In this webinar, Stephen will demonstrate the process of downloading Microsoft cumulative updates to extract the patches and prep them for diffing.
It's a very useful way to identify patched vulnerabilities that can potentially be weaponized for exploitation of un-patched systems, as well as learning how vulnerabilities are patched to aid in bug hunting.
My notes:
Time consuming to find the diff. (use bindiff or diaphora)
2022-10 x64 "Windows 10" 22H2 Vs "Cumulative windows 10"
2 purposes:
weaponize patched vuln (n-day exploit)
find new 0-day vuln
MS doesn't obfuscate the patch management process. 😅
One of the best video that talks about Kubernetes (within 15 min), which covers the architecture or relationship between API, Scheduler, Controller, Data Store (etcd), Kubelet, KubeProxy, Docker, Pod, Container, Cluster.
Learn and understand about containers, and start creating a docker container with 5 simple steps. It compares between physical machines, virtual machines, and containers.
This is a demo on using GitHub Action and Nuclei to protect your CI. It also includes how an attacker can leverage GHA to mine cryptocurrencies, pivot into other targets, and distribute backdoors into different repositories.
This webinar introduces the new Governance feature in Defender for Cloud. It helps to drive security posture improvement by creating governance rules, notify owners and monitor it, and take action to improve secure score.
Building an automated process
To make sure your organization is systematically improving its security posture, you can define rules that assign an owner and set the due date for resources in the specified recommendations. That way resource owners have a clear set of tasks and deadlines for remediating recommendations.
Defining governance rules to automatically set the owner and due date of recommendations
Manually assigning owners and due dates for recommendation remediation
Tracking the status of the recommendations for further action
Tracking progress by rule with the governance report
Weekly email notifications to the owners and managers.
Although this is a 4 years old webinar, I found it is still worth for today. The goals of this webinar is to raise the awareness risk in K8s and demonstrate the 'live' hacking and attacking a K8s. It also provides some hardening methods and tips.
Defaults in use early tend to stay in use.
Systems hardened late tend to break.
The webinar introduces a number of tools for securing K8s and a lot of hardening tips for your K8s cluster.
KubeATF - A tool used to automate the creation, validation, and destruction of K8s in a consistent way.
Bulkhead - A plugin that perform security posture scans on all nodes from within your K8s.
Kubernetes Security Best Practices by Ian Lewis, Google
Containers give developers the ability to isolate applications from one
another, but that’s not enough. Resource isolation is much different
that security isolation. How do we make applications deployed in
containers more secure? What tools can be we apply to our containers
running in Kubernetes to make them more secure? How can we apply policy
to our network and services to make sure applications only have access
to what they need and nothing more?
In this talk, attendees will learn about the risks and attack surfaces
of a Kubernetes cluster. s-We'll look at tools like PodSecurityPolicy,
SELinux, AppArmor, seccomp, and sandboxed containers in action to
improve the security of containers. We’ll then go up the stack and learn
how to apply network policy to containers to further improve security.
Agenda:
Security 101
Defense in depth (redundant
Limit the attack surface
Least privilege
Runtime security
Attacking Kubernetes cluster itself, Kubernetes API server
Host security
RBAC
API Firewall
Network security
NetworkPolicy
Secured access to etcd
Run as non-root
Read-only root filesystem
no new privileges (allowPrivilegeEscalation:false)
Explore the Zero Trust strategy fundamentals, trends and best practices with Microsoft security architect Mark Simos and Forrester analyst Steve Turner.
My notes:
Zero Trust foundations: Definition and scope
A unified security policy across the board
Modernization of your security operations and SOC
ZT is pushing all of those security fundamentals into the limelight
Network-centric versus Identity-centric Zero Trust
micro-segmentation
Identity posture
Identity governance
Business enablement in hybrid work environment
Work with business stakeholders
Moving from VPN to Zero Trust Network Access (ZTNA)
Modernizing you security approach
Leverage Zero Trust strategy with cloud services for greater flexibility
Risk areas and vulnerabilities
ZT addresses compliance and regulatory workflows
Expectation need to be woven into business, leadership, conversations, and thinking
Fail-safe or fail-protected concept
Emerging trends in Zero Trust
IAM may evolve with new technologies and capabilities, and easily replaced to deliver different types of policy enforcement
An excellent webcast from Eran Livne (Qualys) about Multi-layered Approach to address Log4Shell vulnerabilities. Watch the on-demand webcast if you want.
There is also a great demo on how to use multi-layered approach with Qualys to perform log4shell assessment (remote scan, auth scan, agent, inventory scan, prioritize, externally expose/shodon, container, images, patch management, mitigation action, EDR).
Visibility is a key element to identify and respond to cloud security incidents. This session explores how we can leverage native offerings to help solve the visibility problem.
In this webinar, Roger shares the following topics with us, and helps us to keep up with the ever-changing threat landscape.
The public cloud expansion is a reality and maintaining fences up is not easy. Come learn about AWS/Azure/GCP organization rules, policies and best practices to avoid potential threats that help to enforce good practices and avoid potential issues and misconfigurations.
In this webcast, Moises will cover how to:
- Allow new accounts, subscriptions, or project to start with security practices in place
- Reduce the risk that shadow IT could grow without security policies and good practices
- Enforce security good practices even if users try to resist it
- Maintain cloud environments aligned with legal and privacy requirement
