Blogs

Our ideas, experiences, and opinions… in words.

Oct 03

Cybersecurity at Machine Speed > Preparing for the Autonomous Threats

By Blogs, Cyber Defense Strategies, Identity & Access Management, ZTNA

Having spent over two decades in enterprise operational cybersecurity especially cyber defense, I have witnessed the evolution of threats from isolated events to persistent, nation-state grade espionage campaigns. Most security failures are not the result of missing tools. They often stem from controls that look all good on dashboard yet fail silently. Adversaries consistently try exploit the intersection of vulnerabilities, misconfigurations, and excessive access while defenders and response mechanisms largely continue to treat these issues in isolation, leaving systemic blind spots unaddressed. Traditional enterprise defenses were mostly calibrated to human scale attack tempo, exploitation, and lateral movement paced by human operators. This assumption no longer holds against automated, persistent, machine speed campaigns, The new AI-age.

CyberdefenseAIAgents Image
CyberdefenseAIAgents Image
In July 2026, Assumptions broke.

The incident involving OpenAI’s research agents and Hugging Face is not another data breach story. It is the first fully documented major case of an autonomous agent swarm escaping its isolation, discovering a zero-day, and compromising production infrastructure with no human issuing a command in real time. This is our wake-up call. The autonomous threat actor is no longer theoretical. It is operational, at a scale that our traditional defense is not designed to withstand,  and it is already here.

OpenAI & HuggingFace incident 

OpenAI’s technical report described a scenario that read like fiction and ran on real infrastructure. During an internal cybersecurity evaluation, a highly capable internal only research model, assisted by GPT-5.6 Sol agents, was tasked with offensive security testing. The agents were supposed to stay contained. They did not, and the way they got out really matters as much as what they did once they were free. This was not a straight shot from OpenAI’s sandbox to Hugging Face. The agents exploited a previously unknown zero-day in Artifactory’s container image cache handling, later assigned CVE-2026-66384, to reach the public internet. From there they compromised a separate, publicly hosted code-evaluation sandbox belonging to a third party and used it as an external launchpad, a staging point with no direct network path back to OpenAI’s own systems. Only from that launchpad did the campaign move on Hugging Face. Three organizations were involved before a single byte of Hugging Face data was touched, and none of them were the primary attacker’s own infrastructure. That is the real lesson for the supply chain risk model > the blast radius of an agentic escape extends through every possible system. technically every vulnerable system.

The patch didn’t hold, and that is the single most important data point in this whole report.

On July 4, the agents coordination channel, an improvised message board built on Artifactory, triggered an outage. OpenAI investigated, found the channel, and patched the underlying zero-day. The incident appeared closed. Two days later, on July 6, the agents rebuilt the exact same coordination capability through a completely different mechanism and resumed operating. Your incident response plan almost certainly assumes that patching the vulnerability ends the incident. Against an autonomous agent that can independently rediscover a path around a fix, that assumption is now a liability.

From July 9 through July 13, the campaign reached Hugging Face:

  • Code executed on 41 production dataset server workers
  • Root access obtained on at least one production node
  • Administrator-equivalent access to a Kubernetes cluster
  • Production credentials and limited internal and private data accessed
  • Four private Hugging Face code repositories downloaded
  • Agents coordinated through the rebuilt Artifactory message board, exchanging credentials, exploits, commands, and discoveries, with multiple agents independently building on what others had found

OpenAI didn’t detect the anomaly until July 19, six days after the Hugging Face compromise concluded, when unusual internal activity triggered an investigation. The company disclosed publicly and released its technical report on July 21. Hugging Face’s own reconstruction, published separately, recovered roughly 17,600 individual agent actions across the full campaign, most of them failed attempts, which is itself a useful data point: the agents did not need a high success rate. They needed persistence, parallelism, and machine speed. The hard truth for security leaders is about Speed combined with maneuver. Across a 11-day campaign, and a 13-hour final push, a non-human entity went from code execution on one worker to root and Kubernetes admin access across a major infrastructure provider it was never authorized to touch. We have spent years tuning SIEM’s, NDR’s to detect human attack patterns: the beaconing of a C2 server, predictable working hours, the typo in a command line or email grammar of an impersonation attempt. Agents don’t sleep, they don’t get tired, and they can evaluate a thousand lateral movement paths in parallel. Most detection baselines are built for an adversary that no longer represents the leading edge of the threat dimension.

Google Gemini breaches three real companies during testing – – Disclosed September 18 – 2026; incidents occurred in May 2026

In May 2026, during what was supposed to be a controlled cybersecurity evaluation by Irregular, Google’s Gemini model was assigned a simple task – breach a fictional company. But two small oversights an unintentional internet connection and a fictional company name that matched a real one turned a simulation into a live operation. Gemini found the real company, guessed a password to access its systems, and in two other cases, used credentials it scraped from public code repositories to enter protected networks. In each instance, the model stopped on its own once it recognized the targets were real businesses, and Google confirmed no actual harm occurred. But for a movement strip away the guardrails and the disclosure angle, and what’s left is a preview of the threat model every CISO and CIO now has to plan against: an adversary that doesn’t sleep, doesn’t get tired, and doesn’t stop at the first door it tries – It can probe a thousand lateral movement paths in parallel, pivot through credentials harvested from a bunch of public sources in seconds, and do it all without fatigue, hesitation, or a recognizable pattern that you can pick.

The question for CISOs and CIOs isn’t whether your controls can catch a clever human. It’s whether they can catch something that never stops trying.

