier for Mass Exploitation Attacks appeared first on SecurityWeek. https://lnkd.in/gkmnukCE

2

🚨 Check Point VPN Zero-Day Alert! 🚨 🔍 Check Point has uncovered a critical zero-day vulnerability in its VPN software, describing it as "extremely easy to exploit." This vulnerability could potentially allow attackers to infiltrate corporate networks and gain unauthorized access to sensitive information. 🛡️ Check Point's swift response to this threat highlights the ongoing battle in cybersecurity to protect digital infrastructures. With cybersecurity professionals constantly working to identify and mitigate such risks, this discovery emphasizes the need for robust security measures and vigilant monitoring. 🌐 This incident also sparks a broader discussion on the importance of proactive cybersecurity strategies and the role of continuous vulnerability assessments in safeguarding organizational data. For more details, you can read the full article below. #cybersecuritycareers #vpnsecurity #zerodayvulnerability #techpolicy #cybersecuritydistrict

6

Great article for a proactive approach on threat hunting within Azure. It’s important to effectively hunt down and mitigate potential risks, ultimately fortifying the security posture.

16

🔍 Unlock access to our Free Detection Engineering Kickstart course and Project! If you're venturing into a career in Detection Engineering, this course is a must! Plus, learn how to get a free Splunk Enterprise license for 60 days to use for your new project! Comment “Access” and I'll send you the details straight to your inbox! #cybersecurity #ellingtoncyberacademy #engineering #siem

14

12 Comments

The only cert on my resume is Sec+. I have no degree. I code and learn in my free time. And I spend all of my time in my head thinking about how to solve hard problems at scale. Thinking about ideas and concepts more than people and events. It’s a powerful skill - practice it. But most importantly, my first year on LinkedIn, I… 👉 Started following hundreds of my industry’s thought leaders. 👉 Analyzed and engaged with their ideas. 👉 Reached out to them and asked for video calls. 👉 Developed (not found) mentors and peer leaders. 👉 Treated people with respect but as equals, no matter their status. 👉 Wrote content about my own research and ideas. 👉 Used all 100 of my connection requests per week, many weeks. 👉 Invested in my office space to stand out on calls! An office background is the new “wearing nice shoes” in my opinion. And have fun with it. When I pulled the trigger on asking for jobs, I had more interested parties than I knew what to do with. I… 👏 didn’t send my resume to HR, but leaders directly. The magical back door of LinkedIn. 👏 was being interviewed directly by multiple CEOs. 👏 got to learn from skilled leaders in over 12 interviews across the two companies. 👏 which both made me offers for the salary I asked for. (I asked high) 👏 for fully remote work. 👏 without using my security clearance. 👏 and for three job roles I hand selected, which I had no official experience in (but many self-started projects). And by building up all the people, processes, ideas, products, and services I engage with, I’ll make sure the leaders and mentors who’ve invested in me see multiple orders of magnitude returns on their investments. But to be capable of that, I had to spend the past decade investing in myself. Not through certs or degrees, but through free online resources and endless curiosity + initiative. YouTube. Stack Exchange. GitHub. Google Scholar. To name a few. But remember to put people first. And surround yourself with the best of them. Give, don’t take. The best people will always give back. Take the initiative to learn from and engage with them. Thanks to all of you who’ve inspired, advised, supported, and engaged with me over the past year+. Especially: ⭐️ Walter Haydock - who mentored me in the ways of risk and business. ⭐️ Ron Sharon - who took the time from his busy life to have a 1:1 call with me and gave great guidance. ⭐️ Chris Hughes - always shared inspiring and helpful wisdom + engages frequently. ⭐️ Jason Rebholz - I’ve learned so much from our engagements. ⭐️ Jonathan Rau - Always has me smirking at his infamous “sh-tposts” that never fail to enlighten about data ops. ⭐️ Jason Firch, MBA - Has introduced me to some awesome people and helped me share. ⭐️ Jonathan Loop MBA, CISSP ⭐️ Patrick Garrity 👾🛹💙 ⭐️ Ambuj Kumar ⭐️ Sumedh B. ⭐️ Leo Meyerovich ⭐️ Harlan Carvey ⭐️ Fernando Tomlinson, MSIT, MBA, CISSP (Ran out of characters - see comment!)

