Blue Security
Subscribed: 56Played: 1,054
Subscribe
© Andy Jaw & Adam Brewer
Description
A podcast for information security defenders (blue team) on best practices, tools, and implementation for enterprise security.
250 Episodes
Reverse
SummaryIn this episode of the Blue Security Podcast, hosts Andy and Adam discuss the emerging concept of AI agents, their implications for security, and how Microsoft is integrating these technologies into their solutions. They explore the evolution of AI from simple prompt-response interactions to autonomous agents capable of making decisions and taking actions. The conversation highlights the importance of security in the development of AI technologies and introduces the Conditional Access Optimizer, a tool designed to enhance security policies within organizations.----------------------------------------------------YouTube Video Link: https://youtu.be/v45Tzw8VbiM----------------------------------------------------Documentation:https://techcommunity.microsoft.com/blog/microsoft-entra-blog/the-future-of-ai-agents%E2%80%94and-why-oauth-must-evolve/3827391https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agenthttps://www.microsoft.com/en-us/security/blog/2025/05/19/microsoft-extends-zero-trust-to-secure-the-agentic-workforce/https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-optimization----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy and Adam discuss the implications of JP Morgan's open letter to SaaS vendors, emphasizing the need for improved security practices in the software industry. They explore the challenges posed by the SaaS model, the importance of collaboration among security practitioners, and Microsoft's initiatives to enhance security. The conversation also highlights a new partnership between Microsoft and CrowdStrike aimed at standardizing threat intelligence naming conventions, showcasing the importance of teamwork in cybersecurity.----------------------------------------------------YouTube Video Link: https://youtu.be/EL0OfDiyQg0----------------------------------------------------Documentation:https://www.jpmorgan.com/technology/technology-blog/open-letter-to-our-suppliershttps://www.microsoft.com/en-us/security/blog/2025/06/02/announcing-a-new-strategic-collaboration-to-bring-clarity-to-threat-actor-naming/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy and Adam discuss the formation and function of the Cybersecurity Governance Council at Microsoft, highlighting the roles of various deputy CISOs and their focus on specific security areas. They delve into misconceptions in cybersecurity, the importance of shared responsibility, and the evolving techniques used in identity attacks. The conversation emphasizes the need for robust security measures, including fish-resistant MFA and conditional access policies, while also addressing emerging threats like device code phishing and OAuth consent phishing. The episode concludes with practical recommendations for organizations to enhance their identity security practices.----------------------------------------------------YouTube Video Link: https://youtu.be/jvDK8WNYdrQ----------------------------------------------------Documentation:https://www.microsoft.com/en-us/security/blog/2025/04/08/meet-the-deputy-cisos-who-help-shape-microsofts-approach-to-cybersecurity/https://www.microsoft.com/en-us/security/blog/2025/05/29/defending-against-evolving-identity-attack-techniques/https://techcommunity.microsoft.com/blog/microsoft-entra-blog/tls-inspection-now-in-microsoft-entra-internet-access/4395972----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy and Adam delve into the critical aspects of Windows security, focusing on the recently published Windows 11 security book. They discuss various security features, including hardware security, operating system enhancements, application security, identity protection, privacy features, and cloud services. The conversation emphasizes the evolution of Windows security, the importance of balancing security with user configurability, and the ongoing efforts by Microsoft to enhance security across its platforms.----------------------------------------------------YouTube Video Link: https://youtu.be/P6NerTxY3gA----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/windows/security/book/https://news.microsoft.com/source/features/ai/microsofts-majorana-1-chip-carves-new-path-for-quantum-computing/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy and Adam discuss various Microsoft news topics, including the upcoming end of life for Windows 10 and the options for extended security updates. They also delve into the exciting news of the Windows Subsystem for Linux becoming open source, the discontinuation of password autofill in Microsoft Authenticator, and the impactful work of Microsoft's Digital Crimes Unit in combating cyber threats.