Lars Falch

🛡️ Cyber Defense-in-Depth: Reimagined Layered Security for a Perimeter less World 🌐 "Cyber Resilience Across Every Identity, Every Interaction, Every Layer." The traditional layered model assumed fixed users, static infrastructure, and physical perimeters. That world is gone. Today, threats don’t follow rules — and neither should your defenses. Human is the first line of defense, now augmented with AI Agents. I have reimagined the entire Defense-in-Depth model, aligning it with: - Distributed identities - AI-driven agents - Cloud-native workloads - Human-machine convergence - Zero trust-first access models - Sovereign data, real-time risk, and smart enforcement Here’s the shift: - From "Perimeter" ➝ to EDGE coupled by "Identity is the new Perimeter" - From "User" ➝ to HUMAN / AGENTS - From "Network + App" ➝ to full-stack coverage of Workloads, Apps, and Data - From reactive controls ➝ to proactive resilience through #CNAPP, #SBOMs, #CIEM, #AI Policy Agents, and more -This is not a framework. It's a blueprint for cyber resilience — one that blends: - Controls (#ZTNA, #SWG, #EDR, #PAM, #DSPM, #RASP) - Capabilities (#Threat Intel, #CTEM, Red Teaming, #SOC Automation) - Culture (#Awareness, #Gamification, #Simulations) - Governance (#Strategy, #Risk, #TPRM, #Compliance, #Cyber Risk Quantification) Every layer answers a question: Who’s behind the keyboard? Who is trying to access? Where are they interactive from? When/Where the policies are enforced? How it's transported? What is being processed? What they're interacting with? and Finally... "Why" it matters? This is Defense-in-Depth, Rewired for Reality. Let’s stop building walls. Let’s build adaptive layers. 👇 I'd love to hear how you’re evolving your security architecture. Drop your comments, ideas, or disagreements. #CyberSecurity #DefenseInDepth #CyberResilience #ZeroTrust #SecurityArchitecture #AIinSecurity #XDR #ZTNA #CNAPP #CISOLeadership #CloudSecurity Cyber Security News ® #CloudSecurity #SASE #EdgeSecurity #WorkloadSecurity #CISOTalk #CISOLeadership #InfosecLeaders #CyberCommunity

106

7 Kommentarer

We’ve got more security tools, dashboards, and buzzwords than ever—and yet, breaches still find a way in. Why? Because we keep treating symptoms (alerts, audits, “compliance”) instead of fixing the foundation: messy data, legacy sprawl, and vague accountability. AI can help, sure—but only if we stop using it to duct-tape old problems. It’s time to stop playing defense in depth and start leading with clarity. Security isn’t just a tech issue—it’s a business strategy. #CISO #Security #CybersecurityFoundations

87

11 Kommentarer

🔐 Security programs don’t fail due to a lack of alerts — they fail when decisions get buried in noise. High-performing CISOs don’t chase every signal. They triage risk like surgeons — with clarity, intent, and speed. The real question isn’t what happened, but: 👉 What demands attention 👉 What runs itself 👉 What can be parked This clarity doesn’t come from more tools — it comes from a decision model aligned with business pressure. 🚨 Most teams escalate what’s loud. 🏛️ Mature teams escalate what can move the boardroom. While many chase false positives, top CISOs build triage layers that cut through clutter and expose real exposure paths. 🔍 High-functioning security teams do three things better: Link alerts to asset criticality — not just severity Escalate based on crown jewel impact — not noise frequency Automate only when reliability, context, and closure are guaranteed What you automate, defer, and escalate defines your operational maturity. #CyberSecurity #CISO #RiskManagement #SecurityLeadership #OperationalExcellence #ThreatIntelligence #DecisionMaking #SecurityStrategy

