JadePuffer in Azure: who can delete what recovery depends on?
A copy helps only when the business can preserve and use it. Connect the power to delete resources with the access required to recover a service.
Blog
Praktyczne poradniki o pentestach, badaniu podatności i narzędziach bezpieczeństwa opartych na AI.
Artykuły są publikowane po angielsku i portugalsku.
Badania
124 wpisy
FortiBleed: who can recover administrative control of a firewall?
The device controlling entry also needs a recovery plan. Review who can act when the usual administration path stops working.
The Mabna case: following academic accounts into digital libraries
An academic account can reach services administered by different organizations. Assessment needs to follow that path and identify where each permission ends.
Research partnerships: connect funding decisions with access
A contract may identify who funds a project without showing who can access its results. Follow funding, deliverables and permissions throughout the partnership.
Warlock and SharePoint: who can distribute changes across the network?
Securing the entry server and controlling a distributed change are complementary tasks. Follow who authorizes each stage and who confirms its outcome.
After an invoicing incident: who can change where a payment goes?
Knowing an invoice does not establish authority to change its receiving account. Review how a request is confirmed, approved and executed.
The key changed hands. What about the company car’s digital access?
Returning a physical key may leave accounts and histories associated with the vehicle. Define who may view information and how to verify that an association has ended.
The AI invitation looks credible. Who approved the next access request?
A convincing conversation can lead to a login request outside an approved workflow. Test the transition from accepting an invitation to granting access.
The CVE queue grew. Where does your remediation clock start?
Counting installed patches does not show where a decision stalled. Connect each relevant advisory to an asset, an owner and a verified outcome.