Tom Rossdale

"We need to impose cost on adversaries and build evidence based resilience" - NCSC CTO Ollie Whitehouse at #BSidesCheltenham this morning. Disrupting attack chains by simulating adversarial behaviours and hardening Windows and Linux functions so that they cannot be exploited by adversaries can be a way to achieve this.

62

3 Comments

Friday Thoughts: A good tabletop makes people slightly uncomfortable, because that’s when the most learning happens.   With the Cyber Security and Resilience Bill coming and CAF v4 updates now in place, tabletop exercises are becoming a compliance necessity. To achieve Objective D, organisations need to have incident response plans that show: - Coverage of the entire lifecycle of an incident. - Integration with business operations, supply chains and critical dependencies. - Address both known and previously unseen attack scenarios. - Understanding by everyone involved in running your essential functions. To know if it really works it needs to be lived, tested, refined, and stress-tested again. The problem? Too many tabletop sessions are sanitised. Predictable scripts. Too generic. No real chaos. No pressure. No exploration of “what if” when the unexpected happens. If you want them to have impact (and pass regulatory scrutiny): - Go beyond the SOC – involve PR, legal, ops, leadership. - Inject uncertainty – limit facts, create the pressure of partial information. - Challenge assumptions – what if your comms tool fails, or a supplier is the breach vector? -Document lessons learned and take action, make improvements and run the scenarios again to gauge how much you have improved. Is there anything I've missed? What's the best tabletop exercise you've been involved in? #caf #tabletops #cyber

30

8 Comments

A ‘U.S.-only’ SOC is a luxury most MSSPs can’t afford in 2025. Not when clients expect 24/7, faster SLAs, and broader scope for the same price. What’s working right now: • Nearshore Tier 1/2 for cost + coverage • Senior onshore leads focused on hunting & IR • Follow-the-sun handoffs (no night-shift burnout) Result: more capacity, better response, protected margins. 🔗 Link in the comments ⬇️👇 #SOC #FollowTheSun #Operations #MSSP #MDR

33

4 Comments

One thing the US does better than the UK is the culture of forward-leaning, early-adopter CISOs. They are active on advisory boards and act as design partners at the early stage. This has huge benefits for their business and the startup ecosystem more generally. In the UK, those people exist but are less common. UK cyber startups often find their design partners in the US rather than closer to home. But it doesn't have to be this way! For this panel, we have gathered some of the top UK CISOs who do this well, and will share their experiences + thoughts on how to navigate this: Kirsty Kelly (CFC) Simon Goldsmith (OVO) Mark Sutton (Bain Capital) Munawar V. (Close Brothers) Are you a CISO in the UK would like to find out more? Join us this week: https://lnkd.in/dZVim-y7

94

4 Comments

Britain's National Cyber Security Centre recently issued a lukewarm verdict on passkeys as an authentication solution. On the Root Causes Podcast, Jason Soroko and I explore the problems with WebAuthn, including account recovery, spotty availability, inconsistent implementation, and lack of Linux support.  Audio: Video: https://lnkd.in/g6uHKii6

29

3 Comments

👋 Here's everything you wanted to know about the Workload ID feature in Entra. There are three major parts to the Workload ID Premium license. Workload ID is also referred to as Non-Human Identities (ie Service Principals, App registrations). 1️⃣ Enforcing location based CA 2️⃣ ID Protection for Workload ID 3️⃣ ID Governance for Workload ID Let's break it down. 👇 1️⃣ Enforcing location based CA This using conditional access policies for service principals. This supports just one type of CA policy. ✅ That is to allow or block sign ins from IP ranges (named locations) More info here: https://lnkd.in/gipd4G8y 🌟 This feature is limited to single tenant apps. You cannot use this with apps that you as the admin did not create in your tenant. 2️⃣ ID Protection for Workload ID This is the use of risk based conditional access to secure your apps. You can block access to service principals to your tenant based on the following detections. ✅ Microsoft Entra threat intelligence ✅ Suspicious Sign-ins ✅ Admin confirmed service principal compromised ✅ Leaked Credentials ✅ Malicious application ✅ Suspicious application ✅ Anomalous service principal activity ✅ Suspicious API Traffic More info here: https://lnkd.in/gqkcx64X 🌟 ID Protection detects risk on single tenant, non-Microsoft SaaS, and multi-tenant apps. Managed Identities are currently not supported. 3️⃣ ID Governance for Workload ID This feature allows you to apply lifecycle management to non-human identities (service principals) and apply access reviews when you assign Azure and Entra roles to service principals (did you know you can assign the GA role to service principal 🤯). ✅ Access reviews for service provider-assigned privileged roles ✅ App Health Recommendations - Identify unused or inactive workload identities and their risk levels. Get remediation guidelines. More info here: https://lnkd.in/gzAb47VZ 🌟 This feature is not limited to single tenant service principles. ➕ There are lots of features that are in the Free tier for Workload ID (non-human identities). This is a neat comparison table. See https://lnkd.in/gqvV5rGY

130

9 Comments