43

5 Kommentarer

Cyber-spying is possible with embedded sensors in the mobile phone. For those who don't know, modern mobile devices are full of these sensors and they all look innocent. Because of their embedded mechanisms, most data is hosted locally. The most widely used of these sensors are MEMS (Micro-Electro-Mechanical Systems) based structures such as accelerometers, gyroscopes and magnetometers. As a note and an example, these sensors are usually called directly at the system level via APIs such as SensorManager (Android) or Core Motion (iOS). Third-party applications can receive hundreds of samples per second through these APIs, subject to permissions. Sensor data is usually unencrypted, processed directly in user space, and accessible to multiple applications simultaneously. If you are curious, you can check how many apps installed on your mobile device ask for this permission. With each permission, the manufacturer can access your sensor data. Keylogger? Yes, even that is possible. When typing on a mobile device, the user creates very slight tilts and movements on the surface of the device. In 2014, a concept called Touchlogger demonstrated that by analyzing only gyroscope and accelerometer data, it could predict with up to 70% accuracy which keys the user pressed on a virtual keyboard. Ambient sound listening? That is possible. Gyroscopes show a low frequency (typically 80-250 Hz) sensitivity to sound waves. This makes them low-resolution passive microphones. In 2014, researchers from Stanford University developed a system that uses gyroscope sensors in mobile devices to detect surrounding speech. Take a look at the concept of a "gyrophone". PIN attack? Yes. Mobile browsers support access to sensor data via JavaScript. This means that sensor data can be collected from a user simply by visiting a website, without the need to install an application. A 2017 study by Newcastle University showed that by collecting accelerometer and gyroscope data through a web page, 4-digit PINs can be guessed with 74% accuracy. To all this you need to add behavior patterns. If I tell you that the Pegasus spyware developed by NSO Group also accesses sensor data, I think you will understand the seriousness of the situation. Such data has been used to determine when the target person is in a meeting, how often they enter and leave a room, or even if they are asleep. The misuse of these sensors threatens not only individual privacy but also national security. In particular, surveillance of vulnerable individuals such as diplomatic officials, journalists and corporate executives through sensors on their devices poses a great risk. I suggest you take a look at this little spy data. Just as a matter of awareness, friends! ^-^/ #cybersecurity #dataprivacy #informationsecurity #privacy #technology #threatintelligence

203

9 Kommentarer

Patching won’t save you this time. And Microsoft just said it out loud. In response to the actively exploited SharePoint zero-day, Microsoft and CISA have rushed out emergency patches and technical guidance. But here’s the critical line most executives are missing: “𝐏𝐚𝐭𝐜𝐡𝐢𝐧𝐠 𝐚𝐥𝐨𝐧𝐞 𝐢𝐬 𝐧𝐨𝐭 𝐬𝐮𝐟𝐟𝐢𝐜𝐢𝐞𝐧𝐭. 𝐁𝐚𝐜𝐤𝐝𝐨𝐨𝐫𝐬 𝐦𝐚𝐲 𝐩𝐞𝐫𝐬𝐢𝐬𝐭.” That’s not a casual warning. It’s a red flag to every SOC, IR team, and enterprise CISO that remediation is no longer just about software updates—it’s about 𝐟𝐮𝐥𝐥 𝐟𝐨𝐫𝐞𝐧𝐬𝐢𝐜 𝐭𝐫𝐢𝐚𝐠𝐞. Because this exploit didn’t just allow remote code execution. It enabled 𝐬𝐭𝐞𝐚𝐥𝐭𝐡𝐲, 𝐩𝐞𝐫𝐬𝐢𝐬𝐭𝐞𝐧𝐭 𝐛𝐚𝐜𝐤𝐝𝐨𝐨𝐫 𝐢𝐧𝐬𝐭𝐚𝐥𝐥𝐚𝐭𝐢𝐨𝐧—the kind that survives restarts, evades basic EDR, and blends in with legitimate SharePoint services. Once inside, attackers likely leveraged built-in tools, hijacked tokens, and pivoted laterally—leaving minimal footprints. So if your mitigation plan ends at CVE patching, you’re already behind. What you need now is: — Deep process memory inspection — Audit of service principal tokens and app identities — Rollback analysis of recent config drifts — Anomaly detection in service account behaviors — Hard resets of cryptographic material, if exposed This is a 𝐩𝐨𝐬𝐭-𝐜𝐨𝐦𝐩𝐫𝐨𝐦𝐢𝐬𝐞 𝐬𝐜𝐞𝐧𝐚𝐫𝐢𝐨, not a containment issue. CISOs must shift from “are we patched?” to “have we been lived in?” Because advanced actors don’t breach to vandalize—they breach to linger. This breach has changed the SharePoint threat model permanently. Time to treat collaboration platforms as Tier-0 assets—because that’s exactly how the attackers see them. #CRM #CyberSecurity #SalesforceSecurity #SaaSHardening #HubSpot #AccessControl #ZeroTrust #DataBreach #RevenueOps #SaaSSecurity #InfoSec #CISO

