Carolyn Manis Sorensen

🛡️ Identity and Access Management (IAM)🌐 In today’s digital landscape, managing **who has access to what** within an organization is critical for protecting sensitive data and maintaining compliance. This is where **Identity and Access Management (IAM)** comes into play. #### What is IAM? **IAM** is a framework of policies and technologies that ensures the right individuals have appropriate access to resources, systems, and data at the right time. By managing digital identities, organizations can secure their systems from unauthorized access while allowing seamless operations for legitimate users. #### Key Components of IAM: 1. **User Authentication**: Verifying user identities through methods like passwords, biometrics, and multi-factor authentication (MFA). 2. **Authorization**: Ensuring users only have access to the resources they need based on their role (role-based access control). 3. **User Lifecycle Management**: Managing users from onboarding to offboarding, ensuring access permissions are granted, adjusted, or revoked as necessary. 4. **Access Monitoring & Reporting**: Continuous tracking of who accesses what, when, and how, enabling rapid response to suspicious activity. 5. **Single Sign-On (SSO)**: Simplifying access by allowing users to authenticate once and gain access to multiple applications without repeatedly logging in. #### Why is IAM Critical?  - **Mitigates Insider Threats**: Proper role-based access limits what each employee can do, reducing the risk of data breaches from insiders. - **Ensures Compliance**: IAM solutions help businesses comply with regulations like GDPR, HIPAA, and SOX, by ensuring strict access controls. - **Supports Remote Work**: With more employees working remotely, IAM ensures secure access to company systems and data from anywhere. - **Prevents Data Breaches**: By enforcing strong authentication measures, including MFA, IAM reduces the risk of unauthorized access. #### Benefits of Implementing IAM: - **Enhanced Security**: Protects against identity theft and data breaches by ensuring only authenticated and authorized users have access to critical systems. - **Improved User Experience**: SSO and other IAM features reduce password fatigue for users, streamlining their access to necessary tools and applications. - **Operational Efficiency**: Automates user access provisioning and de-provisioning, saving time and reducing errors. #### IAM in Action: Industries like finance, healthcare, and government rely heavily on IAM to manage thousands of user identities and safeguard highly sensitive information. Whether it’s protecting customer data or ensuring that employees only have access to the systems they need, IAM is the backbone of digital security. #Cybersecurity #IAM #IdentityAndAccessManagement #DataSecurity #AccessControl #MFA #SSO #Compliance #Infosec

4

1 Comment

Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications: A critical security flaw has been disclosed in the Apache Avro Java Software Development Kit (SDK) that, if successfully exploited, could allow the execution of arbitrary code on susceptible instances. The flaw, tracked as CVE-2024-47561, impacts all versions of the software prior to 1.11.4. "Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute https://lnkd.in/g-eVMFCj

2

It is easy to protect PL/SQL from leaking your algorithms and code. - https://lnkd.in/eppqxvjw #plsql #protect #securecode

7

New Golang-Based Zergeca Botnet Capable of Powerful DDoS Attacks: Cybersecurity researchers have uncovered a new botnet called Zergeca that's capable of conducting distributed denial-of-service (DDoS) attacks. Written in Golang, the botnet is so named for its reference to a string named "ootheca" present in the command-and-control (C2) servers ("ootheca[.]pw" and "ootheca[.]top"). "Functionally, Zergeca is not just a typical DDoS botnet; besides supporting six https://lnkd.in/ganNh6s4

1

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

30

1 Comment

You need to use the findings and automate based on those. eBPF is not enough.

2

Note: this posting is not specifically about the EUIDW, it applies to most current authentication solutions. Pardon me for p*****g off you identity experts out there. However, I'm also an "identity expert", but I'm also a fairly ordinary user of systems like BankId (SE) which represents the opposite to unlinkability. Yeah, there is even a nation-wide citizen registry in the background! Why is unlinkability a FAKE? Well, practically all services (of any importance), require the user's email address and/or mobile phone number. Since these represent GUIDs, it does (in reality) not matter what measures you take to achieve unlinkability, since they are effectively undermined by how things work today. If unlinkability indeed is a major requirement, we need to come up with a way to perform User-friendly, Secure, Anonymous, Bi-directional, Per party-communication, that works similar to email and SMS. I'm not aware of any serious activity trying to accomplish something along these lines. Depending on specific anonymization services is a possibility, but it seems to move the problem rather than solving it. Even IP addresses are commonly used for tracking down criminals. Personally, I consider linkability a feature rather than a bug 😎 Systems like FranceConnect that [incorrectly] claim to support unlikability are simply put a true PITA! Feel free bashing this outrageous rant!

