The more privileges a user or an app gets, the greater the potential for abuse or error. Implementing privileged access management (PAM) provides several benefits, including a smaller attack surface, which is easier to protect against internal and external threats.
In simple terms, one of the most direct ways to implement Privileged Access Management is by removing local administrator rights from users on their computers. This is important because attackers often try to take control of a user’s computer and install malicious software. Without admin rights, users can’t install software on their own—so any installation must go through an approval process.
By using PAM and limiting admin rights, organizations reduce the risk of unauthorized or harmful software being installed.
Benefits of Privileged Access Management (PAM)
Here are just some of the reasons why all organizations need privileged access management.
Reduce malware infection likelihood
Many types of malware (e.g. SQL injections) rely on elevated privileges to install or execute. Therefore, removing excessive privileges or just implementing the least privilege policies across the company can successfully prevent malware.
Help achieve compliance
By reducing the privileged activities a user can perform, PAM helps create a less complex, more secure, and compliant environment.
Help achieve cyber insurance requirements
Ransomware attacks and ransom payouts have increased exponentially. Cyber insurers recommend organizations to increase PAM controls in order to reduce risks and liability.
Cyber insurers often require PAM controls to renew or obtain new cyber liability coverage: a PAM system to manage privileged access and accounts, removal of local admin rights, etc.
Also, many compliance regulations, such as HIPAA or PCI, require organizations to apply the least privilege access policies for data and systems security.
Privileged Access Management Best Practices
The more comprehensive your IT security policies, the better you will be able to prevent or mitigate insider and external threats while meeting compliance standards.
Here is an overview of the most important privileged access management best practices:
- Create and enforce a complex privileged access management policy
The policy should clearly indicate how privileged access and accounts are commissioned and decommissioned, the hierarchy of privileged users and accounts, etc.
This means that your IT security team should get all privileged accounts and credentials under management: application accounts, database accounts, local accounts, cloud accounts, SSH keys and passwords, including those used by third parties.
Your IT security team will look across operating systems, hardware devices, firewalls, routers, etc.
The PAM policy should emphasize where and how privileged passwords are being used and help reveal security vulnerabilities like old passwords/accounts, reused SSH keys, and so on.
- Apply rules-based permissions
Rules-based permissions should be enforced to elevate privileges as needed to perform specific actions and should be revoked after completion. If access is not provided but required, the user can submit a special request for approval.
The least privilege approach is not just about limiting access but also about the duration of access.
- Enforce separation of duties
Privilege separation measures include separating administrative account capabilities from standard account capabilities.
When the least privilege approach is in place, you should consider separation of duties. Each privileged account should be able to perform only a distinct set of tasks.
- Monitor and audit access privileges frequently
Implementing privileged session management and monitoring (PSM) is essential for detecting suspicious activities and efficiently investigating risky privileged sessions.
Privileged session monitoring and management capabilities are required for achieving regulatory compliance (e.g., HIPAA, PCI, SOX).
- Network and system segmentation
Segment systems and networks to distinguish between users and processes based on levels of trust and needs. Higher trust levels should be at the center of your security policy.
- Implement context-based access
This is basically the zero-trust principle which involves delivering just enough access, in time, and in the proper context. This is handled by assessing multiple inputs in real-time: vulnerability/threat data for a target asset, geolocation, user data, and several others to determine how much and for how long a privilege can be provisioned.
Enabling dynamic risk-based access will allow you to automatically limit privileges and prevent any unsafe activities every time a known threat or potential compromise exists for a user, asset, or system.
- Secure privileged task automation (PTA) workflows
Privileged task automation, such as robotic process automation (RPA) that leverage privileged credentials and elevated access are increasingly embedded within modern IT environments and require many moving parts that need to be audited for privileged access.
- Monitor user behavior
Establish standard behavior for privileged user behavioral activity (PUBA) and privileged access. Monitor and alert in case of any deviations from the standard.
Conclusion
Limiting privileges for people, processes, and applications ultimately means the pathways and entrances for exploitation will be reduced.
Accumulating as much data as possible is not the answer. Most important is to have the needed data that enables you to make prompt, informed decisions while keeping all your systems safe and secure.