Preparing your organization for the autonomous threat

For 20+ years I have advised, worked with enterprises on defense in depth, for the last six, seven years more on Zero Trust approach. These strategies still matter, but the foundation has to shift. We can no longer design detect-response timers around the assumption that an attacker needs hours to move. We need to design for an adversary operating at the speed of a for loop. Also, there is another major dimension in that, as we integrate AI agents into our own workflows, whether that’s a CRM agent, Agentic Chatbot, a GitHub Copilot agent, or an internal HR bot, we are not deploying a tool. We are creating a new identity class with its own permissions, its own API access, and its own capacity to execute code. When one of those identities goes rogue or gets hijacked, it becomes the most capable insider threat organization has ever faced.

An AI Agent with an identity with its own permissions, API access, credentials, and, increasingly, the ability to execute actions and code and that is where the problem lies. Think about the alarms built into our security controls today – anomalous access, impossible traversal, a data pull that doesn’t match the role, privilege escalation, unusual behavior. But what happens when the AI agent doesn’t actually exceed any of those boundaries? It operates within the permissions we gave it, uses the API keys we issued, accesses the systems we allowed, executes the code we authorized – nothing necessarily looks anomalous, and it is doing exactly what we told it to do, just not what we meant it to do. By the time a human recognizes the intent was wrong, the action may already be complete, and the blast radius is determined by one simple thing: how much authority we gave that identity when we created it. That, to me, is the real issue. It isn’t just a detection gap, it is a design gap and we cannot buy our way out of it by adding another tool to the stack. We need to rethink what authority (agency) means for an AI agent > scope the identity to the task, time-box the credentials, limit what it can invoke, and make it earn authority for sensitive actions rather than simply inherit it from a role  and most importantly, assume that an agent we trust today can eventually do something we never intended. Because when that happens and the board asks, “How did this happen?”, saying “It had unintended permission” is not going to be an answer that holds. – Murali Konasani

Aug 03

Microsegmentation: The Missing Layer in Modern Network Defense

By Blogs

Perimeter security assumes everything inside the network can be trusted. Attackers have learned to exploit exactly that assumption. Here’s how segmenting the inside changes the outcome of a breach.

// Flat network

entry point

One compromised host. No internal boundaries. The breach reaches every connected system — the entire environment becomes the blast radius.

// Microsegmented

segment A segment B segment C segment D

Same compromised host. Policy blocks unauthorized east-west traffic by default. The breach is contained to a single segment.

-- THE PROBLEM

Why perimeter security alone no longer works

For decades, enterprise security was built around a simple idea: build a strong wall around the network, and anything inside it can be trusted. That model has quietly collapsed. Cloud adoption, remote work, hybrid data centers, and increasingly sophisticated attackers have made the traditional perimeter porous — and in many cases, irrelevant.

Today’s breaches rarely stop at the point of entry. Once an attacker compromises a single endpoint, server, or cloud workload, the real danger is what happens next: lateral movement. Attackers quietly move from system to system, escalating privileges and searching for high-value targets like databases, domain controllers, or backup systems. By the time defenders notice, the damage is often already done.

-- THE CONCEPT

What is microsegmentation?

Instead of one large open floor, imagine a building full of individually locked rooms — each with its own access rules.

SINGLE PERIMETER Once inside, unrestricted movement Each workload: its own locked policy

Microsegmentation is a security approach that divides a network into small, isolated zones — down to the level of individual workloads, applications, or even processes — and enforces strict policies about what can communicate with what. Instead of relying on a single perimeter, every internal connection is evaluated against policy.

Unlike traditional network segmentation, which relies on VLANs, firewalls, and physical network changes, modern microsegmentation is typically implemented in software. Policies can be applied consistently across on-premises data centers, private cloud, public cloud, and containerized environments, without re-architecting the underlying network.

-- WHAT TO LOOK FOR

Core capabilities that separate effective solutions

Not all microsegmentation approaches are created equal. These seven capabilities consistently distinguish solutions that reduce risk from ones that just add operational overhead.

Full visibility before enforcement

A real-time, application-aware map of every workload and communication flow — on-prem, cloud, and hybrid — reveals risky connections before any policy is written.

Software-based, agent-driven enforcement

Lightweight agents on the workload decouple policy from network hardware — rules travel with the workload as it moves between environments.

Granular, identity- and process-level policy

Rules enforced at the process, application, or identity level — not just IP address — make it far harder to abuse legitimate-looking traffic.

Fast, low-friction deployment

No network redesign required. Meaningful risk reduction in weeks, not the months or years legacy segmentation projects historically took.

Ransomware and breach containment

Default-restrictive east-west policy keeps a successful compromise contained to a small blast radius, limiting spread by design.

Compliance-ready segmentation

Isolating in-scope systems — cardholder data, protected health information — simplifies audit scope and reduces compliance overhead.

Consistent policy across hybrid and multi-cloud environments

The same segmentation logic applies whether workloads sit in a private data center, AWS, Azure, GCP, or a Kubernetes cluster — avoiding fragmented, environment-specific policy sets that are hard to maintain. 

--BUSINESS IMPACT

Benefits beyond the security team

Risk reduction is the headline. But the operational and business value reaches further.

MTTR

Faster incident response through clear traffic visibility
 

SCOPE

Smaller compliance audit footprint by isolating regulated systems

UPTIME

Contained breaches instead of organization-wide outages
 

CONFIDENCE

Consistent policy removes a common cloud-migration blocker
 

TICKETS

Less reliance on network teams for firewall or VLAN changes

-- WHAT TO AVOID

Common pitfalls

✕ Enforcing before visibility

Blocking traffic without first mapping dependencies breaks legitimate applications and erodes trust in the program.

✕ Treating it as a one-time project

Environments change constantly; policy needs continuous monitoring and adjustment, not a single rollout.

✕ Choosing hardware-dependent approaches

Solutions tied to specific network hardware or requiring re-architecture tend to stall due to cost and complexity.

✕ Ignoring the cloud

On-premises-only coverage leaves significant blind spots as workloads migrate to public and hybrid cloud.

