Azure Hybrid Data Improvements
Removes unnecessary placeholder objects Only creates relationships when both sides exist Reduces graph churn and improves analysis time
14 juil.
658 articles
Removes unnecessary placeholder objects Only creates relationships when both sides exist Reduces graph churn and improves analysis time
Attack path management has historically focused on identity systems like Active Directory and Entra ID. That focus made sense. These systems define authentication, authorization, and privilege at scale, and they remain central to how access is granted across an environment. But they are not the full picture. There are entire classes of systems that introduce attack paths that do not exist in the directory. Device management platforms are one of the most important examples. These systems are resp
Perhaps the most important aspect of modeling Jamf is what happens when these capabilities intersect with other platforms. In real environments, attackers rarely operate within a single system. They move between identity providers, device management platforms, and other services as they progress toward their objective. This creates hybrid attack paths spanning multiple systems. We can then identify a path from a non-privileged Active Directory User to one of the jamf_Account nodes that had execu
BadWindowService is chock-full of vulnerabilities and includes a lot of text in the README and logged messages, making it clear that this is intentionally vulnerable. Despite removing those, the response to the following system prompt and prompt was Claude’s conclusion that this is intentionally vulnerable due to the sheer volume of security controls circumvented. It did present its findings in a nice table for further investigation. # Application Information### DescriptionThis is the source cod
Identity is no longer confined to a single system. In modern environments, identity spans multiple platforms: Active Directory, Okta, Entra, GitHub, and others; each operating within its own environment, with its own model for authentication and access. These systems are connected through federation, synchronization, and single sign-on. Each connection serves a legitimate purpose, enabling organizations to manage identity centrally while extending access across platforms. But these connections a
In practice, these relationships rarely present themselves as a single, obvious chain. They are distributed across platforms, environments, and teams, each with its own perspective on identity and access. Consider a typical scenario. An organization uses Active Directory as an upstream identity source, federated into an Okta environment. That Okta environment is then used to provide single sign-on into a set of downstream applications. In some cases, those relationships extend further, to additi
One thing that comes as a surprise is that native Okta attack paths are relatively short when compared to our security models of Active Directory (AD) and Microsoft Entra ID. There are multiple reasons for this: Okta does not support group nesting and only users can be members of groups Many theoretical privilege elevation paths are intentionally mitigated by only allowing Super Administrators (the most privileged role in Okta) to modify users, groups, and applications that have role assignme
Workflows in Okta provide a robust way to automate tasks related to user provisioning and deprovisioning. To achieve this, Okta must be granted non-trivial permissions in connected systems. Here is an example of permissions needed by the Microsoft Office 365 connector: Figure 17. Example Okta Workflows connector permissions. Anyone in control of the workflow could perform administrative actions in Microsoft Entra. As there is no documented API for reading the information about existing workflows
Okta’s Active Directory agents can be installed on member servers to provide synchronization of AD users and groups to/from Okta. This capability is thus similar to Microsoft’s Entra Connect. Unlike Microsoft, Okta recommends for the synchronization service accounts to be added to the Domain Admins group in AD, granting Okta administrators unlimited control over Active Directory. As managed service accounts are not supported by Okta, a human must set and manually rotate service account passwords
This is one of the clearest examples of GitHub acting as an interchange between systems. It is also one of the easiest relationships to miss because the answer depends on understanding GitHub’s control over branches, workflows, and environments, as well as Azure trust configuration.
This matters because it reveals GitHub’s security dependencies. Through the lens of the Clean Source Principle, if GitHub relies on Entra ID or another identity provider for SSO, then compromise of that upstream source has direct implications for GitHub as well. That dependency is easy to underappreciate when GitHub is viewed in isolation rather than as part of a larger identity fabric.
Securing a single platform is really hard, just ask any Active Directory or Entra ID admin. We’ve used the analogy before but think of a single Active Directory domain or Entra ID tenant as a map of the United States. Instead of cities connected by roads, these environments are identities and resources linked by privileges and user behaviors. The number of attack paths within a single domain or tenant is higher than the number routes across within the United States. If that wasn’t bad enough, at
Secure company data by trusting the device, not just the sign-in 1Password Device Trust lets organisations restrict access based on the health of a user’s device. This way, compromised, unmanaged, or out-of-date endpoints don’t get a free pass to sensitive tools and data. Now, with EU data hosting, EMEA teams can adopt that control without compromising on data residency requirements. A smoother rollout that supports employees When employees get blocked and don’t understand why, they do what huma
The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.
Despite ongoing turmoil caused by actor conflicts and disruption, ransomware actors remain highly motivated and the extortion ecosystem demonstrates continued resilience. Several indicators suggest the overall profitability of these operations is, however, declining, and at least some threat actors are shifting their targeting calculus away from large companies to instead focus on higher volume attacks against smaller organizations. This is likely due to increased difficulty in successful deploy
In this test, Claude Sonnet 4 was asked to open a shared document from a colleague. It found an email with a “Q1 Project Timeline” link, clicked it, saw a Microsoft 365 login form, looked up the user’s real password in the vault, typed it in, and hit submit. When the page didn’t load, it tried again. Here, the model fell into the same trap that many people do in phishing attacks: it failed to examine the web address. The link pointed to acmecorp-sharepoint.com-docs.cloud, a domain designed to lo
How Microsoft uses Listen Labs to better understand their customers
Microsoft Copilot is your companion to inform, entertain and inspire. Get advice, feedback and straightforward answers. Try Copilot now.
Today, Microsoft provides the telecom delivery behind SMS and voice authentication natively within Entra ID. As part of this transition, we’ll step back from providing that native telecom delivery to encourage phishing-resistant methods as the standard for everyone. For most organizations, the recommended path is simple: move users to passkeys at no additional cost. If you have a regulatory, technical, or business requirement to keep SMS or voice, you’ll be able to select, configure, and manage
Learn about using passkey (FIDO2) authentication in Microsoft Entra ID to help improve and secure sign-in events
Stop guessing at AI ROI with a clear, four-stage maturity framework that shows how AI creates value across your organization.
Try Compass, the internal developer platform from Atlassian to improve your developer experience, catalog all services, and increase software health.
Product managers are the connective tissue of their organizations. They translate between engineering, design, leadership, sales, and support. That translation work generates an enormous amount of context transfer: meetings to align, documents to write, tickets to update, decisions to record. Most of this context transfer is manual. Someone watches a meeting and writes up the notes. Someone sees a bug and spends ten minutes describing it in a ticket. Someone gives a demo and then re-explains it
Supports ADFS with Integrated Windows Authentication (IWA) Aligns with Windows-native enterprise auth workflows