I recently did a webinar on Token theft where I broke down one of the fastest growing attacks: Token theft via AiTM phishing. In this article, I will summarize that webinar and provide my top protections to both prevent and mitigate this type of attack. Understanding the Kill Chain Token theft via AiTM is performed […]
In this post, we’ll explore how the Australian Cyber Security Centre’s Essential Eight framework maps directly to Microsoft 365 security controls—and how you can automate evidence collection and policy checks across your tenant. Today, we’ll: Walk through each of the eight mitigation strategies Show the Microsoft 365 tools and licensing needed to implement them Highlight […]
In a previous post, I walked you through an incident response playbook for Token Theft via AiTM. This playbook can be leveraged for BEC incidents as well. Today’s deep dive is going to look at proactive protections you can put into place to PREVENT these attacks altogether. We will be focusing on Conditional Access Policies […]
Microsoft is currently in preview with a new session attribute in Conditional Access policies that Requires token protection for sign-ins. Full Details: Microsoft Entra Conditional Access token protection explained – Microsoft Entra ID | Microsoft Learn Microsoft recently changed the licensing requirement to make this available in Entra ID P1 licensing. With that said, there are […]
Token theft is one of the fastest growing attack methods. Lately, I talk to one customer or MSP a week that has had some form of breach that involved this attack which extended into business email compromise. In today’s post, I am going to provide you my recommended incident response playbook that you can leverage […]
Have you ever opened a seemingly harmless Word document, only to have it trigger a script that could have encrypted your entire device? What saved you from disaster? It could very well have been an invisible defense mechanism you didn’t even know existed—Attack Surface Reduction (ASR) rules in Microsoft 365. In this blog post, we’ll […]
As organizations become more dependent on third-party applications, managing and securing these apps has become increasingly complex. If you’re looking for a streamlined solution to manage and update these applications, you’re in the right place. In this blog post, I’ll walk you through how you can leverage Microsoft Defender and Microsoft Intune to remediate software […]
If your organization manages macOS devices, enabling continuous security monitoring is critical—especially with rising threats targeting all endpoints. Microsoft Defender for Endpoint provides 24/7 active vulnerability scanning for macOS, but setup requires several key steps. Here’s a high-level overview to help IT teams get started and scale deployment through automation. 🔧 Prerequisites & Setup Strategy […]
Imagine you had a window in your house with a broken lock. Anyone could open it and climb right in. Now imagine your neighbor posts about it on Next Door for everyone to see. Would you quickly try to fix the lock? Most likely! This is the same mindset we need when managing software vulnerabilities […]
If you’ve ever used your Microsoft 365 credentials to log in to a third-party app or set up a workflow integration, then congratulations — you’ve interacted with an OAuth application. These apps are everywhere in modern cloud environments, and while they enable powerful integrations and automation, they can also introduce significant risk if left unchecked. […]
Managing a software application inventory for a business can feel overwhelming. With the rapid proliferation of SaaS tools, lack of governance, and users signing up for applications on their own, businesses face serious security and compliance risks. If software applications aren’t properly tracked and secured, organizations risk data leaks, unauthorized access, and exposure to security […]
How many of you can confidently say that your business maintains a centralized and approved application inventory? If you’re like most organizations, the answer is either “no” or “we have one, but it’s incomplete.” And honestly, that’s not entirely your fault. With the rise of SaaS tools, ease of access, and the ability for employees […]