StratusPointIT ranks #56 on the 2025 CRN Fast Growth 150 list
/0 Comments/in News /by MihaiWhaling Attacks: Overview
/in IT Security, Tech Tips /by MihaiSimply put, whaling is a sort of phishing attack that targets high-profile employees, such as managers, directors, C-suite positions, etc.
The term “whaling” reflects the target of the attack, the “whale”, basically individuals who hold significant authority and high-level access to sensitive information.
Unlike traditional phishing attacks that target the average person, whaling is a sophisticated, highly targeted attack that uses detailed information to persuade the victim.
NOTE! If the target organization does not have the appropriate email security, hackers can utilize email spoofing to make their emails appear to come from a trusted source, someone within the organization, making the cyberattack harder to detect.
How It Works
Executives are attractive targets for hackers because they have access to financial resources and valuable data, so by compromising an executive’s email account, cybercriminals can perform fraudulent transactions, steal confidential data, etc.
Whaling attacks are carefully planned and executed. The process is usually structured in 3 steps.
The Research Phase
In this phase, hackers will gather information about the targets, details about their responsibilities, professional relationships, and access level. They will extract relevant information from social media, company websites, and other publicly available data.
Crafting the Attack
Cybercriminals will craft highly personalized and convincing emails. These emails often impersonate business partners or other employees and usually include urgent requests.
The Execution Phase
Once the hacker has crafted the harmful email, it is sent to the target. If the target falls for it, the damage can be huge because the victim may authorize fraudulent transactions, share sensitive information, or download malicious attachments.
Impact on Organizations
Whaling attacks can cause severe consequences for organizations.
Reputation Damage: A data breach can damage customer trust and brand reputation.
Regulatory Fines: If a whaling attack leads to the compromise of sensitive data, organizations may face regulatory fines, possible lawsuits, etc.
Financial Loss: Whaling attacks can cause financial losses due to illegitimate transactions or data theft.
Tactics and Techniques
Common tactics include:
Impersonation: The hacker pretends to be a trusted person.
Urgency: Hackers will create a sense of urgency to determine immediate action without rigorous verification.
Whaling attackers will also use several hacking techniques to deceive their targets.
Social Engineering: A hacker will always try to manipulate the target. They will often pretend to be a trusted colleague or business partner to eventually trick the target.
Email Spoofing: This is a very common technique that cybercriminals use to change the sender’s email address to look like a legitimate email address.
Malicious Links and Attachments: Whaling emails may contain malicious attachments or links that, when opened, install malware on the target’s device or may lead to phishing websites designed to steal confidential information.
Identity theft: Sometimes hackers manage to take over email accounts and use them to perform whaling cyberattacks.
Prevention Methods & Best Practices
Organizations can implement efficient measures to protect their assets against whaling attacks.
Cybersecurity Awareness: regular IT security training programs will teach all employees how to recognize and protect themselves against such threats.
Verification Protocols: adding extra layers of verification for sensitive requests, such as financial transactions or data sharing, can prevent dangerous actions. For instance, requiring verbal confirmation for payments above a certain threshold.
Detection and Response: efficient detection and response systems to mitigate the impact of such attacks.
Incident Response Plan: an updated incident response plan will enable organizations to effectively respond to a successful whaling attack, mitigating any damage and reducing recovery time.
Email Filtering/Phishing and Spam Protection: Advanced email filtering systems can identify and block fraudulent emails before they reach your inbox folder.
Monitoring for Unusual Activities: monitoring for suspicious activity, such as unsolicited transactions or data transfer requests, can help detect potential whaling attacks before it’s too late.
Emerging Trends
Targeting new platforms
Hackers are expanding their reach beyond email to target executives on platforms like Slack, Microsoft Teams, etc.
Use of AI
Cybercriminals are increasingly using artificial intelligence to create more persuasive emails, making it even harder for targets to separate fraudulent attempts from legitimate communications.
In Closing
Whaling attacks have a higher level of complexity compared to other types of phishing attacks.
Among others, AI-driven security solutions, a well-crafted incident response plan, regular cybersecurity training, and continuously updating your security protocols will keep your organization safe over the long run.