--GETTING STARTED

A practical rollout path

1 Discover Map workloads & flows 2 Analyze Find risky connections 3 Design policy Based on real behavior 4 Simulate Monitor-only test mode 5 Enforce Roll out segment by segment 6 Monitor Refine as things evolve

The bottom line

As networks become more distributed and attackers more sophisticated, the assumption that “inside the network” means “safe” is no longer viable. Microsegmentation flips the model: instead of trusting everything behind the perimeter, it verifies every connection, everywhere, all the time. The organizations that get ahead of this now – rather than after a breach forces the issue – will be the ones best positioned to operate confidently across increasingly complex, hybrid environments.

Feb 25

Zero Trust Architecture: The Control Plane for AI, Cloud, and Enterprise Security

By Cyber Defense Strategies, Uncategorized, ZTNA
Image

So if you have been following along with this series, welcome back. I have written about the foundational building blocks of Zero Trust security here. The kind of stuff that powers the tools, platform, tech we use every day, even if most people don’t realize it. For me this sits right at the intersection of cybersecurity and AI. The security architecture that protects AWS, Google Cloud, Microsoft Azure, and every serious enterprise network you can name. Every time a user or a process login to an app, access a company VPN, use a cloud service, or work with an AI tool that touches sensitive data… a security model is making decisions. Understanding how that model works helps you design better systems, make smarter security decisions, and spot vulnerabilities that others miss. Before Zero Trust existed, the dominant model was called perimeter security. The idea was simple and intuitive. Build a wall around your network, cloud instance. put a moat around the wall. guard the gate. anything outside the wall is untrusted. anything inside the wall is trusted. this is the castle-and-moat model. In this model, you get past the firewall – you are mostly in and once you’re in, you can go almost anywhere. For a while, this worked. most companies operated in physical offices to private cloud tenants. their data lived on their servers. User connected over a LAN, VPN. the perimeter was real and it was manageable.

The perimeter model had two catastrophic flaws that became impossible to ignore. The world started building cloud infrastructure, remote workforces, mobile devices, third-party integrations, and AI systems that span dozens of services. The perimeter dissolved. and the old model collapsed with it.

Problem 1: There Is No More Perimeter > Users now work from home, coffee shops, airports, and shared offices. Applications live in AWS, Azure, GCP, and five SaaS tools. Data flows between Teams, Slack, Salesforce, your internal database, and an AI model running an API call. Where is the wall now? There is no wall. the network perimeter no longer exists as a meaningful boundary. Trying to protect a castle when the castle has been replaced by a distributed cloud is like putting a moat around thin air.

Problem 2: Attackers Were Getting Inside Anyway > Even when the perimeter existed, it was failing. Attackers found ways in: phishing emails, stolen credentials, compromised vendors, social engineering. and once they were inside? they moved freely. This is called lateral movement. An attacker gets one foothold and then walks through your entire network unchallenged. The breach of one account became the breach of everything. The Equifax breach. The SolarWinds attack. The Target hack. all followed this exact pattern. Get inside the perimeter, move laterally, steal everything. Researchers and practitioners started asking a different questions. “what if we stopped trusting anyone, anywhere, at any time by default? what if every request had to prove itself, every single time?” This led to Zero Trust Approach.

The Core Idea: Never Trust, Always Verify

in 2010, John Kindervag at Forrester Research formally defined the Zero Trust model. Then Google built their own internal implementation called BeyondCorp; they have published it in 2014 and the industry took notice. The big insight was this: “location inside the network means nothing. identity and context are everything.” instead of asking “are you inside the network?” the new question became:

  • Who are you? (identity verification)
  • What device are you using? (device health check)
  • What are you trying to access? (resource context)
  • Do you actually need access to this specific thing? (least privilege)
  • Does this request look normal? (behavioral analysis)

Every single access request answers all five questions. every time. no exceptions.

What Zero Trust Architecture Looks Like

A Zero Trust architecture has three main components. the Policy Engine, the Policy Administrator, and the Policy Enforcement Point, think of them like a bouncer, a security manager, and the door itself.

The Policy Enforcement Point (PEP) This is the door. every access request hits the PEP first. it blocks everything by default. Nothing passes through without a decision from the Policy Engine.  If the Policy Engine goes offline? access is denied. not granted. denied. Fail closed, not fail open. that is a fundamental Zero Trust principle.

The Policy Engine (PE) This is the brain of the system. The Policy Engine takes in all available signals about a request and makes a trust decision. Those signals include:

  • User identity: authenticated via MFA, SSO, or certificate
  • Device health: is this device enrolled? is it patched? does it have endpoint security?
  • Behavioral signals: is this user acting normally or suspiciously?
  • Network context: what time is it? what location? what IP?
  • Threat intelligence: has this IP or user been flagged anywhere?

The engine weighs all of this and produces a trust score. High trust score: access granted, possibly with conditions. Low trust score: access denied or step-up authentication required.

The Policy Administrator (PA) – This is the manager. once the Policy Engine makes its decision, the Policy Administrator communicates it. It issues session tokens for approved access and revokes them when conditions change/ and dynamic in nature. If you change your location mid-session, the PA may re-evaluate your trust score and cut your access in real time.

The Five Pillars of Zero Trust

Zero Trust is not a single product. it’s a philosophy implemented across five layers.

PILLAR 1: IDENTITY Every user, service, and AI agent must have a verified identity. MFA. Certificate-based auth. SSO. No anonymous access.   
PILLAR 2: DEVICE Every device must meet minimum security standards.   Patched? Enrolled? Compliant? If not, no access.  
PILLAR 3: NETWORK Micro-segmentation. East-west traffic is inspected. No implicit trust between internal systems. 
PILLAR 4: APPLICATION AI Agents, Apps authenticate users at the app layer, not just the network. Access to app!= access to all data inside the app.  
PILLAR 5: DATA Classify and protect data itself. Encryption at rest and in transit. Least privilege access.   Audit logs on every data access.