17

54 Comments

A large webshop fraud ring has been exposed, highlighting the importance of vigilance against online scams. The ring tricked victims into making fake purchases on bogus websites, stealing credit card information and attempting to process millions of dollars in fraudulent orders. They also resold stolen credit card details. This is a stark reminder of the ever-present threat of cybercrime. As security professionals, we can help educate our networks about online safety and best practices for identifying legitimate websites. #cybersecurity #webshopfraud #onlinesafety https://lnkd.in/ghzUiK4p

6

🔗 Collaboration Links and Modern Attachments: The Next Big Thing in eDiscovery! 🔗 A recent case, "In re StubHub Refund Litig.," highlighted that there's no off-the-shelf tool for handling hyperlinks to files within emails, creating major challenges for legal teams. But at Cloudficient, we're ahead of the game! 🚀 Expireon detects "Modern Attachments" in email/journaling data streams, downloads, and archives them with a "link replacement" feature during case export, ensuring seamless data management. Currently, it works for links to M365 – more data sources to be added soon. 🌐 Read more about the case here: https://lnkd.in/ewjdDD8H #eDiscovery #InformationGovernance #Expireon #Cloudficient #LegalTech #modernattachments

24

2 Comments

THIS IS WILD - EXPMON Public Detected a PDF "Zero-day" PoC in the wild Which Triggers a RCE Vulnerability In Adobe Reader! Adobe has been notified, will release full details after the vendor finishes their investigation. Please note: 1. This was detected by EXPMON Public (https://pub.expmon.com) when it's on a mission to analyze a huge public PDF sample set (check it out https://lnkd.in/guFBJTFD). I've "hidden" that particular submission since I realized this finding (to give Adobe the vendor a chance to review). 2. EXPMON system detected the crash and reported it as a potential zero-day attack (see picture). 3. This seems not to be a full working exploit, but a crafted PoC, at least. As I didn't see any payload in the sample. Currently not sure if it's malicious (say, a partial unfinished 0day exploit leaked), or non-malicious (crafted PDF sample for good-purpose PDF app testing?). 4. Anyway, this does bring an exploitable crash on the latest Adobe Reader, the root cause seems to be use-after-free. However, all are based on my brief analysis, need Adobe's confirmation. Sigh.. You never know what you will find in real-world samples! More importantly, I feel EXPMON is on a good mission to fill the industry gap - looking deeply into all the files from a vulnerability/exploit perspective. :) #expmon #zeroday #0day #exploit #threatintel #adobe #pdf

50

7 Comments

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

I'm starting a series of articles about Open Bullet 2: fraudsters' favorite tool to conduct credential stuffing attacks. https://lnkd.in/guY_t-B2 In this first article, I give an overview of Open Bullet 2, and its main features, in particular the integration with CAPTCHA farms and the possibility of importing credential stuffing Loli script. The next articles will probably be a bit more technical, e.g. to investigate the fingerprints of Open Bullet with Selenium/Puppeteer, and if attackers can easily modify them from Open Bullet to bypass detection.

29

4 Comments

Hey IAM folks, if someone polled your co-workers today, how would they rate the authentication experience they have today on a scale of 1-10? Here's what kills the ratings for most enterprises: 1. Inconsistency - Having to use multiple and inconsistent MFA tools to access company apps. 2. MFA Fatigue - Requiring users to re-authenticate or do MFA again when unnecessary 3. Lockouts - When providing the wrong credential or expired passwords lead to account lockouts that stop people from working Only by unifying the authentication experience and streamlining can we ever expect to win over everyone in the company. Here is a diagram of our Authentication Speedway, a map to getting to the most frictionless and highly secure authentication experience for your workers! https://lnkd.in/g92bnSgS

22