Leonardo Ramirez

Just landed: the latest Microsoft Entra updates packed with real security wins. From network-level controls for AI data exfiltration to built-in protection against prompt injection attacks, this release is all about locking down modern identity and access at scale. If you’re working on Zero Trust or AI security, this one’s worth a look.

70

2 comentarios

📖 𝐍𝐞𝐰 𝐞-𝐛𝐨𝐨𝐤: 𝐒𝐞𝐜𝐮𝐫𝐢𝐧𝐠 𝐀𝐧𝐬𝐢𝐛𝐥𝐞 𝐏𝐥𝐚𝐲𝐛𝐨𝐨𝐤𝐬 𝐚𝐧𝐝 𝐈𝐧𝐟𝐫𝐚𝐬𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 Security shouldn’t be an afterthought in automation. This e-book shows how to embed security early in the Ansible automation lifecycle - covering playbooks, dependencies, infrastructure, and governance. Inside, you’ll learn: ✅ Why security must start early in Ansible automation  ✅ Common security risks in playbooks and beyond, and how to manage them  ✅ Best practices for secure, compliant, and reliable automation workflows Ideal for teams looking to make security a core part of their Ansible processes. Get it here 👉 https://lnkd.in/dDtbcvzv   #Ansible #ShiftLeft #AutomationSecurity #SteampunkSpotter

13

What happens when you combine Tetragon's eBPF-powered runtime telemetry with Splunk Enterprise Security? You turn the Linux kernel into a security sensor. The Splunk Threat Research Team just published Part 2 of their series 'Splunking Isovalent Data.' The post provides a hands-on walkthrough of real Kubernetes attack scenarios and how to detect them. The scenarios include: - Port scanning from inside a pod (network reconnaissance) - cURL beaconing to a malicious domain - Late process execution — shells spawning after pod startup - Privilege escalation via APT pre-invoke hooks - Kprobe spikes indicating container escape attempts - Access to the cloud metadata service (credential harvesting) Kernel-level visibility from Tetragon doesn't just help detect attacks, it closes the feedback loop between observability and hardening for a more resilient Kubernetes runtime. Read more ➡️ https://lnkd.in/ehina-zP #Splunk #eBPF #Cilium #Security #Kubernetes

42

Cloud Complexity = Blind Spots Too many tools, fragmented visibility. With 16+ average tools in play, therefore security teams face: 🚫 False positives 🕵‍♂ Ineffective threat hunting ⏳ Delayed response (MTTD/MTTR) 🔋 Alert fatigue 🌩 Environmental & SoC Blind Spots EDRs struggle to understand where the workload resides—laptop, cloud, private DC, or home. This lack of cloud context breaks detection chains and skews threat triage. 🔄 Cloud Security Must Be Unified Application Security, Posture Management, Runtime Security & SOC must talk to each other. Siloed tools = missed attacks. 💡 Takeaway 👉 Security must be part of the code. 👉 Context-aware detection is non-negotiable. 👉 DevSecOps isn’t a buzzword—it’s survival. Deepak Mathur, mahima dhamija, Nandu Kannan, Krishnan V V, Kanav Aggarwal, Arnav Khorana, Suvin Mullaseril Rishi Rajpal Mansi Thaparr Ravinder Arora Group Captain Ashok Kumar (IAF Veteran) Rajesh Kumar Alok Malik Dhananjay Khanna #DevSecOps #CloudSecurity #SOC #CISO #EDR #CloudNative #ZeroTrust #CybersecurityLeadership #SecurityByDesign #MTTR #SecurityOps

33

4 comentarios

Curious how to make threat modeling faster and more consistent—without slowing down development? Discover how Devici is helping automate and scale secure design from the start. 🎥 Watch this quick overview to see how we’re helping teams embed security early and often. https://lnkd.in/gYhvpdaK #ThreatModeling #DevSecOps #AppSec #SecurityCompass #Devici #SecureByDesign