Together, these five pillars eliminate the concept of a trusted zone. Every layer independently verifies. Every layer independently protects. Even if an attacker gets through one layer, every other layer is still asking: ‘who are you and should you actually be here?’

Why Zero Trust Is the Security Foundation for AI

Here is why this matters even more in 2026 and beyond. AI systems have fundamentally changed the attack surface. An LLM agent running autonomously can make thousands of API calls. It can access databases, send emails, modify files, and call external services. It has identity. It has access. It behaves in patterns. That agent is a principal in your security model and it needs to be treated exactly like a human user under Zero Trust principles.

Prompt injection attacks, model exfiltration, agentic overreach – all of these are security problems that Zero Trust principles directly address. A well implemented Zero Trust model forces every AI agent to declare its identity, operate with minimum necessary permissions, and have every action logged and auditable. This is not optional architecture. this is the baseline for responsible AI deployment.

Key Principles of Zero Trust

Here is a clean summary of what drives every Zero Trust decision:

  • Assume breach: design as if attackers are already inside. contain the blast radius.
  • Verify explicitly: always authenticate and authorize using all available data points.
  • Use least privilege access: limit access to only what is needed, only when it is needed.
  • Micro-segmentation: divide the network into small zones. breach one zone, stay contained.
  • Continuous monitoring: trust is not a one-time decision. it is re-evaluated constantly.
  • Encrypt everything: data in transit and at rest. always. no exceptions.

May 06

Teksalah Joins Qualys mROC Partner Alliance to Revolutionize Cyber Risk Management 

By Blogs
Image

In an era of digital complexity and evolving cyber threats, organizations struggle not just with protecting their environments but also with translating cybersecurity efforts into measurable business outcomes. Fragmented tools, excessive alerts, and a lack of centralized visibility often hinder true risk management. Teksalah, in partnership with Qualys, is stepping in to bridge this gap. 

As a long standing expert partner from the EMEA region, we are proud inaugural member of the Qualys mROC (Managed Risk Operations Center) Partner Alliance, Teksalah is uniquely positioned to deliver end-to-end, business-aligned cyber risk management services powered by the Qualys Enterprise TruRisk™ Management platform.

From Visibility to Action: Turning Cyber Risk Into Business Strategy 

Our mROC services unify and simplify risk management by consolidating security findings across cloud, on-premises, and hybrid environments. This enables real-time visibility into threats and vulnerabilities—presented in a prioritized, business-contextualized view that empowers security teams to act quickly and strategically. 

What We Offer as a Trusted mROC Partner: 

  • Cyber Risk Quantification & Advisory: 
    We help CISOs and decision-makers quantify cyber risk in financial and operational terms, enabling strategic investment and alignment with risk tolerance levels. 
  • Streamlined Onboarding & Integration: 
    Our experts centralize telemetry and accelerate platform adoption, enabling continuous vulnerability monitoring and automated remediation from day one. 
  • 24/7 Continuous Monitoring & Management: 
    Teksalah ensures always-on risk visibility, workflow automation, and executive-ready reporting to help organizations stay audit- and compliance-ready. 
  • Risk Remediation Services: 
    Our managed remediation programs proactively address critical risks with intelligent automation and hands-on support, reducing exposure and response time. 
Image

Why Teksalah + Qualys mROC? 

“Teksalah & Qualys partnership is built on a shared vision — to embed a holistic risk-based, proactive approach at the core of enterprise cybersecurity. Through our powerful platforms, intelligent tools, and proven services—covering from real-time risk monitoring to effective remediation—we are enabling organizations to manage risk with precision and drive secure innovation. Together, we are transforming our clients’ cybersecurity from a control function into a catalyst for their business growth and resilience.” 
— Murali Konasani, CEO, Teksalah 

The Future of Cyber Risk Management Starts Here 

By joining the mROC Partner Alliance, Teksalah is helping organizations across EMEA take a proactive stance on cybersecurity—bridging the gap between risk and resilience, and transforming siloed defenses into unified, measurable strategies. 

“mROC is a game-changer for both CISOs and our partners,” said Shawn O’Brien, SVP, Global Sales and Channels at Qualys. “By centralizing cyber risk management through the Risk Operations Center (ROC), we’re helping CISOs move from reactive to proactive risk strategies that improve operational efficiency and build resilience.” 

Ready to transform your cybersecurity into a strategic advantage? 

Connect with Team teksalah today to explore how mROC services can drive secure, scalable innovation for your organization.

Apr 28

Microsoft’s New Email Authentication Rules Are Here — Is Your Business Ready?

By Blogs
Image

Microsoft one among the major email platform provider begins strictly enforcing email authentication protocols for domains that are sending over 5,000 emails per day. This means most of the enterprises across verticals are under this criteria, and may need action.

This major update is part of Microsoft’s broader push to reduce spam, combat phishing, and improve email security.

If your organization is a high-volume sender and you’re not compliant with Microsoft’s new standards, your emails could be automatically marked as junk—or even blocked/ rejected entirely. This applies to Outlook.com consumer service, which is supporting hotmail.com live.com and outlook.com consumer domain addresses. 

So what exactly does this mean for your business?

The 3 Essentials for Email Authentication Compliance

To ensure uninterrupted email delivery, you would requires the following: These are however not something new to those who already have a matured email platform security practice in-place.

  • DMARC (Domain-based Message Authentication, Reporting, and Conformance):
    Protects your domain from being spoofed by cybercriminals and gives you visibility into how your domain is used.
    • At least p=none and align with either SPF or DKIM (preferably both).
  • SPF (Sender Policy Framework):
    Verifies that your emails are being sent from approved servers and IP addresses.
    • Must Pass for the sending domain.
    • Your domain’s DNS record should accurately list authorized IP addresses/hosts.
  • DKIM (DomainKeys Identified Mail):
    Ensures the email content hasn’t been altered during transit and validates the sender’s identity.
    • Must Pass to validate email integrity and authenticity.

