VeeamON 2024 - Use Code "COMMUNITY10" for 10% Off!
Recently, I had the privilege to attend a three-day Veeam Availability Suite: Configuration and Management (VMCE) course provided by Veeam from on the 7th - 9th December, 2022. Veeam Technical Education Services offers two industry certifications which are as follows “Veeam Certified Engineer (VMCE)” and the “Veeam Certified Architect (VMCA)“.Please check out the blogpost for a comprehensive information on this topic.After completion of the course, you will be able to effectively install, configure and manage Veeam Availability Suite. Thus, the knowledge gained will be evident in your practical and production environment. Some individuals made this course possible for me. Special thanks to Veeam Community Leadership: @Rick Vanover @Madi.Cristil @safiya, and @NikolaPejkova. Also, special thanks to these folks @haslund and @Federica. Veeam Backup & Replication v11 brings balance to your data protection objectives with a 4-in-1 solution, combining storage snapshots, backup, replicatio
Hey guys, Are you interested in learning about API Security Fundamentals? If yes, please sign up using this link: https://www.apisecuniversity.com/courses/api-security-fundamentals Course outline: The API Security Fundamentals course covers the following areasCore threats to APIs and challenges to prevent breach. OWASP API Security Top 10, Examine how real-world API attacks have succeeded and understand the 3 Pillars of API Security.Note: The course is self-paced, and takes about 90 minutes and includes a certification.
Recently, I have noticed on this platform that most of us work with Windows Server 2016, 2019, and now 2022. Also even Windows 10. In this guide, I will be showing you how to update the Windows installation image (install.wim) file with the latest security intelligence package available. I have successfully tested this on Windows 10 Enterprise, Pro und Home-Edition and Windows Server 2016 and 2019. Here is a detailed guide on "how to install ADK, MDT, and WDS: How to deploy Windows images via Microsoft Deployment Toolkit and Windows Deployment Services".How do you provision your new servers? Regardless of how this is done, you may also find this guide useful.Microsoft Defender Antivirus, formerly known as Windows Defender, is an antivirus protection program that’s included with Windows 10. Unlike other antivirus programs like McAfee, Microsoft Defender is free and doesn’t require any additional installation. After the installation of Windows 10, the built-in version of Microsoft Defend
It is being found that the official app used in installing SteelSeries devices on Windows 10 can be exploited to grant Admin rights as discovered by some security research “Lawrence Amer“. As stated by BleepingComputers, the bug can be leveraged during the device startup process using a link in the License Agreement screen that is opened with SYSTEM privileges. A real SteelSeries device is not necessary to exploit the bug. Also, a bug was discovered in the Razer Synapse software that granted unauthorised admin access. Now, a similar bug was found in SteelSeries software that gives anyone who plugs in a device complete control over a Windows 10 PC with admin rights. Emulating a device also works: This discovery became known after news broke out about the Razer Synapse software as it was able to grant administrative privileges when connecting a Razer mouse or keyboard. This motivated the research from Jorhat, offensive security researcher Lawrence Amer (research team leader at 0xsp) foun
For those of use that have won the “Nike Air Force 1 shoes”. Kindly endeavour to share on your Twitter and Facebook, and Reddit (sub-reddit) platforms. https://www.reddit.com/r/TDArchive/comments/sdb0id/my_nike_air_force_1_shoes/ (Unfortunately, Reddit yanked my old community off.. Here is a new one and I have no time yet to grow it). https://www.facebook.com/TechDarchive/photos/a.135315758105436/487508049552870/ https://www.instagram.com/p/CZM4fhaI_mN/There is a flyer in the pack to this effect! You can find some of the other winners in the link below.