Credential Stuffing: Overview
/in IT Security, Tech Tips /by MihaiCredential stuffing is a very common type of cyberattack where cybercriminals use lists of stolen credentials, usually obtained from previous data breaches, attempting to access different accounts/websites. Once logged in, hackers will take over the account.
How Credential Stuffing Works
Firstly, hackers gather lists of usernames and passwords stolen in data breaches or buy them from obscure sites on the dark web. Stolen password lists can include millions of compromised credentials and are often available to bad actors for a relatively small sum.
Secondly, cybercriminals often use bots to login to many websites at once. Nowadays, they utilize AI bots which are new hacking tools that are very good at imitating real user behavior.
NOTE! Such smart tools add random delays and mouse movements to successfully avoid security systems.
Hackers use specific tools to quickly change network addresses because fake locations help mask the real source of the attack effectively.
Attackers will always look for weak spots in how websites handle the login process. Issues with password reset give hackers more options and ways to break in. Unfortunately, a poor setup is usually the main cause of a successful cyberattack.
Major Consequences
When hackers use credential stuffing to access and control your users’ business accounts, they can quickly damage your finances, your brand, and eventually reduce the level of trust customers have in your organization.
Let’s take a deep look at how this type of attack can affect your organization.
Credential stuffing attacks allow hackers to make illegal transactions on behalf of legitimate users. The burden of supporting affected customers, investigating incidents, and taking steps to prevent future breaches is never easy.
If a credential stuffing attack exposes customer information or causes financial harm, customers will probably lose faith in the organization and will stop collaborating with a company that suffered a data breach that exposed any sensitive information.
Regulators fine organizations that fail to prevent credential stuffing. For instance, Geico, one of the largest auto insurers in the country, was fined $9.75 million in 2024 when a credential stuffing attack allowed unauthorized access to sensitive customer data.
Prevention Methods
Stopping cyberattacks of this sort before they happen requires strategic planning, proactive measures, and the right tools to block hackers. Combining multiple layers of defense is more cost-effective than addressing weaknesses after an attack.
Here are several ways you can use to combat credential-stuffing attacks.
Advanced multi-factor authentication (MFA)
Adding a second login step, like a code sent to the user’s phone, can block unauthorized access even when the hacker has obtained the password.
User behavior assessment
Behavior assessment software can further enhance protection by analyzing user behavior and interaction patterns. Such software can identify fake logins even if the right password was used.
Zero-trust architecture
Test and implement security systems that require users to prove their identity with every login attempt. Also, only users with the appropriate rights should be able to access sensitive files or applications.
Adaptive rate limiter
A software solution that detects rapid login attempts, usually performed by bot networks, is a game changer.
Limiting the number of logins will allow security teams to investigate and protect your organization against credential stuffing attacks. Also, it doesn’t interfere with real users.
Advanced bot detection
Deploy machine learning solutions that enable your team to differentiate between user logins and automated activity patterns.
Passwordless authentication protocols
Implement passwordless authentication methods that use cryptographic keys or biometric access systems. Such systems eliminate the risks associated with traditional passwords, making stolen credentials useless.
Credential update
Ensure login credentials are regularly updated by using automated systems that force resets when potential malicious attempts are detected, reducing the risk of data breaches.
Deception technology
Set up decoy systems to divert cybercriminals from your assets. These systems will help your security team improve your security protocols by gathering valuable data on emerging hacking techniques.
Penetration testing
Carrying out regular penetration testing is paramount as you can use the findings to strengthen your security measures.
Threat intelligence
Staying updated on emerging exploits ensures your cybersecurity remains effective in the face of new threats.
Final Thoughts
Cybercriminals launch credential stuffing attacks from different countries sometimes simultaneously. Spreading attacks across the globe makes it harder to prevent or mitigate.
For a professional approach against this popular type of cyberattack, please reach out to StratusPointIT. Keeping your enterprise, your people, and your data safe is our commitment.
The Zero Trust Security Framework
/in IT Security, Tech Tips /by MihaiAs organizations continue to embrace flexible/remote work, a comprehensive approach to IT security is more than necessary, it is crucial.
The Zero Trust security works on a basic principle: never trust, always verify. So, regardless of the user, device, or application, Zero Trust security ensures every access request is carefully verified.