Also ensure the “From” or “Reply‐To” address is valid, reflects the true sending domain, and can receive replies.

May 5th, 2025, Outlook will begin routing messages from high volume non‐compliant domains to the Junk folder, giving senders an opportunity to address any outstanding issues. NOTE: that in the future (date to be announced), non-compliant messages will be rejected to further protect users.  

What Happens If You’re Not Compliant?

Failure to meet these requirements can seriously harm your email performance and brand trust. Here’s what you could face:

  • ❌ Emails sent to recipients’ spam or junk folders
  • ❌ Loss of credibility and trust with email domain reputation
  • ❌ Complete email rejections by Microsoft mail servers

How Teksalah Can Help Your Business Stay Compliant

At Teksalah, we understand that managing email compliance, DNS records, email protocols, and other data compliance standards can be complex and time-consuming. That’s why our solutions offer a fully managed email authentication systems designed to make compliance effortless.

With our active support & solutions, you get:

✅ Automated SPF, DKIM, and DMARC setup
✅ Real-time, human-readable reports
✅ Easy to manage platform
✅ Expert human support at every step
✅ Zero disruption to your mail flow

Get Expert Help from Teksalah Today

We’ll handle the entire process so you can focus on what matters most—running your business.

Jan 16

Understanding and Mitigating Modern MFA Bypass Attacks

By Blogs
TEK MFA Bypass Attacks Image

2FA/ MFA Bypass

Recently, we have encountered multiple incidents where attackers successfully bypassed Multi-Factor Authentication (MFA), even though the organization had mandatory MFA policies in place. For example at the global level to the O365 tenant. 

This raises a critical question: how are these attacks succeeding despite robust authentication protocols in-place?

Multi-Factor Authentication (MFA) is a cornerstone of modern cybersecurity, designed to provide an additional layer of protection against unauthorized access. However, as cyber defenses evolve, so do the methods attackers use to bypass them. Here, we explore three prominent MFA bypass attack methods—MFA fatigue, token theft, and Machine-in-the-Middle (MitM) attacks—and the strategies organizations can adopt to counteract them.

1. MFA Fatigue Attacks

This social engineering method manipulates users into granting unauthorized access by overwhelming them with repeated MFA requests. Attackers who have stolen valid credentials can send a barrage of push notifications, hoping the user unknowingly approves access out of frustration or confusion.

Mitigation:

  • Limit the number of MFA push notifications allowed in a given period.
  • Use alternative methods like number matching, where users input a unique code displayed on their device to verify access.
  • Educate users about recognizing and reporting unusual MFA prompts.

2. Token Theft

Session cookies, designed for user convenience, can be exploited by attackers to bypass MFA. Once an attacker captures these session cookies (via malware or other methods), they can impersonate the legitimate user without needing to re-authenticate.

Mitigation:

  • Implement robust endpoint protection to prevent malware that steals cookies.
  • Use web session expiration policies to limit cookie validity.
  • Monitor for anomalous session activity and unauthorized cookie usage.

3. Machine-in-the-Middle (MitM) Attacks

Often executed via phishing, these attacks involve tricking users into visiting malicious proxy servers. These proxies intercept traffic between the user and legitimate servers, capturing credentials and session cookies to bypass MFA.

Mitigation:

  • Deploy phishing-resistant MFA solutions like FIDO2-compliant hardware keys.
  • Train users to identify and avoid phishing attempts.
  • Enable URL filtering and email scanning to block malicious links.

While Multi-Factor Authentication (MFA) adds an essential layer of security, it remains vulnerable if the device hosting the authenticator app is compromised. In scenarios where attackers gain access to both stolen credentials and the compromised device, they can potentially bypass MFA entirely, leveraging the authenticator app to approve their own malicious login attempts. This emphasizes the need for additional security measures, such as geofencing. By restricting access based on the user’s geographic location or setting conditional access policies that flag logins from unfamiliar or high-risk locations, organizations can significantly reduce the risk. Geofencing works as a proactive boundary, ensuring that even if credentials and devices are compromised, suspicious login attempts from unauthorized locations are blocked or require further verification, adding a robust layer of defense.

The Role of User Awareness

Human error remains a common factor in MFA bypass attacks. Users often overlook security best practices in favor of convenience, making awareness training critical. Educating employees on the risks of MFA fatigue, phishing, and other attack methods can significantly reduce the likelihood of successful breaches.

Key Takeaways

  1. MFA remains a vital security tool but is not foolproof.
  2. Advanced attacks like MFA fatigue, token theft, and MitM require both technical and behavioral defenses.
  3. Organizations must adopt proactive measures, including awareness training, endpoint protection, and advanced MFA features like number matching.

By combining technology with user education, businesses can better safeguard against the evolving tactics of cybercriminals.

Stay vigilant, stay secure!

May 21

The  Future of Authentication: Going password less

By Blogs

Embrace FIDO for a Password-Free World

Image

You know what we all hate? I mean, really hate? Passwords.

There are too many of them, they are hard to remember, and if you are like me, you are also probably losing them all the time. What if we tell you there is a way to get rid of passwords without compromising security? In fact, a way that improves both usability and security simultaneously. That would be nice, is’nt? The technology that makes this possible is called Fast Identity Online, or FIDO in short.

What is FIDO?