VMware Tools is a set of services and modules that enable several features in VMware products for better management of guests operating systems and seamless user interactions with them. Without VMware Tools installed in your guest operating system, the guest OS will lose some performance functionalities.Impacted Product: VMware Tools for WindowsVmware has released some updates to remediate this vulnerability. The VMware tool can be directly downloaded from the VMware Customer Connect page. Do ensure to select your desired version. It can also be downloaded directly from the VMware Workstation etc.Issue descriptionVMware Tools for Windows contains an XML External Entity (XXE) vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.8.How can this vulnerability be exploited?A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit th
Amazon Virtual Private Cloud (Amazon VPC) allows you to deploy AWS resources within a logically isolated virtual network that you create. This virtual network mirrors the structure of a conventional network found in your own data centre while leveraging the scalable infrastructure provided by AWS. If you would like to follow this process, kindly use these steps to create your AWS account. BTW, Why You Should Create Your Own VPC?Creating your own virtual private cloud (VPC) offers numerous advantages. This allows you to design a networking architecture that aligns with your organisation’s requirements. You can define subnets, configure route tables, and implement various network configurations to optimise performance, reliability, and data flow within your virtual network.Note: You can delete the default subnet or default VPC just as you can delete any other subnet or VPC. However, if you delete your default subnets or default VPC, you must explicitly specify a subnet in one of your VPC
In this article, I will be sharing a script that will enable you query the BitLocker recovery key from the MBAM reporting services. I have written a guide on how to query MBAM to display the report for BitLocker Recovery for a specified period of time. In this way, you will be able to save the report as a CSV file that we will later query in order to determine the number of times, a devices has been recovered via the MBAM help-desk or Self-service recovery. If you would like to set up an Microsoft BitLocker Administration and Monitoring, please see this this link.Upon downloading the BitLocker Recovery CSV file, kindly save it in your desired location. You can also configure the reporting servces to automatically save this report for you. Here is a guide on how to go about this “MBAM reports automatic E-mail notification: How to create MBAM Enterprise and Compliance, and Recovery Audit reports”. The process is similarand you just have to change the destination (delivery method).When th
Found these resources useful- This will also help you determine what focus in cybersecurity to take before investing a lot of money and time. These courses are perfect for helping you break into cybersecurity 👇 👇 👇 👇 👇 1. Introduction to Cyber Attacks at NYU https://lnkd.in/gK-muH_k2. Cryptography I at Stanford https://lnkd.in/gTEN6GNP 3. Hardware Security at University of Maryland https://lnkd.in/g7Neqed84. Network and Security Foundations at Western Governors University https://lnkd.in/gmMgXJvB5. Internet History, Technology, and Security at University of Michigan https://lnkd.in/gSKimTrY6. Network and Computer Security at MIT https://lnkd.in/g7BakrPS7. Computer Networks at MIT https://lnkd.in/gb_WbFcx 8. System Issues in Cloud Computing Specialization at Georgia Tech https://lnkd.in/gg5A8Kw49. Cybersecurity Management at Charles Sturt University https://lnkd.in/gE37ZdnW10. Certified Information Systems Security Professional at Charles Sturt University https://lnkd.in/gz6xTr4b11
I am sure someone else will find this blog post very useful. I have been doing extensive research since I created this blog post below. So I purchased Beelink EQ12 3x recently. Beelink EQ12 mini PC since it has an Intel 12th Alder Lake-N100 processor (4C/4T, up to 3.4GHz, 25W TDP), delivers 25% more power than N5105. The low power consumption makes this mini-computer great for light work, 4K video playback etc. At this time, this Mini PC costs 329.00, and there is a promotional voucher of 45 euros. So it will be about 284 euros. Other Additions- Got a TP-Link TL-SG108E 8-Port Gigabit Switch (Plug and Play, Gigabit Ports, VLAN, QoS)- A Synology 923+ [I got this due to my Veeam Legend and vExpert status]. Here is a post on how to set up DS923+, and many more to come. The next would be on how to protect DS923+.- Wyebot wireless intelligence (To be reviewed as well)- I'm considering purchasing a NGFW appliance and would appreciate your insight. Today, I completed these blog posts based o