Zero Trust & Data Protection
The implicit trust approach is risky as the modern workforce is becoming increasingly mobile. Zero trust, in contrast to the traditional approach, constantly checks each access request to make sure that only users with the appropriate rights may access sensitive files or applications. This approach makes granular access restrictions and data-centric security imperative.
Therefore, all-access requests should be considered harmful, regardless of whether they are for files, apps, or services.
Key Benefits of Zero Trust Architecture
A Zero Trust architecture reduces considerably the attack surface and protects against a wide array of cyberattacks.
It provides secure application access based on account permissions for staff members and third-party users.
Access related decisions are based on pre-established rules that verify behavioral characteristics, device health, user identification, and real-time risk assessments.
Cybersecurity teams need to adapt the access strategy and technologies to ensure the business is secure, while enabling fast and simple access for all users, including third-party users.
It helps ensure compliance, trust, and prevents cyberattacks.
The IT security teams need to make sure that access is only allowed under very specific circumstances, users and devices will be regularly checked every time they try to connect to a network, application, or service.
Zero Trust security can improve your company’s security posture while reducing the risk of phishing, malware, ransomware, DNS attacks, etc.
It reduces complexity and saves resources.
Traditional technology deployment can take weeks (several hardware and software components) using valuable resources. A Zero Trust security model can reduce architectural complexity.
A Successful Zero Trust Setup
Set Your Priorities
Protecting business sensitive data is the primary objective of the setup. To achieve this, begin by assigning sensitivity ratings based on risk levels. This is the foundation of your entire zero trust setup.
Determine Users & Access Needs
Strict access and identity management are required in a Zero Trust approach. Organizations must implement least privilege access across all accounts and only provide access based on user-task combinations.
Create The Security Architecture
Create a security architecture to efficiently reduce risks. Implement zero trust data protection measures based on your infrastructure’s complexity, allocated budget, and IT resources. Apply industry best practices and regulatory needs.
Examine Access to Data
Find out how systems and users interact. Only authorized connections should be able to access certain databases and applications.
Track access trends using data-centric security techniques. Potential attacks may be indicated by suspicious activities, for instance, illegal data extraction.
Additionally, AI-driven analytics should be used for threat identification and mitigation.
Automate Procedures for Improved Security
Automate security. To protect data while it is in transit and at rest you should consider using encryption, Multi-Factor Authentication (MFA), and Identity and Access Management (IAM) to validate user identity.
Automated monitoring ensures ongoing threat detection and compliance.
Establish Success Metrics
Create key performance indicators (KPIs) to accurately measure the success of your Zero Trust data security plan. Increasing MFA usage, decreasing disproportionate access rights, and securing executive support are a few examples of possible measurements.
Zero Trust process in a helpdesk (especially via a Managed IT service Provider – MSP)
How does the helpdesk of an MSP know if it’s you calling and not an imposter? Make sure your MSP uses a “Zero-Trust Policy” when it comes to verifying the user for specific requests. For example, when a request comes in for a password reset, account creation, or for added permissions, your MSP should verify the user by sending a verification code via text/SMS or via an authenticator app (Microsoft Authenticator or Duo).
Conclusion
With the Zero Trust security approach, organizations can successfully impose least privilege access, identity verification, and ongoing monitoring.
Your IT security strategy should cover all systems, applications, and datasets as each is a resource in need of cybersecurity policies. Make sure to plan and partner with the right team for professional implementation.
Privileged Access Management: Best Practices
/in IT Security, Tech Tips /by MihaiThe more privileges a user or an app gets, the greater the potential for abuse or error. Implementing privileged access management (PAM) provides several benefits, including a smaller attack surface, which is easier to protect against internal and external threats.
In simple terms, one of the most direct ways to implement Privileged Access Management is by removing local administrator rights from users on their computers. This is important because attackers often try to take control of a user’s computer and install malicious software. Without admin rights, users can’t install software on their own—so any installation must go through an approval process.
By using PAM and limiting admin rights, organizations reduce the risk of unauthorized or harmful software being installed.
Benefits of Privileged Access Management (PAM)
Here are just some of the reasons why all organizations need privileged access management.