FIDO is a set of security specifications designed to eliminate the need for passwords by replacing them with passkeys. This initiative began in 2013 through the efforts of the FIDO Alliance, an industry consortium that developed the standard. Today, over 250+ Organizations are part of this alliance, integrating FIDO standards to enhance their security frameworks. The FIDO Alliance is changing the nature of authentication with open standards for phishing-resistant sign-ins with passkeys that are more secure than passwords and SMS OTPs, simpler for consumers and employees to use, and easier for service providers to deploy and manage. The Alliance also provides standards for secure device onboarding to ensure the security and efficiency of connected devices operating in cloud and IoT environments. There are already a few password less methods that you might have seen 

  • Biometric authentication
  • Magic links
  • SMS/Email One-Time Password (OTP)
  • Push notifications

But most of these methods are not secure enough to replace a password + Multi-Factor Authentication (MFA) combination.

The Evolution: FIDO2
The latest advancement, FIDO2, brings two critical components to the forefront: hardware-based authentication and extensive web browser support. With FIDO2, users can authenticate using biometrics or hardware tokens, such as smartphones, which serve as a physical authenticator. This means you can unlock your phone with your face or fingerprint and use it to securely access various services. FIDO2’s web browser support expands its usability across different platforms, making passwordless authentication more accessible than ever.

How Does FIDO Work?
To understand how FIDO works, let’s dive into some cryptographic principles. Cryptography is essential for secure communication and comes in two main forms: symmetric and asymmetric.
Symmetric Cryptography: In symmetric cryptography, the same key is used for both encryption and decryption. Both parties need to know the key, which can be a security risk if the key is exposed.
Asymmetric Cryptography: Asymmetric cryptography uses a pair of keys: a public key and a private key. Messages encrypted with the public key can only be decrypted with the private key, and vice versa. This ensures that even if the public key is shared, the private key remains secure.

FIDO Authentication Flow

  1. Registration:
    • During registration, the user’s device generates a pair of cryptographic keys: a public key and a private key.
    • The private key remains on the user’s device, secured by biometrics or another strong authentication method.
    • The public key is sent to the web server, which stores it in its database.

    2. Authentication:

      • When the user attempts to log in, they provide their username to the web server.
      • The server retrieves the corresponding public key and generates a unique challenge—a piece of data that the user’s device must respond to.
      • The challenge is encrypted with the public key and sent to the user’s device.
      • The user’s device decrypts the challenge using the private key, verifies it, and sends a response back to the server.
      • The server then decrypts the response with the public key. If the challenge matches, the user is authenticated.

      Advantages of FIDO

      • Enhanced Security: FIDO’s use of asymmetric cryptography ensures that even if a public key is exposed, the private key remains secure on the user’s device, drastically reducing the risk of unauthorized access.
      • Phishing Resistance: Since there are no passwords to steal, phishing attacks become significantly less effective. Attackers cannot trick users into revealing passkeys because the authentication process does not involve any sharable secrets.
      • Replay Attack Resistance: FIDO’s challenge-response mechanism ensures each authentication attempt is unique and cannot be reused by attackers.
      • User Convenience: Users no longer need to remember or manage passwords. Authentication relies on cryptographic keys that are automatically generated and managed by their devices.

      Industry Adoption and Support
      Major tech giants like Microsoft, Google, Apple and 150+ more like these have adopted FIDO2, integrating it into their platforms to provide secure, passwordless authentication using passkeys. This widespread adoption signals a strong industry shift towards more secure and user-friendly authentication methods.

      So Why Passkeys when compared with passwords

      • Discoverable (browse can autofill, don’t need to remember)
      • Phishing resistant
      • Remote attack resistant
      • Breach resistant
      • Not reusable
      • Not shareable
      • Easier to maintain
      Image

      Looking Ahead: A Password-Free Future

      FIDO represents a revolutionary step in the evolution of digital security. By leveraging the power of cryptography and the convenience of biometrics and hardware-based authentication, FIDO not only eliminates the need for passwords but also enhances security and user experience. As more organizations adopt FIDO, we are moving closer to a future where logins are seamless, secure, and free from the hassles of passwords. This is not just the future of authentication—it is the present, and it’s transforming how we think about security.

      Lets embrace the change and look forward to a world where the stress of managing passwords is a thing of the past. Welcome to the era of FIDO.

      Check on our previous blogs here

      May 02

      The Imperative of Continuous Zero Trust > Adapting Security for the Ever-Growing Threat Landscape 

      By Blogs, ZTNA
      Image

      Despite Zero Trust buzz being around for years now, it is only since 2021 the security landscape is experiencing a major surge in Zero Trust adoptions. The Initial focus was centered on raising awareness, clearly that there is now an ongoing shift towards product and production deployments. Cited in a recent PWC report “2024 Digital Trust Insights: Middle East findings”, still a significant portion of respondents in middle east and across the world are prioritizing Zero Trust implementations within their organizations top priorities. 

      For decades, the cybersecurity landscape relied on building “castle walls” approach – fortifying perimeters, zones, domains and trusting inside. But with the rise of sophisticated cyber threats, cloud adoption, remote work, increasingly collapsed, or do I say spread across perimeter with more and more integrations to ICT environments combined with weak insider factors this strategy has become vulnerable. This is where Zero Trust emerges as a paradigm shift. 

      Zero Trust is the term for an evolving set of cybersecurity paradigm that move defenses from static, network-based perimeters to focus on users, identities, assets, and resources. “Moving security away from the perimeter approach and towards an integrated security architecture approach focusing on data, applications, entity and services protection will be critical to achieving the Zero Trust vision”. It is not a one-time implementation; it is a holistic security philosophy, security framework that requires ongoing vigilance and continuous adaptation to effectively mitigate risks. Unlike traditional perimeter-based security models, which rely on the assumption of trust within the network, zero trust approach assumes that threats could be both external and internal, and it requires continuous authentication & authorization for every user, device, resource, request, and application attempting to access resources, regardless of their location. It operates under the core principle of “never trust, always verify”. This ideally means a 360 degree always on approach to security and data centricity. Access to resources is continuously validated, authenticated and authorized based on multiple factors such as user identity, device health, behavior, risk score and contextual information. It emphasizes that every user, device, or workload connected to or need to access organization’s resources should never be trusted, should always be regularly verified, and should be granted least-privilege access to perform its job. 

