Francesco Tamba

🚨New blogpost - Converting AD groups to Entra ID groups Finally the feature for converting source of authority from Active Directory to Entra ID is here (in preview)! This is the next step in reducing the role of Active DIrectory in your environment, moving the management plane to Entra ID. This means that you can now take an existing AD group, convert it to a cloud group and manage it using: 🕵️ Criteria based groups 📦 Access packages 💪 Life cycle workflows 📝 Microsoft Graph https://lnkd.in/diGSRkQz

223

2 commenti

We just released the updated version of the Access and Identity module of the Security Adoption Framework (SAF) to the catalog, so it is now available to all Microsoft Unified customers. This workshop guides you through Microsoft learnings and best practices for Access and Identity security strategy and architecture (including how Microsoft Entra makes it real). This workshop helps you get a complete understanding of the challenges and solutions required for effective access control security across identity and network, including security service edge (SSE) [aka Zero Trust Network Access (ZTNA)], conditional access, privileged access, and more. This workshop also includes a discussion of the access and identity reference architecture diagram from the Microsoft Cybersecurity Reference Architectures (MCRA). This workshop is focused on helping with the top access and identity challenges we see at our customers including: 🔶 Disjointed identity and network access strategies and implementations 🔶 Adopting Zero Trust and Security Service Edge (SSE) approaches to Access Management 🔶  Rapid escalation of small incidents into major breaches because of neglect of Privileged Access security controls 🔶 Figuring out how to move from flat open networks to segmented, context-aware access models. 🔶 Securing remote work (VPN productivity challenges) The workshop content follows this agenda: ◾ Discuss your current approach ◾ Summary of modernization initiative ◾ Antipatterns and best practices ◾ Fragmented Access Management ◾ Privileged Access ◾ Known-Trusted-Allowed Model ◾ Zero Trust and Security Service Edge (SSE) ◾ Journey from Flat Network to Adaptive Access ◾ Two-way relationship with AI ◾ Next Steps Note that the name of the module has changed since the previous version from “Identity and Access” to “Access and Identity”, reflecting the need to converge network and identity access into a single policy-driven Adaptive Access approach (including a mapping to The Open Group standard approach). If you are interested in this workshop, contact your Microsoft representative (customer success account manager - CSAM)

291

2 commenti

🚨 𝗧𝗵𝗲 𝗙𝘂𝘁𝘂𝗿𝗲 𝗼𝗳 𝗜𝗖𝗦 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 - 𝗕𝗲𝘆𝗼𝗻𝗱 𝗦𝘁𝘂𝘅𝗻𝗲𝘁: 𝗪𝗵𝗲𝗻 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗟𝗲𝗮𝗿𝗻𝘀 𝗣𝗵𝘆𝘀𝗶𝗰𝘀 👁️ 🔎 This research paper “𝗛𝗲𝘆, 𝗠𝘆 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 𝗞𝗻𝗼𝘄𝘀 𝗣𝗵𝘆𝘀𝗶𝗰𝘀!” introduces 𝗛𝗔𝗥𝗩𝗘𝗬 – 𝗮 𝗽𝗵𝘆𝘀𝗶𝗰𝘀-𝗮𝘄𝗮𝗿𝗲 𝗣𝗟𝗖 𝗿𝗼𝗼𝘁𝗸𝗶𝘁 that could change how we think about OT cybersecurity. Unlike traditional ICS malware, HARVEY doesn’t just exploit code. It leverages the laws of physics to stay invisible while damaging critical infrastructure. 💡 𝗞𝗲𝘆 𝗜𝗻𝘀𝗶𝗴𝗵𝘁𝘀: ⚡ 𝗣𝗵𝘆𝘀𝗶𝗰𝘀-𝗔𝘄𝗮𝗿𝗲 𝗦𝘁𝗲𝗮𝗹𝘁𝗵 – HARVEY simulates plant behavior in real time, injecting fake “normal” sensor data while manipulating actuators toward unsafe states. 🛠 𝗙𝗶𝗿𝗺𝘄𝗮𝗿𝗲-𝗟𝗲𝘃𝗲𝗹 𝗖𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲 – Lives inside PLC firmware, bypassing logic-layer defenses. 🔬 𝗣𝗿𝗼𝘃𝗲𝗻 𝗶𝗻 𝗮 𝗣𝗼𝘄𝗲𝗿 𝗚𝗿𝗶𝗱 𝗧𝗲𝘀𝘁𝗯𝗲𝗱 – Tested on an Allen Bradley CompactLogix PLC, showing adversary-optimal attacks that caused grid instability while operators saw normal readings. 🛡 𝗗𝗲𝗳𝗲𝗻𝘀𝗲 𝗚𝗮𝗽𝘀 – Traditional IDS and anomaly detection fail. Mitigation requires secure firmware updates, runtime attestation, and independent physical-state monitoring. ⚠️ 𝗪𝗵𝘆 𝗶𝘁 𝗺𝗮𝘁𝘁𝗲𝗿𝘀: This research highlights the next frontier of OT threats—malware that understands physics. Future attacks won’t just hack code — they’ll exploit the laws of physics. 📄 Read the full paper 👇 💬 𝗤𝘂𝗲𝘀𝘁𝗶𝗼𝗻 𝘁𝗼 𝘁𝗵𝗲 𝗰𝗼𝗺𝗺𝘂𝗻𝗶𝘁𝘆: What approaches do you think will be most effective against the next wave of ICS threats? 👉 Follow OT SECURITY PROFESSIONALS (OTSecPro) for more cutting-edge OT Security research highlights, insights, and community knowledge. #OTSecurity #ICS #PLC #CyberPhysical #CriticalInfrastructure #IndustrialCyberSecurity #OTSecPro #OTSecProInsights #OTSecurityPro Robert M. Lee John Kingsley chitrannk shrivastav DEVIKA JAY Bimal Mehta Kunal S. Mini TT