Reduce malware infection likelihood
Many types of malware (e.g. SQL injections) rely on elevated privileges to install or execute. Therefore, removing excessive privileges or just implementing the least privilege policies across the company can successfully prevent malware.
Help achieve compliance
By reducing the privileged activities a user can perform, PAM helps create a less complex, more secure, and compliant environment.
Help achieve cyber insurance requirements
Ransomware attacks and ransom payouts have increased exponentially. Cyber insurers recommend organizations to increase PAM controls in order to reduce risks and liability.
Cyber insurers often require PAM controls to renew or obtain new cyber liability coverage: a PAM system to manage privileged access and accounts, removal of local admin rights, etc.
Also, many compliance regulations, such as HIPAA or PCI, require organizations to apply the least privilege access policies for data and systems security.
Privileged Access Management Best Practices
The more comprehensive your IT security policies, the better you will be able to prevent or mitigate insider and external threats while meeting compliance standards.
Here is an overview of the most important privileged access management best practices:
The policy should clearly indicate how privileged access and accounts are commissioned and decommissioned, the hierarchy of privileged users and accounts, etc.
This means that your IT security team should get all privileged accounts and credentials under management: application accounts, database accounts, local accounts, cloud accounts, SSH keys and passwords, including those used by third parties.
Your IT security team will look across operating systems, hardware devices, firewalls, routers, etc.
The PAM policy should emphasize where and how privileged passwords are being used and help reveal security vulnerabilities like old passwords/accounts, reused SSH keys, and so on.
Rules-based permissions should be enforced to elevate privileges as needed to perform specific actions and should be revoked after completion. If access is not provided but required, the user can submit a special request for approval.
The least privilege approach is not just about limiting access but also about the duration of access.
Privilege separation measures include separating administrative account capabilities from standard account capabilities.
When the least privilege approach is in place, you should consider separation of duties. Each privileged account should be able to perform only a distinct set of tasks.
Implementing privileged session management and monitoring (PSM) is essential for detecting suspicious activities and efficiently investigating risky privileged sessions.
Privileged session monitoring and management capabilities are required for achieving regulatory compliance (e.g., HIPAA, PCI, SOX).
Segment systems and networks to distinguish between users and processes based on levels of trust and needs. Higher trust levels should be at the center of your security policy.
This is basically the zero-trust principle which involves delivering just enough access, in time, and in the proper context. This is handled by assessing multiple inputs in real-time: vulnerability/threat data for a target asset, geolocation, user data, and several others to determine how much and for how long a privilege can be provisioned.
Enabling dynamic risk-based access will allow you to automatically limit privileges and prevent any unsafe activities every time a known threat or potential compromise exists for a user, asset, or system.
Privileged task automation, such as robotic process automation (RPA) that leverage privileged credentials and elevated access are increasingly embedded within modern IT environments and require many moving parts that need to be audited for privileged access.
Establish standard behavior for privileged user behavioral activity (PUBA) and privileged access. Monitor and alert in case of any deviations from the standard.
Conclusion
Limiting privileges for people, processes, and applications ultimately means the pathways and entrances for exploitation will be reduced.
Accumulating as much data as possible is not the answer. Most important is to have the needed data that enables you to make prompt, informed decisions while keeping all your systems safe and secure.
Security Misconfiguration: Overview
/in IT Security /by MihaiWith the move to the cloud and reliance on third-party solutions, one important vulnerability often occurs: security misconfiguration.
The impact of security misconfigurations can be disastrous, but with proper precautions and cybersecurity, they can be prevented.
Security misconfiguration represents any error or vulnerability in the setup of any system organizations rely on. There are many types of security misconfigurations, but they all expose your company to the same danger: illegitimate access to sensitive data or services.
How Do Security Misconfigurations Occur?
Security misconfiguration occurs when security related settings are put in place poorly or not implemented at all. For instance, cloud misconfiguration and identity service misconfiguration will always cause security vulnerabilities.
Such misconfigurations can lead to a data breach and depending on the value of the compromised data, it can have a significant impact on your organization.
Types of Security Misconfiguration
Any application or code that should include security measures is susceptible to security misconfiguration. Here are just a few examples.