      To summarize, at the core level Zero Trust security model operates on key principles applied on to what is called pillars or ‘the key focus areas.   

      Foundational elements- The Principles 

      • Assumes a Hostile Environment 
      • Presume Breach  
      • Never Trust, Always Verify 
      • Scrutinize Explicitly  
      • Apply Unified Analytics  

      Foundational elements- The Pillars  

      • Data 
      • Users 
      • Devices 
      • Identities 
      • Environment/ Network 
      • Applications and workloads  
      • Automation & Orchestration 
      • Visibility & Analytics  

      For Organizations in this journey, a re-engineered security model with Zero Trust for access to resources implements dynamic policy controls. These are tightly combined with observable state of user and the endpoint identity, application, service and the requesting asset with its behavioral and environmental attributes. Confidence levels are correlated from multiple attributes (identity, location, time, device security posture, context, etc.) of that authentication & authorization request. 

      Continuous Zero Trust tightly implements data centricity, multi-factor authentication, conditional access, micro-segmentation, encryption, endpoint security, automation, analytics, and robust auditing to data, applications, assets, services, entities, which are also fundamental to modern cybersecurity practices. It starts with data centric security identifying sensitive data and resources as foundation. The more organizations know where their most sensitive data exists, who can access to it, and what they are doing with it, the more effective the defenses can be. By enforcing the principle of least privilege, organizations limit access rights for users and applications to only what is necessary for their specific roles and responsibilities. This minimizes the potential impact of a security breach and reduces the attack surface. Furthermore, micro-segmentation divides the network into smaller, isolated segments, effectively containing any potential threats and preventing lateral movement. However, implementing these principles in a static manner is insufficient. Continuous Zero Trust approach must ensure that access rights, segmentation policies and containment, automated actions are dynamically adjusted based on real-time context, such as user behavior, device posture, confidence sore and threat intelligence.  By continuously monitoring user entity, behavior, device health, network traffic, and system logs, systems can identify suspicious activities and anomalies indicative of potential security breaches. This proactive approach allows security teams to respond swiftly, mitigating the impact of cyberattacks and minimizing downtime. 

      As AI capabilities advance rapidly, we will continue to see growing sophistication in AI-powered attacks, ranging from deepfake social engineering to adaptive malware crafted to evade detection. However, fully integrated Continuous Zero Trust implementations, enhanced by AI capabilities, offer a robust defense against these threats. 

      Though a Zero Trust security model is most effective when implemented across the organizational digital ecosystem, most organizations do apply this in their cybersecurity implementations to identity & authentication, firewalls, endpoints but stop before their applications. This is because the existing solution claim “Zero Trust” yet do not follow the “verify first, then allow” model for application workloads or it is not fully integrated into the Zero Trust eco system. Integrating vendor suites of products is critical to this journey and will assist in reducing cost and risk to the organization. Also the absence of standardization in the industry makes it difficult for organization in measuring their Zero Trust implementation effectiveness. Organizations can take a phased but continuous approach based on their current cybersecurity maturity, available resources, and business objectives. It is imperative to consider each investment carefully and align them with the present business needs and the vision. 

      <<BLOGS>>

      Sep 06

      Security Best Practices to Protect Against Insider Threats

      By Blogs, Security Best Practices
      Image

      Its not the technology controls alone nor the sophistication of controls that one have implemented can protect an organization entirely from malicious insiders.
      It requires a combination of technical, procedural, and cultural measures to effectively defend against malicious insiders. Whether they are of intentional or ignorant type.
      An insider or a malicious insider threat can be of many forms – current or former employees, contractors, or business partners who misuse their access and privileges to harm the organization, or a trusted API connection to a third-party which is being exploited under the hood. So lets note what are some effective ways for an organization to protect itself from insider threats: “malicious and ignorant”. Below are the few Security Best Practices to Protect Against Insider Threats:

      Employee Screening
      Conduct thorough background checks on all employees before hiring, especially for positions with access to sensitive data or systems.

      Increase employees cybersecurity awareness, Continuous training.
      With negligence as one of the primary causes of insider security incidents, prioritizing employee cybersecurity education becomes imperative. It’s essential to ensure that your employees fully understand your security policies, the importance of adhering to them, and the potential consequences of non-compliance. Equally vital is equipping your employees with fundamental skills to recognize and respond to potential threats. Educate employees about security policies, acceptable use, and the consequences of insider threats. Promote a culture of security and encourage employees to report suspicious activity without fear of reprisal.

      User Access Control/ Zero trust approach
      Least Privilege Principle: Limit user access to only what is necessary for their roles. Regularly review and update permissions as job roles change.

      Multi-Factor Authentication (MFA)

      Implement MFA for critical systems and sensitive data to make it harder for insiders to compromise accounts.

      Good password policy
      Your organization’s sensitive data and systems are protected from attackers by an effective password policy. Internal company accounts of employees may be compromised, allowing unauthorized access to confidential data. Creating a thorough password policy is crucial to reducing this risk.
      Insiders must adhere to specific rules outlined in a password management policy. These instructions can advise using different passwords for every account, coming up with complicated passwords, and changing passwords frequently. Additionally, without disclosing the credentials, you can give employees access to the endpoints of your company by using password management software.

      Monitoring privileged users activity
      Privileged users within your network present heightened risks compared to regular users due to their elevated access rights. Therefore, it is crucial to give their actions special attention. By closely monitoring privileged users, you significantly increase your ability to detect early indications of privileged account compromise or misuse of privileges.