8

The biggest cloud security mistake I keep seeing? Too much access. On the Tech Woke Podcast, I asked Marc how organizations actually remediate cloud security issues. His answer: automation. Trying to manually review cloud permissions and configurations doesn’t scale. Cloud environments change too fast. Marc recommends using platforms built to continuously monitor cloud risk, such as Prisma Cloud, Wiz, and Qualys. These tools can automatically scan for: • Overly permissive IAM roles • Publicly exposed resources • Cloud misconfigurations • Infrastructure vulnerabilities You can also use CloudTrail to audit activity and see who is accessing your environment. The reality is simple: Manual cloud security doesn’t scale. Automation does. #CloudSecurity #Cybersecurity #TechWoke

1

1 comentario

Cloud is secure. Misconfigurations aren't. Flexibility + efficiency = Great. Exposed buckets + open IAM = Disaster. 80% of cloud breaches trace to config errors: Public storage buckets Excessive IAM permissions/roles Unencrypted data in transit/rest​ Wiseman CyberSec CloudSec Principles: Least Privilege IAM → Enforce granular access Encryption Everywhere → Automate TLS + E2E Continuous Monitoring → Anomaly alerts on configs Infrastructure as Code → GitOps + policy-as-code Prevention mindset: Lock high, monitor all, automate everything. DM "CloudSec" for config hardening checklist. Scan QR.​ wisemancybersec.com | +91-704-205-6915 #CloudSecurity #Misconfiguration #IAM #CloudCompliance #AWS #Azure #GCP #DevSecOps #InfrastructureAsCode #ZeroTrust #CyberSecurity #CISSP #CISM #ISO27001 #DPDPA #SOC #SIEM #GRC #WisemanCyberSec #InfoSec

7

We all know the story: you finally get your logs into Splunk… and then spend hours untangling timestamps, sourcetypes, and formats that don’t line up. The reality? Broken data ingestion silently erodes threat detection. SOC teams lose visibility. Alerts misfire. Storage costs rise. That’s why Axoflow is heading to Splunk .conf25 in Boston. We’ll be sharing how we’ve tackled ingestion and parsing problems at scale, turning noisy, inconsistent logs into clean, structured, actionable data. Our team is ready to discuss real-world fixes for the problems that drain time and budget: Balázs Scheidler Sándor Guba Neil Boyd Mark Bonsack Laurakate Bayman If ingestion is still your bottleneck, what’s stopping you from fixing it upstream instead of in your SIEM? See you at .conf25. 🚀 #conf25 #splunk #SIEMOps #SOCWorkflows

23

2 comentarios

Traditional runtime security falls short in containerized environments. This blog explores how eBPF enables deep, real-time protection at the kernel level. Read more: https://lnkd.in/dMKTm-yR

8

🚨 Are you really using your Splunk license efficiently? Many organizations hit Splunk license limits sooner than expected, leading to ingestion throttling and license violations. But the real question is 👇  Are all the logs you ingest actually adding value to your security use cases? In most environments, a significant portion of ingestion comes from low-signal, noisy logs or unnecessary fields that add little security value—yet silently consume license quota. So how do you:  ✔ Identify low-value data?  ✔ Reduce ingestion without losing visibility?  ✔ Optimize logs before they reach Splunk? That’s where Cribl comes in. Cribl is an observability and log data management platform that allows you to collect, process, filter, and route data before it reaches Splunk or any SIEM. Simply put, Cribl gives you control over your data pipeline. Customers use Cribl to reduce ingestion costs, improve data quality, enable flexible architectures, and onboard new data sources without increasing license pressure. 📌 Lower volume doesn’t mean less visibility—it means smarter data and better security outcomes. 💬 Curious how much of your Splunk data is truly valuable? -Isabel #Cribl #Splunk #SIEM #CostOptimization #LogManagement

17

1 comentario

Most attacks follow the same sequence: Execution ➡️ download ➡️ persistence ➡️ lateral movement We’ve gotten very good at detecting each step. But if execution is controlled, the chain never unfolds. No second stage. No pivot. No incident to respond to. That’s the shift from detection to threat-driven application control. 👉 https://lnkd.in/eQRk-Gse

