Joseph Snyder

Beware the Hidden Risk in Your Entra Environment Guest Account Risk in Entra Environment If you invite guest users into your Entra ID tenant, you may be opening yourself up to a surprising risk. A gap in access control in Microsoft Entra's subscription handling is allowing guest users to create and transfer subscriptions into the tenant they are invited into, while maintaining full ownership of them. Read the full article below ⬇️

1

1 Comment

Lots of text in the AWS post-mortem: https://lnkd.in/e-xRFw6b (edited for brevity) * already disabled the DynamoDB DNS Planner and the DNS Enactor automation worldwide * we will fix the race condition scenario and add additional protections to prevent the application of incorrect DNS plans. * For NLB, we are adding a velocity control mechanism to limit the capacity a single NLB can remove when health check failures cause AZ failover. * For EC2, we are building an additional test suite * We will improve the throttling mechanism in our EC2 data propagation systems to rate limit * we will look for additional ways to avoid impact from a similar event in the future, and how to further reduce time to recovery.

1

Communication Matters When you are talking to someone outside of IT, use plain language. Do not say their "credentials failed to authenticate against Active Directory." Say their "password did not work." Do not say there is a "network connectivity issue affecting your subnet." Say "the internet is not working in your area and we are looking into it." This is not dumbing things down. This is communicating effectively. The goal of communication is to be understood, and if the person you are talking to does not understand you, you have failed at communicating no matter how technically accurate your words were.

36

12 Comments

I like the way this article describes how enterprise IT is shifting to managing multiple innovation curves at once, with value created through how these changes intersect.

4

Another one of my favorite reads, Stephen M. R. Covey’s The Speed of Trust. It provides a clear framework to help #InfoSec leaders build teams that are more effective, resilient, and collaborative. The idea is simple: trust is a performance multiplier. It speeds up communication, lowers friction, and improves decision-making. In the context of InfoSec, where timing and clarity are critical, trust becomes an edge. Trust as a Performance Driver InfoSec is often seen as a blocker. Teams are pulled in late, deliver bad news, and seem to slow progress. That perception changes when the team builds credibility. Covey identifies four key foundations of trust: integrity, intent, capabilities, and results. * Integrity means being honest, consistent, and ethical. It shows up when security professionals admit mistakes, report risks transparently and stick to their commitments. * Intent is about motives. If other teams see security as a partner, not an obstacle, collaboration improves. Aligning InfoSec priorities with business goals builds goodwill. * Capabilities must evolve. The threat landscape changes constantly. A team that learns continuously and adapts quickly earns internal respect. * Results validate trust. If the team consistently prevents incidents, improves response times, and supports audits, people believe in the value it brings. Putting Trust into Practice Covey outlines 13 trust-building behaviors. Several are critical for security teams. * Talk straight. Be clear and honest. Drop the tech jargon and FUD. * Create transparency. Share security decisions, metrics, and incident reports. Let others see how and why you operate. * Clarify expectations. Make security requirements easy to understand and implement. * Right wrongs. When things go wrong, own the mistake and fix both the issue and the process behind it. * Extend trust. Give team members autonomy. People grow into the trust you give them. Collaboration Across the Organization InfoSec depends on partnerships with IT, engineering, HR, legal, and leadership. To build lasting collaboration, involve other teams early, listen to their concerns, and explain risks in practical terms. Work with them, not against them. When security is embedded into conversations from the start, resistance drops and adoption increases. The Payoff A high-trust InfoSec team responds faster, communicates better, and gains influence. It becomes a respected partner that protects the business without slowing it down. Covey’s principles give security leaders the tools to lead with integrity, build real partnerships, and make trust the foundation of resilience.

7

What I’ve learned (and been reminded of) every time I join an organization cybersecurity maturity isn’t about how much you spend—it’s about what you prioritize and verify. I’ve seen big budgets miss the basics, and smaller teams win by executing fundamentals with discipline. In practice, ~90% of cyber risk can be reduced by focusing on ten controls: 1. Multi-Factor Authentication everywhere (40–50%) — Stops most account takeovers. 2. Automated patching & vulnerability scanning (30–40%) — Closes the doors ransomware loves. 3. Endpoint detection & response (EDR/XDR) (25–35%) — Detects and contains active threats. 4. Least privilege / access hardening (20–30%) — Limits lateral movement after compromise. 5. Immutable backups with regular restore testing (20–25%) — Ensures you can recover. 6. Cloud security posture management (15–20%) — Fixes risky misconfigurations early. 7. Advanced email and web filtering (10–15%) — Reduces phishing and BEC exposure. 8. SIEM + SOAR (10–15%) — Correlates signals and automates response. 9. Data loss prevention (10–15%) — Keeps sensitive data from walking out the door. 10. Security awareness and culture (5–10%) — Turns people into a real control. Even the first five typically cut exposure by ~89%—often using tools you already own in Microsoft 365, Azure, AWS, or Google Cloud. The pattern is consistent: Clarity and accountability reduce more risk than budget ever will. If you lead a business, ask your team: Which of these ten can we prove are working today? That answer is your real readiness. #CyberSecurity #Leadership #CISO #RiskManagement #CloudSecurity #SMB #InfoSec #Microsoft365 #AWS #Azure #GoogleCloud #BusinessResilience #DataProtection #CyberAwareness #ExecutiveLeadership #CyberStrategy

1

Critical vulnerabilities (CVE-2025-53770 & CVE-2025-53771) affect on-premises SharePoint Servers only & SharePoint Online remains unaffected. Microsoft has released patches for SharePoint Subscription Edition & SharePoint 2019. 🔒 Apply updates immediately to stay protected. Links in the comments

9

1 Comment

Are CMMC Level 2 SSP expectations inconsistent across C3PAOs? There's a wide range of feedback from Lead CCAs. On one end: “Say what you do.” Minimal narrative. Move on. On the other: -FedRAMP-level inheritance mapping. -Detailed CSP CRM citations. -Explicit 800-53 crosswalks. -Tool configurations. -Role-level procedural detail. IMO we have calibration drift... “Say what you do” is more of a slogan than a standard. To one assessor, it means two paragraphs. To another, it means re-documenting Azure GCC High’s FedRAMP baseline inside your SSP. Those are NOT equivalent expectations. CMMC Level 2 is supposed to assess whether practices are performed, not whether an OSC can recreate FedRAMP documentation. IMO an SSP should: -Clearly describe how the practice is operationalized -Identify responsible roles -Reference supporting technologies -Clarify shared responsibility boundaries -Point to objective evidence It should NOT require duplicating the CSP’s entire control set. When subjectivity drives documentation inflation, we create: -Cost distortion -Timeline unpredictability -A documentation arms race Overengineering SSP narratives does not increase security. It increases friction. We need calibration. Clear examples of sufficiency. Alignment on inheritance expectations. CMMC Level 2 should measure operational maturity not literary endurance. Are you seeing the same variance? #cmmc #c3pao #ssp #dib

58

21 Comments

🚨 Important Notice: Technical Issues Impacting FRED Websites We are currently experiencing technical issues with our websites due to the ongoing Amazon Web Services (AWS) service disruption in the East Coast region, specifically related to network connectivity. This outage may impact data updates and some functionality on: - FRED (Federal Reserve Economic Data) - ALFRED - FRED Accounts We are actively monitoring the situation and working to restore full service as soon as the AWS issues are resolved. We appreciate your patience and apologize for any inconvenience this may cause your research or work. #FRED #EconomicData #AWS #Outage #Update

5

1 Comment