292

17 Kommentarer

The most dangerous question in Cyber GRC? "How many Windows hosts do we actually have?" Ask four teams. Get four different answers: → AV: 7,864 → CMDB: 4,879 → Active Directory: 6,256 → SIEM: 9,886 Which one is right? The uncomfortable truth: they’re all right, and they’re all wrong. Every tool views the world differently: • AV counts only what it protects • CMDB sees only what’s registered • SIEM counts every log source as an asset • EDR can’t see air-gapped systems Meanwhile… Shadow IT spins up cloud instances faster than you can log them. Remote work scatters devices across home networks. And that IoT gadget plugged in last Tuesday? Invisible to half your stack. This isn’t just a security problem. It’s a governance problem. You can’t protect what you can’t see. You can’t manage what you don’t know exists. And you can’t comply when your asset count is just a guess. Until you fix asset visibility, every other investment, even AI-driven detection, is built on quicksand. So… what’s your organisation’s “magic number” gap? My bet? It’s bigger than you think.

62

16 Kommentarer

Two newly disclosed N-able vulnerabilities, CVE-2025-8875 and CVE-2025-8876, have been added to CISA’s KEV Catalog. They affect N-able’s N-central remote monitoring and management (RMM) platform. These flaws allow local code execution and command injection but require authentication to exploit, meaning they are unlikely to be used at the beginning of an exploit chain. Alexander Culafi at Dark Reading covers the details, noting the vulnerabilities impact versions prior to 2025.3.1. The article also features insight from Rapid7's Seth Lazarus: “They require authentication to achieve exploitation, which is much less severe than what we’ve recently seen, and likely why exploitation in the wild doesn’t appear to be widespread.” Read the full breakdown here: https://lnkd.in/eiukB6HM

77

🚨 July 21 Update on Microsoft SharePoint 0-day (CVE-2025-53770 and CVE-2025-53771) Threat Campaigns 🚨 Here are some initial observations from the past 48 hours: ☣️ Microsoft just released security updates for all supported versions of Microsoft SharePoint. Patch now. ☣️ The early 0-day exploitation was broad and opportunistic. We're aware of victims in several sectors and global geographies. The activity primarily involved the theft of machine key material which could be used to access victim environments after the patch has been applied. ☣️ We assess that at least one of the actors responsible for the early exploitation is a China-nexus threat actor.  ☣️ Multiple threat actors are actively exploiting this vulnerability now. New threat actors with diverse motivations will continue to exploit these vulnerabilities over time. ☣️ Several security researchers are actively scanning for vulnerable SharePoint servers and looking for evidence of compromise. Some security vendors are exploiting the vulnerability to determine if the SharePoint server is still vulnerable.  ☣️ There is a lot of noise in logs. Organizations will likely see multiple discrete sets of activity. Some may be associated with threat actors, some may be security researchers/scanners. Every organization with on-premises Microsoft SharePoint should do the following: 1️⃣ Apply the patches right away. 2️⃣ Rotate SharePoint Server ASP.NET machine keys. 3️⃣ Enable additional security controls such as Windows Antimalware Scan Interface (AMSI) and EDR. 4️⃣ Forensically examine your SharePoint system to determine if it was already compromised❗

259

10 Kommentarer