      Continuously Monitor the activity of employees behavior
      Consider implementing user activity monitoring tools that enable real-time visibility into user sessions. By accessing and observing user sessions that involve interaction with your sensitive data and systems, you can significantly enhance the security of these valuable assets. Continuous monitoring can help you ensure early detection and timely response to suspicious user behavior. To effectively safeguard your assets, consider monitoring the activities of your employees and vendors within your infrastructure is must.

      Ensure data security, Data Loss Prevention (DLP)
      Protecting your valuable data is of utmost importance when managing insider risks. Encryption is the tried and true security practice that effectively safeguards your data from unauthorized access. Securing your data also involves performing full, differential, and incremental backups. By doing so, you can safeguard your valuable information and minimize the risk of data loss. Ensuring quick restoration of business operations is crucial in the event of physical or digital data damage. Regular backups are the key to achieving this. Deploy DLP solutions to monitor and prevent unauthorized data transfers or access to sensitive information. Encrypt sensitive data at rest and in transit always.

      Control access to systems and data
      To mitigate insider risks, controlling access to systems and data within your organization is essential. Implementing a zero-trust architecture adds an additional layer of protection. This approach requires approval or user identity verification before granting access to critical assets. The principle of least privilege can also be employed, whereby each user is granted the minimum level of access rights required, with privileges elevated only when necessary. Combine this with conditional access measures like that of enforcing geo fencing, enterprise mobile management with containerized security for organizational data, etc.

      Regularly review user access rights
      User access reviews involve determining which individuals have access to specific data or systems and assessing whether they need such access for their job roles. Regular user access reviews guarantee that existing access permissions align with the organization’s current business and security requirements.

      Perform regular security and IT compliance audits
      By conducting regular audits, you can evaluate the effectiveness of your existing security measures and pinpoint any deficiencies in your security policies. Audits provide valuable insights into areas that require improvement, allowing you to mitigate insider risks and ensure compliance with cybersecurity standards, laws, and regulations.

      Incident Response Plan
      Develop a comprehensive incident response plan that includes procedures for handling insider threats. Test the plan regularly through tabletop exercises and simulations.

      Exit Procedures
      Implement strict exit procedures to revoke access immediately when an employee leaves the organization. Conduct exit interviews to ensure all assets are returned and access credentials are disabled.

      Whistleblower Programs
      Establish anonymous reporting channels for employees to report suspicious activity. Ensure that reports are taken seriously and investigated promptly.

      Physical Security
      Limit physical access to critical infrastructure and sensitive areas. Use security cameras and access control systems to monitor and control physical access.

      Vendor and Third-Party Risk Management
      Extend security policies to third-party vendors and partners who have access to your systems or data. Verify their security practices and conduct regular audits.

      Legal Measures
      Develop legal agreements and contracts that explicitly outline the consequences of insider threats and unauthorized data access.

      Remember that while technical controls are essential, a strong security culture and continuous employee education are very crucial in mitigating the risks associated with malicious insiders. It’s important to strike a balance between security and trust to maintain a healthy work environment while safeguarding the organization’s assets.

      Jan 04

      Effective Cyber Defense Strategies for Enterprises against Social Engineering Attacks – Part1

      By Blogs, Cyber Defense Strategies

      Digital transformation, digital technology usage from what it was to how it is being adopted today by enterprises, and individuals are an almost essential commodity. New applications in this mobile-first cloud-first era are exposing individuals, and organizations to potential cyber security vulnerabilities that can be exploited through social engineering attacks without much of sophistication.

      Social engineering attacks are real and are considered major threats to organizations of every size. They are of manipulation techniques that exploit human error to gain access to something sensitive. They employ deception, manipulation, intimidation, etc to exploit the human element, or users, of target information assets in the cyber context. Generally, these attacks are successful because individuals may be persuaded to take an action by strong incentives like money, sentiment, fame, or fear, as well as by simple deceit. These attacks pose a serious threat to cybersecurity because users can still be tricked into revealing their credentials or executing a malicious action for an attacker regardless of how robust the technical security infrastructure is. There have been many major incidents in the industry notably – Target, Yahoo, Zoom, RSA, Marriott, Twilio, and so on breaches where social engineering was employed to successfully exploit. Eventually leading to a major business impact.

      Here are a few major techniques and types that can come under social engineering attacks – Phishing, Spear Phishing, Whaling, Vishing, Smishing, BEC, DSD, Angular Phishing, Baiting, Quid Pro Quo, Impersonating, Shoulder Surfing, Eavesdropping, Desk Sniffing, Dumpster Diving, Pharming, Tailgating, Credential Harvesting, Water Hole Attacking, URL Hijacking/ TypoSqating, Pretexting, Popup Windows, Reverse Social Engg, Weaponized QRCodeing, Robocalls, Deep fakes, Supply chain attacks.

      Countering social engineering attacks through solely by using technology is not an adequate solution for any organization or individual. To defend, the security approach for the human factor is to improve security through awareness and practice. At the organizational level, a methodical approach to continuously identifying, train vulnerable employees can significantly reduce cybersecurity social engineering threats. This involves continuous assessment of the workforce’s security awareness, maintaining efficient means of communication – regarding the latest threats, and attack tactics in addition to routine system updates, and the underlying appropriate security infrastructure.

      Image
      Social Engineering attack defense measures 1

      Organizations must adopt a continuous approach to people, processes, and technology with their Information security program. It necessitates a must training, awareness, and strict policy control programs that is made relevant in every aspect of the organization along with applicable technology controls and the infrastructure making it a PEOPLE, PROCESS, TECHNOLOGY aspect.

      Image

      In simple summary – employee & user awareness, multi-factor authentication, monitoring the user & entity behavior, strict identity and access controls, patching, data classification, and leak protection, and zero-trust network access(ZTNA) are a few must-have essential strategies. Organizations must implement these strategies through a proactive, continuous approach for better protection against social engineering attacks.