In this article, we will learn how to Migrate Veeam Configuration Database to PostgreSQL Server. I am sure you already know what PostgreSQL is. So let me not bore you with this information as some of our peers have already discussed this topic. By default, PostgreSQL is used with all new installs of Veeam Backup & Replication 12. Existing Veeam Backup & Replication deployments that were upgraded from 11a or older will continue to use Microsoft SQL Server until they are manually migrated to PostgreSQL Why switch to PostgreSQL?Migrating Veeam Backup and Replication from Microsoft SQL Server (MSSQL) to PostgreSQL is driven by various reasons. Below are some common reasons to consider such a migrationCost saving: If you prioritize cost savings, choosing PostgreSQL for your database needs is an excellent option. It is an open-source database engine that is completely free to use, even for commercial purposes, under the PostgreSQL license.Mitigate Vendor Lockin: Migrating to Po
Veeam Backup & Replication utilises a NAS-Based Repository to store backup files, VM copies, and metadata for replicated VMs. File-sharing protocols like SMB or NFS enable users to access files and directories on a computer, server, or virtual machine via the network by configuring a directory as a file share. Any operating system supporting these protocols can host a file share.The DS923+ serves as an ideal solution for storing backups on your Synology system, particularly for organisations utilising third-party backup software like Veeam Backup and Replication. It provides a perfect repository for business/mission-critical data and backups in both company environments and home labs. You may want to learn how to Step-by-step guide on how to set up the Synology DS923+ NAS, and How to Protect Synology DS923+ NAS, and then proceed in setting up Synology NAS as a Backup Repo.DS923+ as a Backup TargetThe Synology 923+ NAS systems as mentioned above are a reliable storage destinations f
There are two critical CVEs that affect Veeam Backup & Replication and account for two of the three critical Veeam Backup & Replication CVEs, and the most serious of the products affected. The Critical Veeam Backup & Replication vulnerability notes include: CVE-2022-26500 | CVE-2022-26501CVE-2022-26500, CVE–2022-26501: These two CVEs relate to Veeam Backup & Replication allow executing malicious code remotely without authentication. This may lead to gaining control over the target system. This carries a CVSS rating of 9.8 and is classified as Critical.Cause? – The vulnerability is caused by the Veeam Distribution Service, running on TCP 9380 by default, allows unauthenticated users to access internal Veeam API functions. An attacker may send input to the Veeam API which may allow uploading and executing malicious code.It is worth nothing that patches are available for Veeam 11a and 10a as follow11a – Build 11.0.1.1261 P20220302: https://www.veeam.com/kb4245?ad=in-text-l
Some Security practitioners are familiar with the terms “due care” and “due diligence”. Everyone assumes to know what they mean in literal terms. But then, these terms are distinct and can be challenging to comprehend. Before diving into the topic further, Due care is an organization’s reasonable effort to protect system assets and/or people. A good way to think of this is “Do Correct” while Due diligence is an organization’s ongoing effort to ensure assets and/or personnel remain protected which involves prior planning. A good way to think of this is “Do Maintain”. Why should these terms be taken seriously? Due diligence and Due care are often used interchangeably. In the cybersecurity context, both aim in protecting the organization’s critical IT systems and data. But, these terms are different from each other. With an emphasis on various studies online, 82% of breaches are attributed to humans and this composes of various attack techniques such as social engineering etc. This is no
Hey Guys, I would like to draw your attention to this event “AWS Dev Day Security 2023” happening tomorrow and next from 09:00 AM to 13:00 PM CET.AWS Dev Day Security Edition will focus on the latest developments in cloud security, identity and compliance.If you are a software engineer, security engineer, cloud and solution architect, and DevOps engineer involved in designing and implementing scalable, secure, resilient applications in the cloud, and that are keen on gaining deeper knowledge of the security and governance topics handled with the help of AWS services. Then, this event is for you. Kindly register via the links below to get acquainted with the latest in AWS security and learn how to implement them yourself during the various demonstration planned out.https://aws-experience.com/emea/dach-cee/e/203bd/aws-security-devdays-2023---day-1 https://aws-experience.com/emea/dach-cee/e/58d2b/aws-security-devdays-2023---day-2
Security researchers discovered vulnerabilities in the fingerprint sensors of some Windows PCs that could be exploited to bypass Windows Hello's biometric fingerprint login. The affected sensors, manufactured by Elan, Googix, and Synaptics, all use a match-on-chip (MoC) design, where the biometric test occurs within a shielded microprocessor on the chip itself. Kindly refer to the YouTube video for more information as demonstrated at the BlueHat conference in October 2023 by the security researchers.Note: The Secure Device Connection Protocol (SDCP) protection mechanism has been implemented by Microsoft to prevent unauthorized access. Therefore, the researchers suggest that fingerprint sensor manufacturers enable SDCP and undergo third-party security audits for their implementations. But it remains unclear whether the identified security issues can be entirely addressed through software updates.
