SECTION 9 Cyber Security

Latest Episodes:

Wazuh, Detection, and VMware Management - 240 Apr 25, 2022

Show notes

Wazuh! It works! Not only does it work, but it’s awesome. We’re also covering detection as part of a security program. You can’t have good security without detection. We’re also throwing in a bit of VMware management. Can’t manage labs in VMware without some management know how.

LINKS

1. Wazuh · The Open Source Security Platform

2. Lab Instructions - Emulation of ATT&CK techniques and detection with Wazuh

3. Sysmon config from SwiftOnSecurity

4. Wazuh Server Rules

5. Video: Installing The EDR Solution Wazuh

FIND US ON

1. Twitter - DamienHull

2. YouTube

Wazuh, Sysmon and Atomic Red Team - 239 Apr 11, 2022

Show notes

Time for more Wazuh and Sysmon. This time we’re adding Atomic Red Team for testing. This is starting to look really good. Unfortunately we’re missing something.

LINKS

1. Wazuh · The Open Source Security Platform

2. Lab Instructions - Emulation of ATT&CK techniques and detection with Wazuh

3. Sysmon config from SwiftOnSecurity

4. Wazuh Server Rules

5. Video: 163. Use Sysinternals Sysmon with Wazuh: The Swiss Army Knife for Windows Monitoring

FIND US ON

1. Twitter - DamienHull

2. YouTube

Labs, Wazuh & Sysmon, Microsoft 365 - 238 Apr 04, 2022

Show notes

We’ve packed a lot into one episode. We’re reviewing Dorothy’s lab, Wazuh & Sysmon and Microsoft 365. We do have some good news. Got Sysmon installed. We also have access to good Microsoft 365 instructions and a book. We’re moving in the right direction.

LINKS

1. Sysmon Installation

2. Microsoft 365 Business Premium Partner Playbook and Readiness Series

3. Office 365 for IT Pros

4. ITProMentor: The Microsoft 365 Consultant’s Bundle

FIND US ON

1. Twitter - DamienHull

2. YouTube

How does one get into IT? - 237 Mar 28, 2022

Show notes

There are many ways to answer this question. First, you need some skills. For this ongoing project we’ve decided to focus on Windows. Server 2019, Windows 10 and 11, and a bit of networking for good measure. One has to start somewhere.

FIND US ON

1. Twitter - DamienHull

2. YouTube

What is Microsoft Defender for Business? - 236 Mar 21, 2022

Show notes

We’re in the process of testing Microsoft Defender for Business. This includes vulnerability management, endpoint detection and response and a lot more. This could be the security solution we’ve been looking for.

LINKS

1. Overview of Microsoft Defender for Business

2. Video: Onboarding Windows 10 devices to Defender for Business

FIND US ON

1. Twitter - DamienHull

2. YouTube

Are Security Solutions 100% Perfect? - 235 Mar 14, 2022

Show notes

Of course security solutions aren’t 100% perfect. So, why are people building security programs around perfect solutions?

LINKS

1. YouTube Video: "Prevention First": An Approach to Cybersecurity w/ Minerva Labs!

FIND US ON

1. Twitter - DamienHull

2. YouTube

How do we deploy Sysmon? Part 2 - 234 Mar 07, 2022

Show notes

Time to go deeper down the Sysmon rabbit hole. Looks like Wazuh does a lot more than we thought.

LINKS

1. Sysmon

2. Wazuh

FIND US ON

1. Twitter - DamienHull

2. YouTube

How do we deploy Sysmon? Part 1 - 233 Feb 28, 2022

Show notes

Time to start thinking about our Sysmon deployment. There are a lot of moving parts to this project. It won’t be a simple install on Windows 10. That’s just a small part of the project.

LINKS

1. Security Onion

2. Getting started with Elastic Stack

3. Sysmon

4. Wazuh

FIND US ON

1. Twitter - DamienHull

2. YouTube

Mini Security Audit - 232 Feb 21, 2022

Show notes

We’re conducting a mini security audit. We’ve got our short list of things we’re doing for security. Are they working for us? Are there things we need to change? How are we doing?

LINKS

1. Security Onion

2. Getting started with Elastic Stack

3. Sysmon

4. AppLocker

FIND US ON

1. Twitter - DamienHull

2. YouTube

Application Allow List with AppLocker and Intune - Part 1 Feb 14, 2022

Show notes

It works! We have application allow listing with AppLocker. Pushed out the settings from Intune. This is awesome!

NOTE: No links to instructions for Intune and AppLocker. I need to find good documentation or write my own.