Let's talk about passwords!
Summary In this episode of the BlueScarity Podcast, hosts Andy Jaw and Adam Brewer discuss the evolution of password guidelines, focusing on the recent updates from NIST and Microsoft. They explore the implications of these changes, emphasizing the importance of understanding human behavior in password security and the need for organizations to adopt passwordless solutions. The conversation highlights practical steps for reducing reliance on passwords while enhancing security through user education and modern authentication methods. ---------------------------------------------------- YouTube Video Link: https://youtu.be/MJ_h6TzMyEU ---------------------------------------------------- Documentation: https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf https://learn.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide https://pages.nist.gov/800-63-4/sp800-63.html ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
8 Okt 202439min
Protect against token theft
Summary In this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer delve into the critical topic of token theft in identity management. They discuss the importance of multi-factor authentication (MFA) as a primary defense against identity attacks, the nature of tokens, and how attackers exploit vulnerabilities to steal these tokens. The conversation highlights the introduction of token binding as a new protective measure, practical steps organizations can take to reduce the risk of token theft, and the significance of detecting and investigating potential attacks. The hosts emphasize the need for managed and compliant devices, user training, and the implementation of conditional access policies to enhance security. ---------------------------------------------------- YouTube Video Link: https://youtu.be/xPHqA7JzPkY ---------------------------------------------------- Documentation: https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700 ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
1 Okt 202434min
BSP Turns 4, WSUS Deprecated, macOS Firewall Woes
Summary In this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer celebrate four years of podcasting, reflecting on their journey and the importance of providing actionable insights to their audience. They discuss the significance of education in technology, particularly in relation to Microsoft products and the recent deprecation of WSUS. The conversation also covers the implications of Apple's latest OS release and the challenges faced by enterprise users. Finally, they emphasize the need for resilience in technology and the importance of having backup plans in place. ---------------------------------------------------- YouTube Video Link: https://youtu.be/cIcE-hXtCNs ---------------------------------------------------- Documentation: https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-server-update-services-wsus-deprecation/ba-p/4250436 ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
24 Sep 202440min
Cloud Security - Containers 101 & Defender for Containers
Summary In this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer delve into the world of containers, exploring their functionality, differences from virtual machines, and the importance of securing them. They discuss key tools like Docker and Kubernetes, and introduce Microsoft's Defender for Containers as a solution for managing security in containerized environments. The conversation emphasizes the simplicity and efficiency of containers, while also addressing the shared responsibility of security in modern application development. ---------------------------------------------------- YouTube Video Link: https://youtu.be/zjhIC4IoxgE ---------------------------------------------------- Documentation: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
17 Sep 202426min
IBM's Cost of a Data Breach 2024
Summary In this episode, Andy and Adam discuss the key findings from IBM's report on the costs of a data breach in 2024. They cover topics such as the increase in the cost of data breaches, the use of security AI and automation, the cyber skills shortage, the challenges of shadow data, and the importance of insider risk management. They also highlight the need for password protection, fish-resistant MFA, and data consolidation, as well as the benefits of using generative AI tools. The episode concludes with a reminder to not be afraid of AI and to embrace its potential to enhance productivity and efficiency. ---------------------------------------------------- YouTube Video Link: https://youtu.be/mbwJGjg7g0s ---------------------------------------------------- Documentation: https://www.ibm.com/downloads/cas/1KZ3XE9D ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
10 Sep 202448min
Entra Suite Overview
Summary In this episode of the Blue Security Podcast, Andy and Adam discuss Entra Suite, a new package from Microsoft that includes various Entra products and solutions. They provide an overview of each component, including Entra Private Access, Entra Internet Access, Entra ID Governance, Entra ID Protection, and Entra Verified ID. They highlight the benefits and use cases of each component and discuss the pricing options. They also emphasize the importance of using open standards and collaboration in the identity space. ---------------------------------------------------- YouTube Video Link: https://youtu.be/9zlC8NmBEp8 ---------------------------------------------------- Documentation: https://techcommunity.microsoft.com/t5/microsoft-entra-blog/microsoft-entra-suite-now-generally-available/ba-p/2520427 https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access https://learn.microsoft.com/en-us/entra/global-secure-access/concept-internet-access https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-overview https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection https://learn.microsoft.com/en-us/entra/verified-id/decentralized-identifier-overview ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
3 Sep 202439min
Where do you get technical training?
Summary In this episode, Andy and Adam discuss various resources and methods for getting training and learning about Microsoft and other technology solutions. They cover topics such as official documentation, certification tracks, Ninja training, Microsoft Mechanics, the Tech Community, customer connection programs, building a personal lab, and the importance of having a supportive network. Takeaways - learn.microsoft.com is the official documentation and training resource for Microsoft products and solutions. - Microsoft offers certification tracks for various roles and technologies, and free training is available for these certifications. - Ninja training provides deep dives and technical content on security, compliance, and other Microsoft products. - Microsoft Mechanics is a YouTube channel and podcast that offers bite-sized videos on various Microsoft technologies. - Building a personal lab using virtualization software or cloud services is a great way to gain hands-on experience. - Having a supportive network of coworkers and friends who are curious and willing to share experiences can greatly enhance learning and professional growth. ---------------------------------------------------- YouTube Video Link: https://youtu.be/5cgUfci9M9c ---------------------------------------------------- Documentation: https://rodtrent.substack.com/p/all-the-microsoft-ninja-training https://www.youtube.com/@MSFTMechanics https://www.youtube.com/@MicrosoftSecurity https://techcommunity.microsoft.com/t5/security-compliance-and-identity/bg-p/MicrosoftSecurityandCompliance https://aka.ms/joinccp ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
27 Aug 202440min
Trump and NPD Hacked, Microsoft Admin MFA
Summary In this episode of the Blue Security Podcast, Andy and Adam discuss several cybersecurity news stories. They cover the hack of the Trump campaign's emails by Iranian hackers, the breach of the National Public Data records, and Microsoft's new requirement for admins to enable multi-factor authentication (MFA). They also touch on the importance of data privacy and the need for companies to be responsible stewards of consumer data. Takeaways -Iranian hackers targeted the Trump campaign's emails in an attempt to influence the US presidential election. -The breach of the National Public Data records compromised personal information for billions of individuals, highlighting the need for stronger data privacy regulations. -Microsoft is enforcing the use of multi-factor authentication (MFA) for admins to enhance security and reduce the risk of account takeovers. -Companies should prioritize data security and be responsible stewards of consumer data, minimizing data collection and protecting it from unauthorized access. ---------------------------------------------------- YouTube Video Link: https://youtu.be/xFPPyec6GJQ ---------------------------------------------------- Documentation: https://blogs.microsoft.com/on-the-issues/2024/08/08/iran-targeting-2024-us-election/ https://npd.pentester.com/search https://www.bleepingcomputer.com/news/microsoft/microsoft-enable-mfa-or-lose-access-to-admin-portals-in-october/ ---------------------------------------------------- Contact Us: Website: https://bluesecuritypod.com Twitter: https://twitter.com/bluesecuritypod LinkedIn: https://www.linkedin.com/company/bluesecpod YouTube: https://www.youtube.com/c/BlueSecurityPodcast ----------------------------------------------------------- Andy Jaw Twitter: https://twitter.com/ajawzero LinkedIn: https://www.linkedin.com/in/andyjaw/ Email: andy@bluesecuritypod.com ---------------------------------------------------- Adam Brewer Twitter: https://twitter.com/ajbrewer LinkedIn: https://www.linkedin.com/in/adamjbrewer/ Email: adam@bluesecuritypod.com
20 Aug 202433min