Causes of Security Misconfiguration
Security misconfiguration can occur in many ways. Some of the common causes include:
The Impact of Security Misconfiguration
Security misconfiguration can expose a business to high risks, such as unauthorized access to systems, services, or data, causing significant and often permanent loss for an organization. The risks of security misconfiguration vary depending on the data that is exposed.
When sensitive data is leaked or stolen, the result often involves regulatory fines for failing to meet required security measures, losing customers, damaged reputation, etc.
Exploitable vulnerabilities and any business-critical information gained by a hacker can put your organization at further risk. That is why preventing security misconfiguration is crucial.
According to Wiz, about 20% of all organizations have at least one misconfigured application that can be exploited.
Prevention & Diagnosis
Preventing security misconfiguration requires implementing necessary security protocols, complex access controls, typically with an identity and access management (IAM) framework.
Diagnosing security misconfigurations quickly is key. Also, finding security misconfigurations is just as important as preventing them.
Along with scanning, security testing can provide valuable insights into vulnerabilities. The testing stage is where security misconfigurations discovered can be successfully diagnosed and the risk is 100% preventable.
Some other ways to prevent security misconfigurations:
Conclusion
Security misconfiguration vulnerabilities leave organizations exposed to potential attacks which can cause a company to lose money, customers, and reputation. Therefore, finding and fixing such misconfigurations should be one of your top priorities.
For a professional cybersecurity approach, don’t hesitate to reach out to StratusPointIT.
Windows 10: End of Support
/in IT Security, IT support /by MihaiMicrosoft have recently stated that support for Windows 10 will end on October 14, 2025. If you are still using Windows 10 after this date, your services will not stop, but Microsoft will no longer provide Windows 10 updates and free security patches.
Note: Version 22H2 will be the last version of Microsoft Windows 10.
Support & Security
We always recommend businesses implement the latest security updates and security fixes. This is because outdated software and systems, especially those not receiving support, add to the list of security risks to your organization.
From October 14th the user:
As of March 2025, 54.2% of users are still using Windows 10, and 42.6% currently use Windows 11 – StatCounter worldwide data.
Windows 11 Features
Windows 11 benefits from complex end-to-end security features such as internet protections, antivirus, firewall, secure authentication, etc.
Advanced security features and free updates will help your organization safeguard against emerging cyber threats.
Windows 11 maintains a familiar user experience from Windows 10 and a similar layout while introducing a more modern design and improved functionality. Central elements like the Start menu and taskbar have been updated for a cleaner look, but the overall navigation remains intuitive and user friendly.
It brings in several innovative improvements for usability and efficiency. For instance, the updated Settings application now features a persistent left menu that makes it easier to navigate from general to specific settings.
Many applications have been updated, adding new functionalities, such as Focus Sessions, which allows the user to apply certain limits in order to zero in on getting tasks done.
The Photos app can not only organize and edit photos, but it can also handle video editing, enabling the user to make transitions and add different effects. It includes innovative features like face recognition, allows the user to enable location-based features, generate albums, etc.
Also, the central collaboration app, Microsoft Teams, has been improved. Chat from Teams is now integrated into the Windows taskbar, so the user can easily connect with other Teams users, even from outside your organization, regardless of the operating system they use (Android, iOS, or Windows). If the other person does not have the Teams app, this feature will allow you to chat via Short Message Service (SMS).
In case you install Windows 11 on a tablet with no keyboard, you need to know that the touch experience has been improved with bigger touch targets, more space between icons, and the ability to resize and move windows swiftly.
Besides, if you prefer voice over text or voice typing, Windows 11 comes with voice commands.
Upgrade to Windows 11
Microsoft has implemented a secure migration process to Windows 11 which begins with checking whether your current Windows 10 computer can upgrade to Windows 11 or if a new computer is necessary.
Note: Your computer must be running Windows 10 – version 2004 or a more recent version to be able to upgrade.
Firstly, check to see if your Windows 10 device is eligible to upgrade for free to Windows 11 by selecting the Start button and going to Settings > Update & Security > Windows Update.
To benefit from the level of security, features, and functionalities that Windows 11 provides, some users may need new computers. Learn more about Windows 11 system requirements.
If your current Windows 10 device is compatible, you should upgrade it. However, if your hardware falls short, upgrading might cause your device to lag, so make sure you have the necessary hardware resources for the upgrade.