138

25 commenti

Bitdefender Labs and MDR teams confirm active, widespread exploitation of CVE-2025-53770 in on-premises Microsoft SharePoint Server. Immediate action to take: - Apply emergency patches (KB5002754 for SharePoint 2019, KB5002768 for Subscription Edition; 2016 patch pending) - Rotate ASP.NET Machine Keys Edge network device exploits serve as a "beachhead" for follow-up attacks like ransomware (days or weeks later). We've tracked record ransomware activity to single vulnerabilities exploited months prior, demonstrating this pattern. Read the full technical advisory for IoCs and detailed guidance: https://lnkd.in/ed_SHiq6

72

2 commenti

🔄 UPDATE | Microsoft has expanded patches for the actively exploited SharePoint RCE flaw (CVE-2025-53770). 🔐 Now also covered: • SharePoint Enterprise Server 2016 • SharePoint Enterprise Server 2016 Language Pack 🛡️ Full guidance → https://lnkd.in/gcnM-p6N

110

1 commento

🚀 Today I published a new blog post: A first look at Microsoft Entra Private Access for Active Directory domain controllers. Over the past few days, I tested the current preview of the Private Access Sensor — a feature that lets you restrict Kerberos SSO for specific SPNs to clients using Entra Private Access. The post walks you through setup, configuration, and my first impressions, along with some tips, tricks, and personal takeaways. This feature shows strong potential to add an extra security layer to on-prem environments — definitely worth a look! 👉 Read the full post here: https://lnkd.in/ejkuYQym Hashtag #MicrosoftEntra #CyberSecurity #ActiveDirectory #Kerberos #GlobalSecureAccess #ZTNA

228

7 commenti

Microsoft is introducing a new capability in Teams that allows internal users to attach/share files in 1:1 and group chats with external users (guests). This feature is disabled by default and must be explicitly enabled by a Teams administrator. https://topedia.net/M30e6d #MicrosoftTeams #FileSharing #TeamsChat

33

5 commenti

🔐 Active Directory vs Microsoft Entra ID: The Identity Evolution As organizations modernize their infrastructure, understanding the shift from on-prem identity to cloud-native access is critical. Here’s a look at how Active Directory (AD) and Microsoft Entra ID compare across key dimensions: 🏗️ Architecture & Scope 🔸AD: Built for traditional, on-premises networks 🔹Entra ID: built for cloud-first and hybrid use Access Scope: 🔸 AD → Local file shares, printers 🔹 Entra ID → SaaS apps, cloud platforms, external identities 🔐 Authentication & Security Protocols: 🔸 AD → Kerberos, NTLM 🔹 Entra ID → OAuth2, SAML, OpenID Connect SSO: 🔸 AD → Limited to domain-joined devices 🔹 Entra ID → Broad SSO with federation for hybrid/cloud apps Conditional Access: 🔸 AD → Not native 🔹 Entra ID → Built-in Zero Trust engine using identity, device, and risk signals Credential Management: 🔸 AD → Password policies, smart cards 🔹 Entra ID → MFA, passwordless login, self-service reset ⚙️ Policy & Device Management Policy Enforcement: 🔸 AD → Group Policy Objects (GPO) 🔹 Entra ID → Intune, Conditional Access Device Join: 🔸 AD → Domain Join 🔹 Entra ID → Azure AD Join, Hybrid Join Mobile Support: 🔸 AD → Requires third-party tools 🔹 Entra ID → Native via Intune 👥 User Lifecycle & Collaboration Provisioning: 🔸 AD → Manual or via Microsoft Identity Manager 🔹 Entra ID → SCIM, cloud HR systems, dynamic groups 🛠️ Admin & Role Delegation Delegation Model: 🔸 AD → Domains, OUs 🔹 Entra ID → Role-Based Access Control (RBAC), Privileged Identity Management (PIM) Service Accounts: 🔸 AD → gMSA(Group Managed Service Account), static credentials 🔹 Entra ID → Managed identities for cloud workloads 🌐 Network Dependency 🔸 AD: Requires constant connectivity to domain controllers within the corporate network. 🔹 Entra ID: Internet-based—accessible from anywhere, ideal for remote and hybrid workforces. 🧩 Integration Ecosystem 🔸 AD: Integrates well with legacy Windows-based applications and on-prem infrastructure. 🔹 Entra ID: Seamlessly integrates with Microsoft 365, Power Platform, and thousands of SaaS apps via pre-built connectors. 📊 Monitoring & Insights 🔸 AD: Limited native reporting; often requires third-party tools for auditing and analytics. 🔹 Entra ID: Built-in insights via Microsoft Entra Admin Center, plus integration with Microsoft Sentinel and Defender for Identity. 🧠 AI & Automation 🔸 AD: Manual processes dominate—limited automation without custom scripting. 🔹 Entra ID: Supports automation through dynamic groups, lifecycle workflows, and AI-powered identity governance. 🧾 Licensing & Cost Model 🔸 AD: Included with Windows Server licensing; additional tools (like MIM) may incur costs. 🔹 Entra ID: Tiered licensing (P1, P2) with advanced features like Conditional Access, Identity Protection, and PIM.

49