Blumira Sponsor #3 - Emily Eubanks, more actionable events, incident response help, and more

<p>In this sponsored BDS episode, Bryan Brake and Amanda Berlin interview Emily Eubanks, a Security Operations Analyst for #Blumira. We discuss common business risks like IT staff turnover, a lack of Incident Response procedures, choosing not to follow PowerShell best practices, and MFA use for critical or sensitive applications. We also discuss ways to improve security posture to mitigate these risks as well as how Blumira can help organizations in light of these common business challenges.</p> <p><br /> ADDITIONAL RESOURCES</p> <p> </p> <p><br /> OUR REDDIT AMA</p> <p> https://www.reddit.com/r/cybersecurity/comments/qao73j/we_are_a_security_team_with_20_years_of_ethical/ </p> <p> </p> <p><br /> MFA</p> <p>https://attack.mitre.org/mitigations/M1032/ </p> <p> https://techcommunity.microsoft.com/t5/azure-active-directory-identity/your-pa-word-doesn-t-matter/ba-p/731984 </p> <p> https://www.yubico.com/blog/otp-vs-u2f-strong-to-stronger/ </p> <p> </p> <p><br /> INCIDENT RESPONSE</p> <p>https://www.nist.gov/cyberframework/respond </p> <p> https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf </p> <p> </p> <p><br /> POWERSHELL BEST PRACTICES</p> <p> https://www.blumira.com/analysis-of-a-threat-powershell-malicious-activity/ </p> <p> https://docs.microsoft.com/en-us/mem/configmgr/apps/deploy-use/learn-script-security </p> <p> https://devblogs.microsoft.com/powershell/secrets-management-module-vault-extensions/ </p> <p> https://www.reddit.com/r/PowerShell/comments/g3b9h5/how_are_you_managing_secrets/ </p> <p> </p> <p><br /> RISK: A lack of MFA where available or using SMS based MFA for critical applications.<br /> Please do not use SMS based MFA for critical applications. [6] [7]<br /> This is an easy layer of defense that has historically been very effective [5]<br /> One-Time Passwords (OTP) good but [8] FIDO U2F better<br /> Consider hardware tokens (e.g. Yubico YubiKey, Google Titan Security Key).<br /> MITIGATION: <br /> Blumira requires use of MFA<br /> MFA related detections (e.g. AWS, Duo)<b