Security Boulevard

Axio’s CRQ Included in Gartner’s 2024 Hype Cycle for Cyber-Risk Management Historically, Gartner’s Hype Cycle for Cyber Risk 2024 focused more on benchmarking and probability, but it has now increased

Read More

The post Gartner’s 2024 Hype Cycle for Cyber-Risk Management Focuses More on Impact appeared first on Axio.

The post Gartner’s 2024 Hype Cycle for Cyber-Risk Management Focuses More on Impact appeared first on Security Boulevard.

Introducing Hybrid Attack Paths Death from Above: An Attack Path from Azure to Active Directory With BloodHound

When we introduced Azure Attack Paths into BloodHound, they were added as a completely separate sub-graph. At no point did Active Directory (AD) and Azure connect within a BloodHound dataset. Ever since adding Azure (honestly, even before that), we’ve wanted to solve that problem. We’re so very excited to introduce the first version of what we’ve taken to calling a “hybrid path” into BloodHound!

Microsoft Entra Cloud Sync and Microsoft Entra Connect Sync allow administrators to synchronize users from on-premises AD domains up to Entra ID tenants. Additionally, administrators can choose to enable a feature called “Password Hash Synchronization”, which replicates the password hashes from the on-premises user up to its Entra ID counterpart. This allows users to authenticate to Entra/Azure resources using their on-premises AD User Principal Name (UPN) and password. This creates Attack Paths from on-premises AD to Entra ID.

As of BloodHound v5.13.0, when data is collected from an Entra ID tenant as well as an AD domain with users synced between them, BloodHound will automatically generate Hybrid Attack Paths in the graph. Conveniently named “SyncedToADUser” and “SyncedToEntraUser”, these edges indicate where two users are synchronized, which may mean control of one grants control of the other. These edges are generated utilizing the “onpremsyncenabled” and the “onpremid” properties that result from an AzureHound collection. If an Entra ID user object is described as being synced (indicated by a “True” value in the “onpremsyncenabled” field), an edge will be added between the Entra ID user and the AD user identified in the “onpremid” field.

In the below screenshots, you can see the JD Entra ID user has sync enabled with an associated Object ID of the JD AD object displayed.

The Azure User Entity Panel showing the On Prem ID The AD User Entity Panel showing the a matching Object ID

To support these changes, we’ve included several additional pre-built queries in BloodHound for potentially interesting paths for hybrid environments. After clicking on the “Open” folder on the Cypher tab, these queries are available underneath the Azure section:

Cross Platform Attack Paths in Pre-Built Queries

Here’s a set of results from our example dataset for the pre-built query named on-premises Users synced to Entra Users with Entra Admin Roles:

Pathfinding also supports Hybrid Paths, which can uncover those configurations that allow BloodHound to cross from on-prem AD to Azure or vice versa. Here, we show a path starting from anyone in the on-premises domain to Global Administrators in Entra via ADCS and synced user accounts:

Domain Users (AD) to Global Administrators (Azure)

We are very excited to introduce these new edges into the product for testing and validation of hybrid environments. We are already hard at work to research and introduce additional hybrid paths, including computer object synchronization. Additionally, we are developing a capability within BloodHound Enterprise that will enable us to empirically measure the risk to our customers’ critical Tier Zero assets across these hybrid paths. We look forward to sharing more with everyone soon!

BloodHound Enterprise Attack Paths View Improvements

To kick off the start of the many UI improvements we have planned this year, we released an updated attack paths page for BloodHound Enterprise customers with increased readability and enhanced granularity:

New Attack Paths View in BloodHound Enterprise

First, we re-oriented the attack graph to a more familiar left-to-right view versus top to bottom:

This layout now clearly identifies the Tier Zero / critical asset group and states the current exposure for the domain or tenant.

A domain with 99% exposure highlighting an Active Directory Certificate Services Attack Path

We are also introducing a new attribute in this view called “Exposed Principals”. BloodHound Enterprise has always calculated this value but has previously only represented it as a percentage; now this is directly stated as a numeric value in the Attack Path view for additional clarity:

Today in BloodHound Enterprise, Attack Paths are given a severity rating based on their exposure percentage to Tier Zero:

• Critical — 96%+ Exposure
• High — 81–95% Exposure
• Moderate — 41–80% Exposure
• Low — 0–40% Exposure

Now we can not only report the percentage of identities and resources that have an Attack Path, but also include the raw count. This is helpful in large domains where Exposure percentage could be low (30% for example) and the count is useful to still articulate that “This Attack Path exposes Tier Zero to 35,364 principals”.

