UBS Forums – CISO Round Table – SOC Modernization
Looking forward to speaking and participating with esteemed CISOs in the community.
Please join us and register
Join me at NASSCOM DSCI AISS 2021
Posted in Security Conference
Organizations depending upon their maturity curve of their Cyber Security Journey would be interested in solutions like EDR and XDR. A lot of times these terms often creates a lot of myths and confusion.
I am happy to return to AISS 2021 and speaking on this important topic. Hope to you see you all.
Threat Hunting on SQL Server with Azure Sentinel
For years Microsoft SQL Server has served as a backbone of critical applications for enterprises. Due to the nature of critical data stored on the SQL Server databases, it has always been a point of Interest for internal or external adversaries and one of the primary targets for exploitation.
It is important to monitor all your SQL database instances and servers for any sign of threats.
Last week I posted a detailed blog post on Monitoring SQL Server with Azure Sentinel on Microsoft Azure Sentinel Official Blog. The blog talks about how to ingest logs from SQL Servers running on VMs, Parse the logs in readable format and then run various hunting queries and create alerts
You can read the detailed post here.
The Parser and hunting queries are also uploaded to Azure Sentinel Github repo.
Join me at Microsoft 360 Security Conclave
Posted in Uncategorized
I’ll be speaking at Microsoft 360 Security Conclave on Integrated Cyber Threat Management last this week, we’ll talk about how modern cyber threats leveraging power of cloud to launch multi-staged attacks and how having an end to end visibility of the attack indicators across Identity, Endpoint, Apps and Infrastructure helps early detection and remediation.
If you are attending this event, please do stop by and say hi.
There are some other distinguished speakers lined up for you from Industry and Microsoft engineering.
See you there.
Iftekhar
My Session at Economic Times–Microsoft Security 360 Conclave
ETCISO.in and Microsoft organized a one-day conclave to enable CISOs enhance their security stance in the era of flux and transformation. The conclave served as a platform for top CISOs and security experts to deliberate on the latest opportunities, challenges and trends in the enterprise cybersecurity space.
It was really speaking at this event on “ Top Security Myth busters” which was all about various myths within the security community and in organizations for their internal cyber security and compare them with things happening in reality. This session also had some demos on some of Microsoft’s investments in threat detection capabilities and remediation accross Email Security, Endpoint Security and Identity protection.
If you happened to attend this event in person, I really hope you liked it.
If you couldn’t attend it in person, the sessions were streamed LIVE and now available On-Demand below.
My Session starts at ~ 4:28:00
Cheers,
Iftekhar
My Session at Digital Governance Tech Summit 2019, New Delhi – Security Considerations for Moving to Cloud.
I’ll be speaking at Digital Governance Tech Summit 2019, New Delhi on
Security considerations while moving to the cloud” – 1615 Hrs, 27th August 2019
In this session, learn about various security considerations organizations to make while moving to cloud, shared responsibilities between cloud provider and end customers.
If you happen to be participating in this conference, please do stop by and say hi.
There are other great sessions in this conference presented by elite Microsoft speakers and other industry veterans like Keynote by Ananth Maheshwari, President Microsoft India and Amitabh Kant, CEO, Niti Aayog, Govt of India.
You can find the list of entire list of sessions and tracks here
I look forward to have some of you in the session and discuss more on your secure cloud journey.
Cheers
Iftekhar
Best Practices in configuring Office 365 Anti Phishing Policy
Office 365 Advanced Threat Protection enables additional layer of protection against malicious URLs, Malicious Attachments and Phishing campaigns.
In my previous posts we talked about these configurations, please click on the hyperlinks below to see those posts.
1. Best practices in configuring Office 365 Safe Attachments
2. Best Practices in configuring Office 365 Safe Links.
Today we’ll take a look at anti phishing policies which can be configured in Office 365 for protection against
- 1. User Impersonation
- 2. Domain Impersonation
- 3. Domain Spoofing
User Impersonation : User Impersonation configuration allows organization to list down their top executives like CEO, CFO, Directors etc and any emails coming with the exact same display name and going to users will be quarantined/delivered to Junk as per the configuration.
Domain Impersonation : Domain Impersonation configuration protects against emails coming with similar typosquatted domains like yours. For eg. your organizations domain is Contoso.com and attackers may send emails after registering similar looking domains like Cont0so.com, Contoso-inc.com etc.
Domain Spoofing : Domain spoofing configuration enables domain authentication like SPF, DKIM, DMARC to be enforced validating the origin of the emails as per the from address and block/quarantine/junk those emails which fails authentication.
I have created this video tutorial of Step by Step tutorial of the recommended configurations of Anti Phishing Policies in Office 365 Advanced Threat Protection.
Hope you like the videos, please do subscribe to the channel to be updated with future tutorials.
Cheers
Best Practices in configuring ATP Safe Link Policies in Office 365
One of the major attack vector used by threat actors are sending emails with malicious URLs. These emails without any malicious attachments usually has luring text which encourages users to click on a link to take any action and then take them to a Phishing URL or a webpage with malicious content.
For E.g. the email below, which looks like it has come from Microsoft to users and asking users to click on a URL which would lead to
Office 365 Advanced Threat Protection enables Safe Link policy which protects users at the time of click by verifying the URL against threat intelligence for any phishing page or malicious content.
Please watch this video on how to configure Office 365 Safe Links with recommended configurations.
if you want to see a quick demo on how Office 365 Safe works, checkout the following video.
Cheers.
About Me
I am Iftekhar Hussain, Global Black Belt – Technology Specialist for Cyber Defense and Threat Analytics at Microsoft.