Identity & Access Management (Entra ID)
/in IT Security /by MihaiMicrosoft Entra ID is a cloud-based identity and access management service for applications like Office365 and Azure.
Entra ID Security Defaults
Security defaults are a group of settings that help protect your organization from emerging threats and cyberattacks like brute force attacks, password spraying, phishing, etc.
Security defaults include the following requirements:
NOTE! Security defaults are free, while Conditional Access requires Entra ID Premium licensing (P1 or P2). Also, Conditional Access policies are fully customizable, security defaults are not.
Conditional Access Policies
Conditional Access policies have the potential to prevent any unauthorized access to sensitive data, considerably improving your security framework.
Administrators can control who has access to applications and resources based on certain conditions/criteria: user identity, device, location, and more.
For instance, let’s say you oversee identity and access management at a company that has 70 employees in the following departments:
Also, the organization outsources the following services: Marketing, IT and Cloud consulting.
Employees should only have access to services and files relevant to their work (the principle of least privilege) while each department should be able to operate remotely.
This is how organizations usually operate today. Employees now work remotely, sometimes across different continents, in different roles and levels of access rights and privileges.
If your administrator logs in from overseas, his authentication process must be tighter than it would be in the office. Therefore, authentication security must be strict.
To give employees flexibility while addressing the diverse security requirements, a Conditional Access strategy is paramount. With it you can apply security measures to specific roles, locations, and applications for a robust and adaptable security posture.
Users, Target Resources & Conditions
The Users
Configure who is affected by the policy. You can include/exclude a group of users (e.g. Marketing department members), specific roles, and more.
Target Resources
User actions – Administrators can define policies based on user action. For instance, the user tries to register security information (MFA, password, etc.) or connect a new device to the tenant.
Cloud applications – Administrators can assign security controls to specific applications.
Authentication context – Administrators can configure authentication contexts which will be used to further secure data and actions in applications.
Conditions
Sign-in risk: This security feature enables administrators to control user access based on the likelihood of a fraudulent sign-in attempt.
User risk: It allows administrators who have access to Entra ID Protection to label users as risky if their activity is suspicious.
Location: You can approve or deny sign-ins based on the geographic location of the user.
Device platforms: Approve or deny access based on the operating system of the device used for login.
Client apps: You can approve/deny an authentication request based on the client application utilized for login. Unfortunately, legacy authentication apps can expose the user to identity frauds, brute-force attacks, etc.
Device filters: Approve or deny access based on the user’s device.
Conditional Access: Benefits
You can use Conditional Access controls to improve security and achieve compliance goals.
Location-based access: You can create trusted and untrusted zones, and you can apply access conditions. For example, you can enable multi-factor authentication for users logging in from home but skip the rule for all users who login from the headquarters.
Blocking unauthorized access: Allow access only to passwordless authentication methods to minimize the risk of compromised user accounts.
Identity and application granularity: You can create application/entity-specific policies to allow access in case of an emergency, under specific conditions.
Session controls: You may consider creating reauthentication policies for different roles within the organization. For instance, non-privileged users may be required to reauthenticate more often.
Compliance-based access: Allow/block access based on device compliance. This way you ensure that user devices meet minimum configuration requirements. For example, if a device used for authentication is marked as compliant in Entra ID, your controls can be less restrictive.
Final Thoughts
With proper Entra ID security controls, emergent cyberattacks are now preventable. On the other hand, Entra ID misconfigurations can impact your environment, so make sure to plan and partner with the right team for professional implementation.
File Share Phishing: Overview
/in IT Security, Tech Tips /by MihaiCybercriminals’ favorite way to break into a company right now is by sharing a document that leads to a fake Microsoft login page. The link could direct you to SharePoint, OneDrive, Dropbox, or another site, but the goal is always the same – they want access to your email account. Because this attack has become so common, we’d like to share some advice with you.
When you first receive a shared file, your initial thought might be, “Is this for me?” You may even respond to the email and ask the sender that very question. Unfortunately, it’s easy for cybercriminals to reply with a generic “yes.”
Moving forward into 2025, a better question to ask is, “What’s this for?”