This number is included in both the Attack Path detail and the graph:

Next, we’ve included the count of findings within the header for every Attack Path:

This allows our users to understand the level of effort to help them better prioritize where to start. In this case, we have two Attack Path choke points that can be completely remediated with less effort.

The Attack Path choke points have also been given more viewable space (50% versus 30%) to make it easier to read the details and we’ve also added a button to drop the results to CSV:

You’ll also notice new helpful columns have been added to the findings details based on the type of Attack Path. For example, we’ve included the age of the password in the “Kerberoastable Users” findings as an indication of which passwords maybe easier to crack:

Introducing Dark Mode for BloodHound

Dark mode is now in early access for both BloodHound Community Edition and BloodHound Enterprise:

ADCS Attack Paths in sweet, sweet darkness Hybrid Attack Paths at

Dark mode can be enabled / disabled through the settings cog on the upper right-hand side of the product (after enabling in Early Access):

For our Enterprise customers, this new theme applies to all portions of the product:

Dark mode in Attack Paths view in BloodHound Enterprise Dark mode in detailed remediation in BloodHound Enterprise Domain security posture over time in dark mode in BloodHound Enterprise

We also standardized our light theme across the product to be more consistent and set up the introduction of other themes in the future. Try it now to remove some of that eye strain and let us know your thoughts!

Going to BlackHat next week? Check out all the updates in person at our booth (#2600) or come hang out with us and a ton of other amazing industry folks at our bowling party on Wednesday evening: https://events.humanitix.com/specterops-black-hat-happy-hour-at-brooklyn-bowl

Hybrid Attack Paths, New Views and your favorite dog learns an old trick was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Hybrid Attack Paths, New Views and your favorite dog learns an old trick appeared first on Security Boulevard.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Chili Tornado Quake’ appeared first on Security Boulevard.

AttackIQ has released a new attack graph that emulates the behaviors exhibited by Prestige ransomware since the beginning of its activities in October 2022. Prestige has been observed targeting organizations in the transportation and related logistics sectors located in Ukraine and Poland. In November 2022, it was assessed that the Russian adversary known as Sandworm was most likely behind these attacks.

The post Emulating Sandworm’s Prestige Ransomware appeared first on AttackIQ.

The post Emulating Sandworm’s Prestige Ransomware appeared first on Security Boulevard.

Pragmatic politics: Anger as Putin gets back two notorious cybercriminals

The post Prisoner Swap: Huge Russian Hackers Freed — Seleznev and Klyushin appeared first on Security Boulevard.

A network vulnerability scan checks and evaluates security vulnerabilities in a computer network. It uses special software to look at systems, devices, and apps in a network to find possible vulnerabilities. These might include outdated software wrong setups, or security gaps. Network vulnerability scanning aims to spot and rank security risks, so organizations can fix […]

The post Network Vulnerability Scan: Detailed Overview appeared first on Kratikal Blogs.

The post Network Vulnerability Scan: Detailed Overview appeared first on Security Boulevard.

Authors/Presenters:Jesse De Meulemeester, Antoon Purnal, Lennert Wouters, Arthur Beckers, Ingrid Verbauwhede

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – SpectrEM: Exploiting Electromagnetic Emanations During Transient Execution appeared first on Security Boulevard.

Opal Security this week updated its privilege posture management platform to provide the ability to detect irregular access to an IT environment and manage privileges by groups.

The post Opal Security Extends Scope and Reach of Platform for Managing Privileges appeared first on Security Boulevard.

Philadelphia, PA, Aug. 1, 2024, CyberNewsWire — Security Risk Advisors (SRA) announces the launch of VECTR Enterprise Edition, a premium version of its widely-used VECTR platform for purple teams and adversary management program reporting and benchmarking.

VECTR Enterprise is … (more…)

The post News alert: Security Risk Advisors launchs VECTR Enterprise Edition for ‘purple team’ benchmarking first appeared on The Last Watchdog.

The post News alert: Security Risk Advisors launchs VECTR Enterprise Edition for ‘purple team’ benchmarking appeared first on Security Boulevard.