----------------------------------------------------YouTube Video Link: https://youtu.be/4hiaInM3O3I----------------------------------------------------Documentation:https://www.microsoft.com/en-us/windows/end-of-supporthttps://learn.microsoft.com/en-us/windows/whats-new/extended-security-updateshttps://www.theverge.com/news/669286/microsoft-windows-subsystem-for-linux-open-sourcehttps://support.microsoft.com/en-us/account-billing/changes-to-microsoft-authenticator-autofill-09fd75df-dc04-4477-9619-811510805ab6https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy and Adam delve into Microsoft's new feature, Security Exposure Management (XSPM). They discuss the evolution of vulnerability management, the importance of understanding exposure management, and the five phases of continuous threat exposure management. The conversation also covers licensing requirements, the functionality of the exposure management portal, and the proactive approach to cybersecurity that this new feature embodies. The hosts emphasize the need for organizations to adopt a holistic view of their security posture and to continuously assess their vulnerabilities and risks.----------------------------------------------------YouTube Video Link: https://youtu.be/fuHMhE4gRrA----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/security-exposure-management/microsoft-security-exposure-management----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer delve into the new security features of Windows 11, focusing on Administrator Protection and its implications for user privilege management. They also explore the advancements in Microsoft Sentinel, particularly the introduction of multi-tenancy and workspace management, which enhances security operations for organizations with multiple tenants. The discussion emphasizes the importance of these features in improving security and operational efficiency.----------------------------------------------------YouTube Video Link: https://youtu.be/n4IsSrLmPPc----------------------------------------------------Documentation:https://techcommunity.microsoft.com/blog/windows-itpro-blog/administrator-protection-on-windows-11/4303482https://techcommunity.microsoft.com/blog/microsoftsentinelblog/whats-new-multi-tenancy-in-the-unified-security-operations-platform-experience-i/4225658https://techcommunity.microsoft.com/blog/microsoftsentinelblog/multi-workspace-for-multi-tenant-is-now-in-public-preview-in-microsofts-unified-/4398229https://learn.microsoft.com/en-us/unified-secops-platform/mto-overview----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube: https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer discuss Microsoft's Secure Future Initiative (SFI), which aims to enhance security standards across its products and services. They delve into the implementation of mandatory multi-factor authentication, the transition to passwordless accounts, and the adoption of memory-safe programming languages. The conversation highlights the importance of user experience in security measures and the ongoing efforts to reduce vulnerabilities in software development. In this conversation, Andy Jaw and Adam Brewer discuss significant advancements in Windows security, including just-in-time admin access, the Pluton processor, and the integration of security features in Windows 11. They emphasize the importance of mandatory security practices at Microsoft, the role of Xbox in hardware security, and the need for transparency in vulnerability disclosures. The discussion also highlights the impact of security framework initiatives on employee behavior and the overall security posture of the organization.----------------------------------------------------YouTube Video Link: https://youtu.be/GctR4oEo_PI----------------------------------------------------Documentation:https://www.microsoft.com/en-us/security/blog/2025/04/17/microsofts-secure-by-design-journey-one-year-of-success/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer discuss the new Quick Recovery feature in Windows 11, which automates device remediation during critical failures. They explore its implications for cybersecurity, the Windows Resiliency Initiative, and the importance of user feedback in feature development. The conversation also covers the Hot Patch feature, which allows for security updates without requiring user reboots, and the performance of Windows on ARM devices. Finally, they delve into Copilot's new podcast generation feature, highlighting its potential to enhance user learning.----------------------------------------------------YouTube Video Link: https://youtu.be/emZcf3WvHb0----------------------------------------------------Documentation:https://techcommunity.microsoft.com/blog/windows-itpro-blog/get-started-with-quick-machine-recovery-in-windows/4398487https://techcommunity.microsoft.com/blog/windows-itpro-blog/hotpatch-for-windows-client-now-available/4399808https://www.msn.com/en-us/news/technology/copilot-can-now-turn-your-favorite-topics-into-a-virtual-podcast-that-you-can-partake-in/ar-AA1CjDld----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer discuss critical updates in cybersecurity, focusing on the funding crisis of the CVE program, concerns over government efficiency and data security, and the recent Microsoft CLFS vulnerability that led to ransomware threats. They emphasize the importance of maintaining a centralized database for vulnerability tracking and the risks associated with data handling in government agencies.----------------------------------------------------YouTube Video Link: https://youtu.be/V6kCi3H-yLY----------------------------------------------------Documentation:https://www.theverge.com/news/649835/cve-cybersecurity-program-contract-renewedhttps://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-securityhttps://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer discuss the integration of Microsoft Security Solutions with third-party security tools. They explore how organizations can leverage Microsoft Defender for Endpoint, Defender for Office, Entra, Intune, and Cloud Access Security Broker solutions to enhance their security posture. The conversation emphasizes the importance of utilizing existing tools to gain additional insights and telemetry, ensuring a more robust security framework without conflicts or performance degradation.