Barath Gosakan, M.Eng, SSCP, CISSP, CISA

The impact of a security incident is largely dependent on the quality and swiftness of the response. Complete Incident Response playbooks for common threats, tabletop exercises, and simulations help your team respond fast and comprehensively. Do you have updated IR playbooks for common cloud threats ? if not, here are some resources that can help you: 1) A new app I created in PartyRock that builds initial IR plans for you to use as template for your plans: https://lnkd.in/dMf492ee I instructed it to provide: 1.Preparation Steps, 2. Detection Mechanisms, 3. Response Procedures (Containment, Eradication, Recovery), 4. Post-Incident Activities (While I'm not a fan of using GenAI for everything, this is actually a good use case, as it provides good ideas with commands that speed up the response) 2) Sample playbooks from our AWS Customer Incident Response Team: https://lnkd.in/dyy2TV7P 3) Threat Technique Catalog for AWS (like a Mitre Att&ck framework for AWS): https://lnkd.in/dsHNjWNc 4) AWS SkillBuilder subscriptions include access to the AWS Jam platform (gamification) that has challenges for the blue team to practice incident response in live aws accounts. https://skillbuilder.aws/ 5) AWS ProServe has a service offering to run tabletop exercises for your AWS Cloud workloads. Contact your AWS Account Manager to request more details if you're interested in this service offering or contact proserve sales from here: https://lnkd.in/dRtv7RVE The AWS Security Maturity Model has multiple recommendations related to this topic: - Define incident response playbooks (phase: Foundational) - Run TableTop Exercises - Simulations (phase: Efficient) - Forming a Blue Team (phase: Optimized) and several others, you can find the SMM here: https://lnkd.in/dztMvSUs Any other important resource is missing here? I read your comments. Any feedback for improvement in any of these assets ? please connect via Linkedin with the feedback on the invitation or write it here on the comments. Follow Dario Goldfarb for more resources on Cloud Security

371

17 Comments

URGENT: CISA Calls on Organizations to Swiftly Embrace Microsegmentation On July 29, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) published “Microsegmentation in Zero Trust, Part One: Introduction and Planning” — setting a renewed standard for securing modern IT environments under the Zero Trust principle. Microsegmentation is central to Zero Trust Architecture, dramatically reducing attack surfaces, limiting lateral movement, and boosting visibility. CISA recommends a risk‑based, phased approach: from asset discovery to dependency mapping, policy design, and incremental deployment. This is not guidance for next year—it’s a mission-critical directive for today. Whether you're in public or private sector IT, the time to plan and act is now. At Stratejm, a Bell Canada company, we're proud to partner with Illumio, the original microsegmentation specialist and leading Zero Trust Segmentation platform recognized by Forrester. Together, we are bridging theory and action. How Stratejm + Illumio empower your Zero Trust journey: 1. Instant visibility: Rapid insight into application and workload communication patterns . 2. Automated policy recommendations: AI-driven guidance helps eliminate guesswork . 3. Resilient enforcement: Real‑time segmentation across data centers, hybrid cloud, containers, endpoints, IoT and OT.   4. Breach containment: Minimize blast radius during active threats with adaptive policies . Key Steps You Should Take Now: 1. Join cross-functional teams to manage asset mapping and policy design Prioritize segmentation of your critical assets. 2. Start with a low‑risk or non‑production pilot, refine policies based on actual traffic flows. 3. Deploy Illumio with Stratejm’s guidance to operationalize safe, scalable segmentation. 4. Monitor continuously and iterate to adapt as your environment evolves. Stratejm + Illumio deliver CISA‑aligned, zero‑trust‑ready microsegmentation—fast. In a threat landscape where breaches can escalate in minutes, delaying is not an option. Ready to act? Let's talk about how Stratejm and Illumio can help you implement zero trust microsegmentation that works from day one. #ZeroTrust #Microsegmentation #CISA #Cybersecurity #Stratejm #Illumio #BreachContainment #SecurityResilience

75

6 Comments

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

🚨 CRITICAL ALERT: Mass exploitation of multiple Oracle E-Business Suite (EBS) vulnerabilities, including a 0-day, by Clop for data theft and extortion   Here's what you need to know:   1️⃣ Clop exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victim in August 2025. 2️⃣ Clop is the actor behind prior mass exploitation, data theft, and extortion campaigns impacting customers of MOVEit and other managed file transfer solutions. They've made a lot of money over the years. 3️⃣ Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet. 4️⃣ Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882). 5️⃣ CVE-2025-61882 is a critical (9.8 CVSS) vulnerability that enables unauthenticated remote code execution.   ⚠️ Given the broad mass 0-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised.   Thanks to the Oracle team for the collaboration.   🔗 Additional details from Oracle: https://lnkd.in/eFaF-hu3

556

9 Comments