First, ask yourself this question before clicking any links in your email. If the link is part of an active conversation, that’s great – you should be safe.
If you can think of a valid reason why someone sent you the link, then you can ask the sender, “What’s this for?” If you receive a vague response, that’s a red flag, it’s likely an attacker, not a legitimate contact.
If you have no idea why someone sent you a link, do not click on it. You can still ask the sender for clarification, but only proceed if they provide a clear, specific explanation.
The following examples may look like harmless file sharing emails, but all three of these deceptive messages led to phishing websites that were waiting to steal the user’s login information.
Remember: Always verify that the shared file is part of an active conversation before clicking on it.
The Cross-site Scripting (XSS)
/in IT Security /by MihaiCross-site scripting, also known as XSS, is a web security vulnerability that enables hackers to manipulate user interactions with compromised applications. Through cross-site scripting, the perpetrator can impersonate a user, execute any actions the user is able to, also can access and manipulate their data. If the user has privileges within the application, the perpetrator may gain complete control over all functionalities and data associated with that application.
Briefly, cross-site scripting involves manipulating a website to run malicious scripts. When the code executes within the victim’s browser, the attacker can fully compromise the interaction with the application.
Types of XSS Attacks
There are three main types of XSS attacks.
Reflected XSS occurs when an application receives data in an HTTP request and includes that data within its response in an unsecure way.
Here is a simple example of a reflected XSS vulnerability:
https://website.com/status?message=Everything+is+fine.
<p>Status: Everything is fine.</p>
Instead, a hacker can easily perform an attack like this:
https://website.com/status?message=<script>/*+malicious+code+here…+*/</script>
<p>Status: <script>/*malicious code here*/</script></p>
If the user visits the URL generated by the attacker, then the perpetrator’s script executes in the user’s browser. At that point, the script can carry out any action and retrieve any data to which the user has access.
Stored XSS occurs when a vulnerable application receives data from a malicious source and includes that data within its subsequent HTTP responses. This data might be submitted via HTTP requests. For example, comments on a forum/blog post, usernames in a chat room, etc.
An example of a stored XSS attack is an application for exchanging text messages which allows users to submit any messages which are publicly displayed to other users, such as:
<p>Hello, this is my text.</p>
The application won’t perform any other verification over the submitted message, so the hacker can easily send a malicious message:
<p><script>/*malicious code here*/</script></p>
DOM-based XSS occurs when an application contains some client-side JavaScript that unsafely processes data from an untrusted source.
If the perpetrator controls the value of the input field, they can easily construct a malicious value to eventually execute their own script.
What can XSS be used for?
A hacker who exploits a cross-site scripting vulnerability is able to:
The impact of an XSS attack will depend on the functionality of the targeted application, the captured data, and the access-level of the compromised user.
So, in the case of a simple application where all users are anonymous and all information is displayed publicly, the consequences will be minimal. On the other hand, an application holding sensitive data, such as banking transactions or healthcare records will be massively impacted.
Also, if the compromised user has elevated privileges within the application, then the impact will be serious, allowing the hacker to take full control of the application getting access to users and data.
Test For Such Vulnerabilities
Testing for reflected and stored XSS involves submitting simple unique input – a short alphanumeric string into every entry point in the application and identifying where the submitted input is returned in HTTP responses. Next, test each location to find out if an input can be used to execute malicious scripts.
Manually testing for DOM-based XSS can be done by placing an unique input in the parameter, then using the browser’s developer tools to search the DOM for this input and testing it to determine whether it is exploitable. Other types of DOM XSS are harder to detect, but achievable with the right support team.
Prevention Methods
Preventing XSS vulnerabilities will involve a combination of the following measures.
In case user-controllable data is output in HTTP responses, encode the output to prevent it from being interpreted as script.
Also, when the user input is received, filter as strictly as possible based on what data you expect to receive.
Make sure to utilize appropriate response headers. To prevent cross-site scripting in HTTP responses that aren’t intended to contain any HTML or JavaScript, you can use the Content-Type and X-Content-Type-Options headers to ensure that browsers interpret the responses the way you intend.
Finally, one of the most effective measures for safeguarding the client side of your business is to implement a content security policy (CSP). This security measure can be easily integrated into any website, providing an additional layer of protection.