Jesse Lesperance

Download Pentera Labs Report - revealing three new critical injection points in the ingress-nginx controller, building on Wiz’s IngressNightmare CVE. These overlooked vulnerabilities could let attackers hijack traffic, spoof headers, or reach unauthorized backend services - They exist in one of the most widely used ingress controllers in Kubernetes, putting countless environments at risk. This research highlights how small misconfigurations can lead to major exposure in modern cloud-native architectures. What’s Inside: ✅ 3 new injection vulnerabilities in ingress-nginx ✅ How attackers find and exploit CVEs in open source ✅ Actionable tips to secure your Kubernetes environment https://lnkd.in/eHtX6EdP

9

1 Comment

NTDS.DIT extraction provides a stealthy way for bad actors to access AD. How can you cut them off before they do damage? Senior Identity and Security Architect Huy Kha explains that detecting NTDS.DIT extraction requires attention to command-line activities and domain controller Application logs. Learn how maintaining this level of vigilance is made easier by using automation in tools such as endpoint detection and response (EDR) solutions. 🔗 https://lnkd.in/grnZuztm

30

Security teams are buried in dashboards, queries, and manual triage. ORDR IQ changes that. Ask a question or give a prompt in plain language: "Which devices are affected by this CVE?" or "Generate zero-trust policies for these pumps," and get verified, actionable answers in seconds. Built on our Asset Intelligence Graph spanning 100M+ devices, ORDR IQ turns insight into execution with full governance and audit trails built in. 🔗 https://bit.ly/48aQROh

9

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

145

11 Comments

You might be feeling frustrated by the endless struggle of getting Sigma detection rules to work seamlessly in your open-source SIEM stack. It probably feels like every new rule demands manual conversions, special configs, and a ton of guesswork. It can be exhausting--and I’ve definitely been there. In this walkthrough I introduce how we can incorporate Velociraptor DFIR to solve our Sigma challenge. I share how I set up automated scans, tackled noisy detections, and fed alerts into my incident-response workflow (CoPilot). https://lnkd.in/gX5-X_mN

90

3 Comments

Access creep is real, and it’s putting your org at risk. ⚠️ Manual provisioning leads to identity sprawl, excessive privileges and forgotten access that lingers long after employees leave. See how automation and role-based access control (RBAC) can help you clean up your directories and enforce least privilege across AD and Entra ID. 👉 https://okt.to/DWZq0I #admanagement #IdentitySprawl #identitysecurity

36

🚨 Up to 90% of SOC alerts are false positives. Prophet AI filters noise, automates triage, and cuts response time from hours to minutes—boosting efficiency without adding headcount. See how AI analysts transform your SOC → https://lnkd.in/gr9yr6NR

19

1 Comment

Most security programs validate once a year and hope for the best. Annual pen tests, compliance checkboxes, tools that were tuned once and never retested. Meanwhile, attackers aren't waiting for your next assessment. Here's why traditional validation is broken and how CTEM fixes it. Download the full guide: https://hubs.ly/Q0447YMl0 #CTEM #ThreatEmulation #cybersecurity

12

For those of you navigating CRA & RED-DA compliance… this one’s worth a read. For many years product security compliance was treated like a checklist exercise something to rush through right before launch. CRA and RED-DA changed that. Today, compliance isn’t optional, and treating it as a one-off task is a recipe for delays, lost trust, and missed opportunities. My colleague David Nosibor shares how the PSCOPE Maturity Framework can flip the script turning regulatory compliance into a continuous operational capability that drives performance, scalability, and trust. Instead of chasing PDFs and scrambling for evidence, PSCOPE builds shared language, measurement, and maturity across governance, automation, supply chain, and monitoring. I strongly believe that this is exactly the kind of shift our ecosystem needs. https://lnkd.in/eBudy-wk #CyberSecurity #CRA #RED #Compliance #ProductSecurity #PSCOPE #ContinuousCompliance #CyberResilience #IoT #Regulations #CyberPass

20

1 Comment