----------------------------------------------------YouTube Video Link: https://youtu.be/kE2cVwjPzYs----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibilityhttps://learn.microsoft.com/en-us/intune/intune-service/protect/device-compliance-partners#supported-device-compliance-partnershttps://learn.microsoft.com/en-us/defender-cloud-apps/zscaler-integrationhttps://learn.microsoft.com/en-us/defender-cloud-apps/additional-integrations----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer delve into the intricacies of Microsoft's Automatic Attack Disruption feature, particularly focusing on its integration with OAuth protection. They discuss the risks associated with OAuth applications, the importance of signal correlation in detecting and mitigating attacks, and the capabilities of Microsoft's Defender XDR platform. The conversation highlights the need for organizations to configure their security settings effectively and the future direction of security practices towards a 'secure by default' approach.----------------------------------------------------YouTube Video Link: https://youtu.be/zLj5b8JFH2s----------------------------------------------------Documentation:https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/defending-against-oauth-based-attacks-with-automatic-attack-disruption/4384381https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portalhttps://learn.microsoft.com/en-us/graph/permissions-referencehttps://learn.microsoft.com/en-us/defender-xdr/configure-attack-disruption----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode, Andy and Adam discuss a significant breach of sensitive military information that was leaked through a Signal chat involving high-level government officials. They explore the implications of this breach, the role of technology in government security, and the human errors that led to the violation of established policies. The conversation delves into the cultural influences on compliance, the challenges posed by shadow IT, and the evolution of security practices in the face of modern technology. They also evaluate the security risks associated with using Signal for sensitive communications. In this conversation, Andy Jaw and Adam Brewer delve into the complexities of data security, focusing on the vulnerabilities associated with devices and applications like Signal. They discuss the importance of human factors in data security, emphasizing that even the most secure applications can be compromised through human error. The conversation transitions into organizational strategies for protecting sensitive information, highlighting the need for a positive workplace culture that encourages compliance with security protocols. The discussion concludes with reflections on the importance of adaptability in organizational security practices and the role of insider risk management.----------------------------------------------------YouTube Video Link: https://youtu.be/hLotPRhNH8s----------------------------------------------------Documentation:https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/https://www.theatlantic.com/politics/archive/2025/03/signal-group-chat-attack-plans-hegseth-goldberg/682176/https://www.npr.org/2025/03/25/nx-s1-5339801/pentagon-email-signal-vulnerability----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer delve into the intricacies of Microsoft Entra's conditional access. They explore the fundamental concepts of conditional access, its policies, and the integration of identity management with device management. The discussion highlights the importance of risk assessment, granular control, and the various conditions that can be applied to access controls. The hosts emphasize the significance of compliance policies and the interplay between different security measures to ensure robust protection against potential threats. In this conversation, Adam Brewer and Andy Jaw delve into the complexities of compliance and security in hybrid environments, focusing on access control mechanisms, session controls, and the innovative concept of authentication context. They explore the importance of ensuring devices are compliant and the various strategies organizations can implement to enhance security measures, including the use of approved client apps and continuous access evaluation. The discussion emphasizes the need for a layered security approach to protect sensitive information effectively.