9

1 comentario

Security can’t be an afterthought in modern software development. As engineering teams accelerate cloud adoption and release cycles, traditional security models that detect issues late in testing simply can’t keep up. The result? Higher remediation costs, delayed releases, and increased risk exposure. Forward-looking organizations are embedding application security directly into the developer workflow. With GitHub Advanced Security, teams can detect vulnerabilities earlier, automate security checks, and strengthen secure coding practices without slowing development. Key capabilities include:  • Intelligent code analysis to identify risky patterns  • Automated dependency monitoring and updates  • Secret scanning to prevent credential exposure  • Security insights surfaced directly in pull requests By integrating security into the development lifecycle, organizations can reduce manual overhead, improve code quality, and build a stronger AppSec culture across engineering teams. Read more: https://lnkd.in/gMu_cffZ #DevSecOps #ApplicationSecurity #SecureCoding #GitHub #CloudSecurity #SoftwareEngineering #EngineeringIntelligentEnterprises 

3

Regex looks harmless. But one misplaced pattern can quietly dismantle critical security controls. In “Regex Gone Rogue,” we uncover how tiny mistakes, missing anchors, loose matching, flawed assumptions open the door to authorization bypasses and exposed automation pipelines. No exploits. No malware. Just logic doing exactly what it was told. We don’t warn against regex. We warn against trusting it blindly. Because when security decisions hide in patterns, logic becomes the attack surface. 👉 Read how a few characters can break everything. 🔗 https://lnkd.in/gUEw5YT5 #CyberSecurity #AppSec #SecureCoding #CyberLabs

20

Stop buying more security tools. Start connecting the ones you have. Most security teams are drowning in data but starving for context. You have SAST for code, DAST for runtime, and cloud scanners for infrastructure, but they all live in different silos. The result? You spend hours chasing "critical" alerts that don't actually matter. This is why ASPM (Application Security Posture Management) is shifting the industry. It’s not about adding another scanner; it’s about unifying the ecosystem. By connecting your tools, you can correlate findings and finally answer the question: "Is this vulnerability actually exploitable?" A unified view lets you automate fixes and prove compliance without the manual headache. The 5-step process above isn't just a workflow; it's your roadmap to sanity. Is your team suffering from alert fatigue or tool fatigue? Which is worse? 👇

17

1 comentario

🚨 Zero-days + SharePoint = A dangerous combo. Our team is tracking active attacks using a new “ToolShell” exploit chain to target on-prem Microsoft SharePoint servers. By combining two patched vulnerabilities with two zero-day variants, attackers are achieving remote code execution—and attacks are accelerating. 🔗 Read the full analysis: https://ftnt.net/6040fPfYr

37

Download the 30-60-90 day plan 👉 https://lnkd.in/ettKgfrF SOC workflows often depend on signals that arrive too late. By the time attacker infrastructure is weaponized, analysts are already under pressure to triage alerts, pivot across tools, and contain the threat before it spreads. The SOC Blueprint breaks down how teams can start shifting left with a practical plan, making preemptive defense feel achievable, not like a full-stack overhaul. #soc #soar #siem #preemptivedefense

18

Active Directory: One Misstep = Full Domain AD is still the fastest path from a phished user to full domain takeover. Most breaches don't need zero-days - just weak tiering, legacy protocols, and misconfigurations. If AD runs your business, hardening it isn't optional. Tier-0 boundaries, gMSA/LAPS, signed protocols, and real assumed-breach testing. #ONSEC #Cybersecurity #EnterpriseSecurity #Pentesting

24

Empty fields break investigations. This piece walks through a simple Splunk fix for empty coalesce results, so your searches return clean, usable values instead of blanks. The outcome is tighter correlation, clearer dashboards and faster triage across firewall, endpoint and network data. If your SOC lives in Splunk and you have ever chased a null value through a query, this guide will save you time. Read the article: https://lnkd.in/eRRz_ts7 #Splunk #SecurityOperations #SIEM #CiscoSecure #ReSolution #ThreatHunting #DetectionEngineering #UKTech

1