InfoSec Pro working as Advisor and CISO. GIAC GSLC, GDSA and GDAT. Scripter, architect, awareness, governance, risk and compliance. @dotBATman@infosec.exchange
Rogaland, Sandnes
Joined April 2009
- Tweets9.7K
- Following578
- Followers360
- Likes8.5K
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
In case you missed it, back in October we published a brand new guide for deploying phishing-resistant passwordless in your organization with Entra ID: aka.ms/PasswordlessGuide ! This is the outcome of a ton of effort across Microsoft, please use it to begin your journey!
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Did you vote in America yesterday? If so, you just got doxed
This site takes voter records that can be hard to source and puts them all into one place. Name, address, voter history, for free. It turns voting into a privacy and security risk 404media.co/voted-in-america…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
The ‘Windows Server 2025 Security Book’ is also available at
techcommunity.microsoft.com/…
Two things that caught my eye:
▪️Credential Guard is now enabled by default on servers.
▪️Delegated Managed Service Account (DMSA) is now introduced.
This quoted post is unavailable.
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Acting as digital detectives, we uncovered the sale of a bypass tool on underground forums. This investigation began when a bad actor tried to test an EDR bypass tool. Read what we learned from there: bit.ly/4eb8nlh
ALT Representation of malware displayed over a computer screen
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Internet Archive has not been archiving since 10/8.
Google Cache has stopped caching.
The Alexa service - the one that used to rank web traffic (not the Amazon virtual assistant) is gone.
The ability of censors to memory-hole the internet is growing.
brownstone.org/articles/they…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Fortinet svakheten aktivt utnyttet siden juni av UNC5820. Nå fått CVE-nummeret CVE-2024-47575. Fortinet har publisert sikkerhetsoppdatering for å patche sårbarheten. telenorsoc-news.blogspot.com…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Everything in this image that doesn't have spikes coming off of it is a galaxy.
Every. Single. Dot.
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
If you find Defender for Endpoint missing in 24H2, let @JasonSandys know
OEMs were notified a long time ago, and shocking, they haven't fixed it
This is why Intune and other solutions should automatically remediate as part of onboarding
Don't trust OEMs..
👀 The mssense service is missing on Windows 24H2 images. If you're using Defender for Endpoint, the absence of mssense prevents onboarding devices to MDE on 24H2. This issue affects all devices running 24H2, not just Copilot+ devices.
Here is a detection and remediation script for you to deploy: github.com/schwerdti/Endpoin…
Steffen has a great post here about it: manage-everything.cloud/post…
#Windows11 #24H2 #MDE
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Bank of Ireland customers targeted in ‘online chat’ scam independent.ie/business/bank…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
What we know: DDOS attack–fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords.
What we’ve done: Disabled the JS library, scrubbing systems, upgrading security.
Will share more as we know it.
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Introducing Cloudflare’s free security.txt generator, empowering all users to easily create and manage their security.txt files. cfl.re/4eK1sAq
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Sweet! The 2024 @SANSInstitute #HolidayHack Challenge reg page just dropped this morn! Lotsa new game dynamics this year & fun hints in the artwork! Register to be notified when this year's free holiday-themed range launches Nov 11, 2024. Check. It. Out! sans.org/mlp/holiday-hack-ch…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Protect desktop, documents, and pictures folders with unique keys per user account, ensuring files are only readable during active sessions—even on shared or multi-user devices. Check out Windows 11, version 24H2's personal data encryption. #Windows1124H2 youtu.be/lgCt1Z2Da_E
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
In an effort to interrupt international money laundering and cybercrime operations, indictments were unsealed against two cybercriminals.
Sergey Sergeevich Ivanov allegedly operated multiple international payment services to aid cybercriminals.
secretservice.gov/sites/defa…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Phd student Yanyu Chen interviewed Cambodian money launderers who help move money for pig butchering scams
"Like another similar enterprise I had previously visited, their premises was in a dozen hotel rooms above a casino in Sihanoukville that were rented monthly. The managers had replaced the beds with desks and now the business was up and running."
globalchinapulse.net/moving-…
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Did you know the PCI 90 days password reset requirement does not apply if the users are doing MFA?
Even better, enforce passwordless with conditional access and authentication strength to protect the Cardholder data environment (CDE) and make the 'Not applicable for Entra ID'!
Folks it's 2024 and the new NIST draft for digital identity is asking you to STOP the madness of 30/90 days password resets and moving it from a
recommendation → to a REQUIREMENT
Microsoft admins here's what you need to do:
→ Turn on risk based conditional access policy
→ Stop periodic password resets
= Reduced help desk calls + happy users
It's a win, win.
If you are not licensed for Entra ID P2 then you can still use the logs and trigger a workflow to get your users to change their password.
Thanks to @blackroomsec for the call out.
Tor Vigesdal | @dotBATman@infosec.exchange retweeted
Folks it's 2024 and the new NIST draft for digital identity is asking you to STOP the madness of 30/90 days password resets and moving it from a
recommendation → to a REQUIREMENT
Microsoft admins here's what you need to do:
→ Turn on risk based conditional access policy
→ Stop periodic password resets
= Reduced help desk calls + happy users
It's a win, win.
If you are not licensed for Entra ID P2 then you can still use the logs and trigger a workflow to get your users to change their password.
Thanks to @blackroomsec for the call out.