----------------------------------------------------YouTube Video Link: https://youtu.be/qvfEt49j2qQ----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/entra/identity/conditional-access/overviewhttps://learn.microsoft.com/en-us/sharepoint/authentication-context-examplehttps://techcommunity.microsoft.com/blog/microsoft-entra-blog/conditional-access-authentication-context-now-in-public-preview/1942484https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/enhancing-security-with-entra-pim-and-conditional-access-policy-using-authentica/4368002----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer delve into the complexities of granting secure access to third-party vendors and contractors. They discuss the best practices for managing elevated permissions, the implications of B2B collaboration, and the importance of lifecycle management for contractor accounts. The conversation also covers licensing considerations for external identities and compares access methods like Azure Bastion and Azure Virtual Desktop (AVD). In this conversation, Adam Brewer and Andy Jaw delve into the complexities of RDP security, Azure environments, and the management of contractor accounts. They discuss the inherent risks associated with RDP, the importance of mitigating these risks through proper governance and lifecycle management, and the advantages of using Azure Virtual Desktop (AVD) versus Windows 365 for contractors. The discussion emphasizes the need for a zero trust approach and the benefits of network segmentation, while also addressing licensing considerations and user management strategies.----------------------------------------------------YouTube Video Link: https://youtu.be/PQSLdNK_Yv4----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/windows-365/overviewhttps://learn.microsoft.com/en-us/azure/virtual-desktop/overviewhttps://learn.microsoft.com/en-us/entra/external-id/b2b-fundamentals----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer engage with cybersecurity architect Karl Niblock to discuss the evolution of logging practices in security information and event management (SIEM) systems. The conversation explores the shift from a 'log everything' mentality to a more strategic approach that emphasizes quality over quantity in data ingestion. Karl highlights the challenges posed by exponential data growth and the importance of customer empathy in designing effective security operations. The discussion also delves into the cost of detection, the value of high-quality logs, and the need for organizations to rethink their logging strategies to enhance threat detection and response capabilities. In this conversation, Karl discusses the intricacies of data logging in cybersecurity, emphasizing the importance of understanding the layers of data fidelity and how to effectively manage and utilize logs within Azure Sentinel. He introduces a pyramid model to categorize different types of logs based on their security value and discusses the significance of data-driven decision-making in optimizing security operations. The conversation also touches on the need for evolving data architecture to keep pace with modern threats and the practical implications of data management in security operations.----------------------------------------------------YouTube Video Link: https://youtu.be/V3KEpNIJl-o----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/azure/data-explorer/data-explorer-overviewhttps://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overviewhttps://techcommunity.microsoft.com/blog/microsoftsentinelblog/using-azure-data-explorer-for-long-term-retention-of-microsoft-sentinel-logs/1883947https://learn.microsoft.com/en-us/azure/sentinel/basic-logs-use-caseshttps://www.linkedin.com/in/karlniblock/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer engage with Ray Wolfram, Senior Product Manager for Defender Experts at Microsoft. Ray shares her extensive background in healthcare IT and cybersecurity, detailing her journey to Microsoft and the impact of COVID-19 on the cybersecurity landscape. The conversation delves into the two offerings of Defender Experts: Defender Experts for Hunting and Defender Experts for XDR, highlighting their unique features and the role of Microsoft in providing unparalleled threat intelligence. The episode emphasizes the importance of human expertise in cybersecurity and the proactive approach of Defender Experts in threat hunting and incident response. In this conversation, the speakers discuss the evolving landscape of cybersecurity, focusing on the role of threat hunters, the capabilities of Microsoft Defender Experts for XDR, and the importance of partnerships in providing comprehensive security solutions. They explore how Microsoft meets customers where they are, the onboarding process for new customers, and the integration of third-party solutions into the Defender ecosystem. The discussion also highlights the proactive nature of Defender Experts and the future roadmap for Defender for Cloud, emphasizing the need for collaboration in the cybersecurity space.----------------------------------------------------YouTube Video Link: https://youtu.be/zY9zOEFkZOc----------------------------------------------------Documentation:https://learn.microsoft.com/en-us/defender-xdr/defender-experts-for-huntinghttps://learn.microsoft.com/en-us/defender-xdr/dex-xdr-overviewhttps://www.microsoft.com/en-us/security/blog/2023/03/27/microsoft-incident-response-retainer-is-generally-available/https://www.linkedin.com/in/raaewolfram/----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer discuss the ongoing battle between governments and tech companies over encryption, focusing on Apple's recent response to the UK government's demands for access to iCloud data. They explore the implications of Apple's decision to disable advanced data protection for UK users and the broader context of encryption in cybersecurity. The conversation then shifts to the latest MITRE evaluation of endpoint protection platforms, highlighting Microsoft's performance and the challenges of the evaluation methodology. In this conversation, Andy Jaw and Adam Brewer delve into the complexities of cybersecurity, focusing on the limitations of current testing methods, the importance of realistic evaluations, and the need for a shared responsibility culture within organizations. They critique the MITRE evaluation process, discuss the shortcomings of phishing simulations, and emphasize the necessity of integrating security into the organizational culture to foster collaboration rather than hostility between security teams and users.