512

58 Comments

Huntress agent added to an endpoint on Saturday; WMI persistence reported, and then today, malicious activity via CVE-2023-48788 reported. Process: 1. Create investigative timeline from WEVTX, EDR telem/detected processes. 2. Run Events Ripper, creating pivot points (installed apps, Defender detections, WMI persistence, activation of xp_cmdshell, PowerShell code run, etc.), as well as installation path of FortiClientEMS. 3. Validate FortiClientEMS CVE-2023-48788 exploit via appropriate Fortigate logs. 4. Based on investigative timeline, there were 4 distinct exploits of CVE-2023-48788 since 2024-03-25, several that included the installation of Atera, with one also including the installation of Splashtop Streamer. Patch, folks. Please patch. And limit access to endpoints as operationally necessary.

98

4 Comments

How to 𝘯𝘰𝘵 introduce yourself on LinkedIn: "Hi" "How are you" "What security roles do you have open?" "Here's my phone number: ..." And yes, I've gotten all of these this week. Just one-line, cold opens. Instead... "Hey Ruby - I really loved your post about X and also graduated from X. I found your X role and have the qualifications you're looking for (list your said experiences quickly). Resume attached. Do you have time today to discuss?" It takes two seconds to find a personal connection based on someone's profile and separates yourself from an overwhelmed inbox. P.S. 𝘐𝘧 𝘺𝘰𝘶'𝘳𝘦 𝘤𝘰𝘱𝘺𝘪𝘯𝘨 𝘢𝘯𝘥 𝘱𝘢𝘴𝘵𝘪𝘯𝘨 𝘯𝘦𝘵𝘸𝘰𝘳𝘬𝘪𝘯𝘨 𝘮𝘦𝘴𝘴𝘢𝘨𝘦𝘴, 𝘥𝘰 𝘯𝘰𝘵 𝘧𝘰𝘳𝘨𝘦𝘵 𝘵𝘰 𝘤𝘩𝘢𝘯𝘨𝘦 𝘵𝘩𝘦 𝘳𝘦𝘤𝘳𝘶𝘪𝘵𝘦𝘳'𝘴 𝘯𝘢𝘮𝘦. 𝘠𝘰𝘶 𝘸𝘪𝘭𝘭 100% 𝘣𝘦 𝘪𝘨𝘯𝘰𝘳𝘦𝘥 𝘪𝘧 𝘺𝘰𝘶 𝘤𝘢𝘭𝘭 𝘮𝘦 𝘚𝘢𝘳𝘢𝘩, 𝘙𝘰𝘣𝘦𝘳𝘵, 𝘰𝘳 𝘋𝘢𝘯.

294

139 Comments

Feeling a bit down 🤣 🤣 🤣 I submitted a Pull Request in Jaeger to address a bug. I completed all 5 checks but overlooked the "commit signature verification" as I utilize multiple GPG keys for various GitHub accounts locally. On another note, I want to introduce a way to enhance security when our company uses git - by using a GPG key to sign Tags and Commits digitally. This action results in a "green checkmark" on GitHub, confirming the commit's authenticity. This method ensures that commits originate from the correct team member within the company, preventing impersonation. #devops #jaeger #github #gpg

28

1 Comment

New pulse is live, this week talking about 5 common blind spots in security programs and some of the unique companies trying to solve them. I've spent the last few weeks really talking a ton about ASPM and CDR, so I wanted to highlight some areas I haven't talked about as much. These are: 1. Securing OAuth Connections - Astrix Security 2. Securing Third Party Data Flows - Riscosity 3. Security Features for your app - Pangea 4. Cloud Identity and Data Perimeters - Sonrai Security and InstaSecure 5. Open Source Maintainer Relationships - Tidelift https://lnkd.in/ew_qs-SM

104

8 Comments