When it comes to financial services, retail, or any other industry that handles credit card information, Application Programming Interfaces (APIs) play a pivotal role in connecting systems, enabling seamless transactions, and facilitating real-time data exchange. For organizations handling payment card information, adherence to the Payment Card Industry Data Security Standard (PCI DSS) 4.0 is essential […]

The post Achieving PCI DSS 4.0 Compliance with API Security appeared first on Cequence Security.

The post Achieving PCI DSS 4.0 Compliance with API Security appeared first on Security Boulevard.

Insight #1

Per IBM, the average cost of a data breach is now closing in on $5 million. You know what causes many of those breaches? Account compromise due to lack of multifactor authentication (MFA). It doesn't cost you $5 million to enable MFA. What are you waiting for?

 

The post Cybersecurity Insights with Contrast CISO David Lindner | 8/2/24 appeared first on Security Boulevard.

Israeli hacktivist group WeRedEvils reportedly attacked Iran's Wi-Fi infrastructure, knocking out internet service in parts of the country amid growing tensions following Israel's assassination this week of a Hamas leader in Iran.

The post Iranian Internet Attacked by Israeli Hacktivist Group: Reports appeared first on Security Boulevard.

By Deb Radcliff, DevSecOps analyst and editor of CodeSecure’s TalkSecure educational content (syndicated at Security Boulevard & YouTube) In this show, Deb interviews two innovative technologists driving the DevOps Automated Governance movement. They’re both authors, prolific writers, speakers, and contributors to reference architectures and other materials supporting Automated DevOps Governance. Bill Bensing, whose mantra is…

The post Toil Not: Automate DevOps Governance appeared first on CodeSecure.

The post Toil Not: Automate DevOps Governance appeared first on Security Boulevard.

Integrating security into DevOps workflows has become a critical task, especially in Linux environments. As organizations increasingly rely on DevOps to streamline software development and deployment, ensuring robust security measures is essential to mitigate risks and protect sensitive data. This article delves into the importance of Linux security automation and how to effectively integrate security […]

The post Securing DevOps Workflows in Linux: Linux Security Automation and Orchestration Tools appeared first on TuxCare.

The post Securing DevOps Workflows in Linux: Linux Security Automation and Orchestration Tools appeared first on Security Boulevard.

As per recent media reports, multiple SAP AI Core vulnerabilities have been discovered by cybersecurity researchers. This is a cloud-based platform used for creating and deploying AI workflows. In this article, we’ll look at how these SAP AI Core flaws were discovered and what they could be exploited for. Let’s begin!  SAP AI Core Vulnerabilities: […]

The post Alert: SAP AI Core Vulnerabilities Put Customer Data At Risk appeared first on TuxCare.

The post Alert: SAP AI Core Vulnerabilities Put Customer Data At Risk appeared first on Security Boulevard.

A solid cybersecurity program can help prevent cyberattacks, protect networks and communication and give both employers and remote employees peace of mind.

The post Navigating Indispensable Cybersecurity Practices for Hybrid Working Professionals appeared first on Security Boulevard.

Identity security and data security must be addressed simultaneously for an organization’s security posture to address security risks and threats adequately.

The post The Unbreakable Bond: Why Identity and Data Security are Inseparable appeared first on Security Boulevard.

With the rise of AI, NHIs (non-human identities) are booming, and attacks are becoming increasingly identity-first and AI-powered, making them faster, evasive and more sophisticated.

The post CSMA Starts with Identity A Comprehensive Approach to Modern Cybersecurity appeared first on Security Boulevard.

The post How to Prepare for the Cyber Resilience Act appeared first on AI-enhanced Security Automation.

The post How to Prepare for the Cyber Resilience Act appeared first on Security Boulevard.

Recent cybersecurity vulnerabilities reported on the National Institute of Standards and Technology (NIST)’s National Vulnerability Database pose significant risks to organizations worldwide. Without mitigation, data breaches and system compromises are possible. July’s CVE news includes critical updates and patches for various high-severity vulnerabilities. Check out the vulnerabilities reported from last month to keep your organization...

The post Recent Vulnerabilities in Cybersecurity: July 2024 CVE Roundup appeared first on TrueFort.

The post Recent Vulnerabilities in Cybersecurity: July 2024 CVE Roundup appeared first on Security Boulevard.