Risky Business #741 -- The Mintlify breach and modern supply chains
Mar 19, 2024
auto_awesome
This week's show covers AI code review flaws, Mintlify's Github token loss, UDP loop DoS attack resurgence, challenges in recon satellites, Microsoft restricting Russia's PowerShell, LockBit cyberattack aftermath, SpaceX's spy satellite network, and Russians losing access to Microsoft cloud services.
Businesses face challenges in securing cloud productivity tools like Office 365 and Google Workspace, highlighting the need for improved security measures.
Material Security offers post-compromise security solutions, detecting chain of entry and preventing access to sensitive data even after a breach.
Consolidated security operations after a breach are crucial, focusing on making it difficult for attackers to exploit compromised accounts and ensuring layered protection.
Deep dives
Challenges with Cloud Productivity Tools and Risk Management
Many security professionals feel that the security risks associated with cloud productivity tools like Office 365 and Google Workspace were not adequately addressed. Businesses moved to SaaS solutions to increase innovation and operational efficiency, but security measures lag behind. Configuring security options correctly becomes a complex and ongoing task, especially with the evolving threat landscape.
Material Security's Approach to Post-Compromise Security
Material Security focuses on the assumption that breaches will occur and aims to provide solutions for post-compromise security. Their platform enables organizations to detect chain of entry, combine prevention, detection, and data protection functions in one tool, and centralize telemetry data for better security posture assessment.
Addressing Lateral Movement and OAuth App Risks
Material Security is focused on making it useless for attackers to install OAuth apps after a breach. By centralizing telemetry data, identifying suspicious activities, and applying layers of protection, the platform aims to prevent attackers from accessing sensitive data, even after compromising certain account credentials.
Rajan Kapoor of Material Security and Home Sanders' Insights
Rajan Kapoor and Home Sanders highlight the need for a consolidated approach to security operations after a breach. They emphasize the importance of making it difficult for attackers to leverage compromised accounts or OAuth apps to access critical data, focusing on post-compromise security and layered protection strategies.
MyPillow Guy's $5 Million 'Prove Mike Wrong' Challenge Backfires
Michael Lindell's $5 million challenge to prove election interference by China resulted in someone presenting evidence against his claim. Despite failing to pay up, Lindell faces legal action, creating a humorous yet consequential situation that showcases the importance of backing claims with evidence.
On this week’s show Patrick and Adam discuss the week’s security news, including:
Turns out AI is still bad code review after all,
Mintlify loses a bunch of Github tokens,
Everything old is new again with the UDP loop DoS,
Know-your-(recon satellite)-customer is hard,
Microsoft takes away Russia’s powershell, solving living off the land,
And much, much more
This week’s show is brought to you by Material Security. In this week’s sponsor interview we speak with Material’s Rajan Kapoor, VP of Customer Experience at Material. We’re also joined by Chaim Sanders, who heads Security and Privacy at Lyft.