Microsoft 365Detection & Response
Detecting Teams External Chat Phishing: Defender XDR and Sentinel Hunting Queries
Teams chat phishing arrives outside email defenses. These detections help spot suspicious external chats and their consequences.
Insights
Cloud & AI security insights
News, breach teardowns, how-to guides, detections and CIO briefings for Microsoft 365, Entra ID, Azure, AWS and AI agents.
Microsoft 365CIO Briefings
CIO Brief: Your Chat Tool Is an Email Inbox Without Spam Filters
The short version: In 2023, Russian state hackers used Microsoft Teams chat — not email — to trick people into approving login requests. Companies have...
Microsoft 365How-To & Hardening
How to Enable Expanded Audit Logging to Detect Mailbox Access
Storm-0558 was detected because a customer had detailed mailbox access logs. Here is how to make sure your Microsoft 365 audit logging captures what you'd...
Microsoft 365Detection & Response
Detecting Forged Token Mailbox Access: Defender XDR and Sentinel Hunting Queries
Forged or stolen tokens let attackers access mailboxes without normal sign-ins. Mailbox access audit events are often the only evidence.
Microsoft 365CIO Briefings
CIO Brief: Storm-0558 and Paying Extra for Security Logs
The short version: In 2023, Chinese hackers read US government email by forging digital keys in Microsoft's systems. A government agency caught it — because...
Entra ID & IdentityPlatform Changes
Azure AD Becomes Microsoft Entra ID (July 2023): What Actually Changed
On July 11, 2023, Microsoft announced that Azure Active Directory would be renamed Microsoft Entra ID. The change rolled out across portals, documentation...
Entra ID & IdentityHow-To & Hardening
How to Update Documentation, Scripts and Policies After the Entra ID Rename
The rename from Azure AD to Microsoft Entra ID didn't change functionality, but it's a good reason to update documentation and retire legacy tooling —...
Entra ID & IdentityHow-To & Hardening
Entra ID Configuration Health Checklist
Use this checklist to review the health of your Microsoft Entra ID configuration.
Entra ID & IdentityCIO Briefings
CIO Brief: Renames Don't Change Risk — But Licensing Might
The short version: In 2023, Microsoft renamed Azure Active Directory to Microsoft Entra ID. Nothing about security changed with the name. But renames are a...
Multi-CloudHow-To & Hardening
How to Inventory Internet-Facing File Transfer and Integration Services
Attackers repeatedly target internet-facing file transfer, integration and remote access services. Here is how to inventory them so you can patch, restrict...
Multi-CloudDetection & Response
Detecting File Transfer Zero-Day Exploitation: Sentinel and GuardDuty Detections
Mass exploitation of file transfer products typically targets web interfaces and ends with bulk data downloads. These detections help catch both stages.
Multi-CloudCIO Briefings
CIO Brief: Managed File Transfer — The Forgotten Crown Jewel
The short version: In 2023, a ransomware gang exploited a flaw in MOVEit, a file transfer product, stealing data from over 2,000 organizations — many of...
AWSPlatform Changes
S3 Block Public Access and ACLs Disabled by Default for New Buckets (Apr 2023)
In April 2023, AWS changed the default settings for all new S3 buckets: S3 Block Public Access is enabled, and access control lists (ACLs) are disabled...
AWSHow-To & Hardening
How to Migrate Legacy S3 Buckets Off ACLs to Bucket Owner Enforced
New S3 buckets have ACLs disabled by default, but older buckets may still rely on them. Migrating to "Bucket owner enforced" simplifies access control. Here...
AWSHow-To & Hardening
S3 Object Ownership and ACL Cleanup Checklist
Use this checklist to clean up legacy S3 ACLs and ownership settings.
AWSCIO Briefings
CIO Brief: Secure Defaults Help — But Only for New Resources
The short version: In April 2023, AWS changed the defaults so new cloud storage buckets are private and simpler to secure. That's a big improvement — but it...
Microsoft 365Platform Changes
Microsoft Security Copilot Announced (Mar 2023): Generative AI Comes to the SOC
On March 28, 2023, Microsoft announced Microsoft Security Copilot, a generative AI assistant for security teams built on OpenAI's GPT-4 and Microsoft's...
Microsoft 365How-To & Hardening
How to Evaluate AI Assistants for Security Operations
AI assistants for security operations can speed up triage and investigation — or add cost and noise. Here is a practical way to evaluate them.
Microsoft 365How-To & Hardening
AI Security Tool Pilot Checklist: Data, Access and ROI
Use this checklist before and during a pilot of an AI security assistant.
Microsoft 365CIO Briefings
CIO Brief: AI in the SOC — Productivity Gains vs. Real Risks
The short version: In 2023, Microsoft launched Security Copilot, an AI assistant for security teams. Many vendors followed. AI can make security analysts...
AWSPlatform Changes
AWS Encrypts All New S3 Objects by Default (Jan 2023)
On January 5, 2023, AWS began automatically applying server-side encryption with Amazon S3 managed keys (SSE-S3) to all new objects uploaded to S3, at no...
AWSHow-To & Hardening
How to Choose Between SSE-S3, SSE-KMS and DSSE-KMS for S3
All new S3 objects are encrypted by default with SSE-S3. For sensitive data, you may want more control. Here is how to choose between SSE-S3, SSE-KMS and...
AWSHow-To & Hardening
S3 Encryption and KMS Key Policy Audit Checklist
KMS key policies decide who can decrypt your sensitive S3 data. Use this checklist to audit encryption and key policies.
AWSCIO Briefings
CIO Brief: Encryption by Default — What It Does and Doesn't Protect
The short version: Since January 2023, AWS automatically encrypts all new files stored in S3. That's good — but encryption by default doesn't stop someone...