Everyone know RBAC is important. And this is one of the best webinar that demonstrate how the best practices in designing RBAC.
Notes:
Let's learn the zero trust segmentation for network, process, and file access within K8s cluster with Tracy Walker.
| Threat-Based Controls | Zero-Trust Controls |
|---|---|
| CVEs | Automated Learning |
| DLP | Network |
| Network Attacks | Process |
| OWASP Top 10 WAF | File Access |
| Admission Control | Security as Code |
The Automated Behavioral-based Zero-Trust covers:
The demo will show how Zero Trust can protect against zero-day attacks as well as exploits such as Log4j and Spring4shell.
Links:
Google Project Zero researcher Maddie Stone presents a speech at the FIRST conference which titled "0-day In-the-Wild Exploitation in 2022…so far".
It revealed that nine out of 18 zero-day flaws detected and disclosed as exploited in-the-wild in 2022 are variants of previously patched vulnerabilities.
This means that many of the attacks were not so sophisticated, instead threat actors that exploited the issue were able to come back and trigger the known vulnerability through a different path.
For example:
“When 0-day exploits are detected in-the-wild, it’s the failure case for an attacker. It’s a gift for us security defenders to learn as much as we can and take actions to ensure that that vector can’t be used again. The goal is to force attackers to start from scratch each time we detect one of their exploits: they’re forced to discover a whole new vulnerability, they have to invest the time in learning and analyzing a new attack surface, they must develop a brand new exploitation method.”
To properly address zero-day vulnerabilities Google researchers recommend platform security teams and other independent security researchers to invest in root cause analysis, variant analysis, patch analysis, and exploit technique analysis.
Learn from 0-days exploited in the wild to make -day hard.
Make 0-day hard by:
Links:
A look at what Zero Trust really is and how to get started by John.
My take away (ZT principles):
Other notes:
EPSS is a measure of exploitability. Specifically, EPSS is estimating the probability of observing any exploitation attempts against a vulnerability in the next 30 days.
This is accomplished by observing and recording exploitation attempts against vulnerabilities and then collecting as much information about each vulnerabilities.
EPSS is best used when there is no other evidence of active exploitation. When evidence or other intelligence is available about exploitation activity, that should supersede the EPSS estimate.
EPSS does not account for any specific environmental, or compensating controls, and it does make any attempt to estimate the impact of a vulnerability being exploited. EPSS should not be treated as a complete picture of risk, but it can be used as one of the inputs into risk analyses.In vulnerability management, EPSS is treated as "pre-threat intel." If an organization have any intel source which something is being exploited (via their own telemetry sensors or OSINT), then they should use that as an indication of activity in the wild. For those without any evidence of exploitation or that lack threat intel, then EPSS is a great fit.
Thus, EPSS can be used for better Vulnerability Management's OSINT strategy and prioritization.
Links:
Prioritization to Prediction Volume 1: Analyzing Vulnerability Remediation Strategies
Effective remediation depends on quickly determining which vulnerabilities warrant action and which of those have highest priority, but prioritization remains one of the biggest challenges in vulnerability management.
For the first time, Kenna Security and the Cyentia Institute took a quantitative look at the effectiveness of common remediation strategies and used that data as a baseline to compare against a cutting-edge predictive model.
The results of this research are detailed in the new report, Prioritization To Prediction: Analyzing Vulnerability Remediation Strategies.
Links:
My notes:
Here are some of my notes about what can we deploy to help to protect web application using the modern technologies.
Instead of depending on developers to FIX all the webapp vulnerabilities, such as XSS/CSRF, below are a few things we should strategies at the policy/framework level.
A New Strategy for WebApp
Traditionally, we assess a web application (webapp) security via scanning and penetration testing (pentest). This isn't an effective way when you have a complex webapp or many webapps (with undocumented CMDB).
A better way would be securing webapp (or many webapps) via policy.
At the policy level, it requires every webapp to implement a series web security policies such as Content Security Policy (CSP), and during the regular scanning, the scanner will detect is those policies are still in place, to determine if an webapp is violating the policy. The benefits here include:
Links:
Today, I just found that Microsoft has stopped their ESAE strategic architecture. Microsoft has recommended new strategy to complements any existing ESAE implementation.
The Enhanced Security Admin Environment (ESAE) architecture (often referred to as red forest, admin forest, or hardened forest) is an approach to provide a secure environment for Windows Server Active Directory (AD) administrators.
In early 2018, where I first learned about ESAE. After a deep dive evaluation, my conclusion is, it is too costly to implement such a solution, in term of operating cost, for most of the company (even it is a secure strategy). This is simply because the strategies have never consider the essential security concept. #EssentialSecurity
And after 3 years, Microsoft has admitted that the ESAE architectural pattern is only valid or applicable in a limited set of scenarios. Any organization who implement ESAE architecture, must accept the increased technical complexity and operational costs of the solution.
The ESAE retirement post can be found at https://docs.microsoft.com/en-us/security/compass/esae-retirement