----------------------------------------------------YouTube Video Link: https://youtu.be/TL_cu-vnu58----------------------------------------------------Documentation:https://www.theverge.com/policy/612136/uk-icloud-investigatory-powers-act-war-on-encryptionhttps://arstechnica.com/tech-policy/2025/02/apple-pulls-data-protection-tool-instead-of-caving-to-uk-demand-for-a-backdoor/https://www.microsoft.com/en-us/security/blog/2024/12/11/microsoft-defender-xdr-demonstrates-100-detection-coverage-across-all-cyberattack-stages-in-the-2024-mitre-attck-evaluations-enterprise/https://www.wsj.com/tech/cybersecurity/phishing-tests-the-bane-of-work-life-are-getting-meaner-76f30173----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
SummaryIn this episode, Andy and Adam discuss the evolution of messaging security, focusing on end-to-end encryption and the implications of RCS messaging. They explore the recent market reactions to AI developments, particularly the impact of the DeepSeek app on Nvidia's stock value and delve into the nuances of AI model efficiency and its potential effects on the tech industry. In this conversation, Adam Brewer and Andy Jaw explore the evolving landscape of AI technology, particularly in the context of US-China relations, the ethical implications of AI scraping, and the pressing concerns surrounding data privacy. They discuss the importance of building a record of work efforts, the innovative spirit that arises from constraints, and the public's perception of data security. The dialogue emphasizes the need for awareness and proactive conversations about data handling and privacy policies in an increasingly digital world.----------------------------------------------------YouTube Video Link: https://youtu.be/yicYSkuECcQ----------------------------------------------------Documentation:https://www.tomsguide.com/phones/iphones/fbi-warns-apple-and-android-users-to-avoid-rcs-messaging-heres-whyhttps://www.bbc.com/news/articles/c0qw7z2v1pgohttps://techcrunch.com/2025/01/29/microsoft-probing-whether-deepseek-improperly-used-openais-api/https://www.fastcompany.com/91267968/how-the-biden-chip-bans-created-a-monster-called-deepseekhttps://lifehacker.com/tech/how-to-try-deepseek-ai-and-why-you-might-not-want-to----------------------------------------------------Contact Us:Website: https://bluesecuritypod.comBluesky: https://bsky.app/profile/bluesecuritypod.comLinkedIn: https://www.linkedin.com/company/bluesecpodYouTube:https://www.youtube.com/c/BlueSecurityPodcast-----------------------------------------------------------Andy JawBluesky: https://bsky.app/profile/ajawzero.comLinkedIn: https://www.linkedin.com/in/andyjaw/Email: andy@bluesecuritypod.com----------------------------------------------------Adam BrewerTwitter: https://twitter.com/ajbrewerLinkedIn: https://www.linkedin.com/in/adamjbrewer/Email: adam@bluesecuritypod.com
Summary
In this episode of the Blue Security Podcast, hosts Andy Jaw and Adam Brewer discuss the importance of securing CI/CD environments, highlighting the risks associated with these systems and the best practices for mitigating vulnerabilities. They delve into specific threats, including insecure code and supply chain compromises, and emphasize the need for a collaborative approach between security professionals and developers to ensure secure software development practices.
----------------------------------------------------
YouTube Video Link: https://youtu.be/zQwFAN6PHrE
----------------------------------------------------
Documentation:
https://www.cisa.gov/news-events/alerts/2023/06/28/cisa-and-nsa-release-joint-guidance-defending-continuous-integrationcontinuous-delivery-cicd
https://owasp.org/www-project-top-10-ci-cd-security-risks/
----------------------------------------------------
Contact Us:
Website: https://bluesecuritypod.com
Bluesky: https://bsky.app/profile/bluesecuritypod.com
LinkedIn: https://www.linkedin.com/company/bluesecpod
YouTube:
https://www.youtube.com/c/BlueSecurityPodcast
-----------------------------------------------------------
Andy Jaw
Bluesky: https://bsky.app/profile/ajawzero.com
LinkedIn: https://www.linkedin.com/in/andyjaw/
Email: andy@bluesecuritypod.com
----------------------------------------------------
Adam Brewer
Twitter: https://twitter.com/ajbrewer
LinkedIn: https://www.linkedin.com/in/adamjbrewer/
Email: adam@bluesecuritypod.com
Download from Google Play
Download from App Store
United States
SRD grant application online via the SASSA SRD website. By entering their ID number and cellphone number, applicants can view the status of their application as https://srdsassacheck.org.za/ , including whether it has been approved or rejected. If rejected, reasons are provided, and applicants have the right to appeal through a formal reconsideration process.