Norton LifeLock parent company Gen Digital says that hackers likely used a credential stuffing attack to compromise customers’ password managers. The breach began as early as December 1, 2022, although Gen Digital did not detect the issue until they became aware of a large volume of failed login attempts around December 12. The company has sent notifications to roughly 6,500 individuals whose accounts were compromised. For some reason, I have never used and not comfortable using Norton Password Manager. By the way, these Password managers have been breached (LastPass, Okta, and now Norton Password Manager). Which is next?! Bit^**den :-)
Git has released a new verson to address some security vulnerabilities, As reported, we are aware that GitHub is affected. But there is a need to upgrade your local installation of Git, especifially when you are using Git on Windows or on multi-user machines. All credit goes to to 俞晨东, and the fix was authored by Johannes Schindelin. CVE-2022-24765As stated in this article, this vulnerability affects multi-user machines, Git users might find themselves unexpectedly in a Git worktree, e.g. when another user created a repository in C:\.git, in a mounted network drive or in a scratch space. Merely having a Git-aware prompt that runs git status (or git diff) and navigate to a directory that is supposedly not a Git worktree, or open such a directory in an editor or IDE such as VS Code or Atom, which will potentially run commands defined by that other user. Vulnerability ImpactSince part of Git for Windows’ uninstaller is copied into the current user’s temporary directory and run in that pla
Remote Defender Credential Guide was introduced in Windows 10 version 1607 to be precise and helps protect your credentials over a Remote Desktop connection by redirecting Kerberos requests back to the device that's requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions. You may want to learn about how to enable or disable Memory integrity in windows, reputation based protection, and how to enable or disable Windows Defender Credential Guard I wrote yesterday :-). Please refer to the original guide, I will do my best to limit internal links from my website that are vital. You will agree with me that highly privileged Administrators' credentials are very critical and must be adequately and correctly protected. Note: Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server. How does Windows Defender Remote Credential Guard compare to Restricted Admin and Remote
Recently, Lionel Gilles, a French-based Offensive Computer Security researcher based in Paris, France published a PoC tool on NTLM Relay Attack known as PetitPotam that exploits the MS-EFSRPC (Encrypting File Services Remote Protocol). PetitPotam is a classic NTLM Relay Attack, and such attacks have been previously documented by Microsoft along with numerous mitigation options to protect users. Here is an example of such documents: NT LAN Manager: How to prevent NTLM credentials from being sent to remote servers. Below are some related guides: Active Directory Authentication methods: How do Kerberos and NTLM work? how does cached domain logon work?, and What is Pass the Hash Attack and how to mitigate the attack. PetitPotam takes advantage of servers where the Active Directory Certificate Services (AD CS) is not configured with protections for NTLM Relay Attacks. The mitigations below outline to customers how to protect their AD CS servers from such attacks and help in mitigating the W
VMware vCenter Server is advanced server management software that provides a centralised platform for controlling your VMware vSphere environments, allowing you to automate and deliver a virtual infrastructure across the hybrid cloud with confidence.This privilege escalation vulnerability in VMware Center Server was reported to VMware by Yaron Zinar and Sagi Sheinfeld of Crowdstrike for reporting.Present IssueThe vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1. Impacted ProductsThe following products are impacted. Workarounds are available to remediate this vulnerability in the affected VMware products.VMware vCenter Server (vCenter Server) VMware Cloud Foundation (Cloud Foundation).Known Attack VectorsA malicious actor with non-administrative access to vCenter Server may expl
The following disclosure vulnerability (CVE-2022-22948) was reported to VMware by Yuval Lazar (@Ul7raVi0l3t) of Pentera. To remediate this vulnerability, apply the patch in the response matrix below as it applies to you. The vCenter Server contains an information disclosure vulnerability due to improper permission of files. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.5.Below are the affected productsVMware vCenter Server (vCenter Server) VMware Cloud Foundation (Cloud Foundation)An information disclosure vulnerability in VMware vCenter Server was privately reported to VMware. Updates are available to remediate this vulnerability in affected VMware products.Known Attack VectorsA malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.ResolutionTo remediate CVE-2022-22948 apply the patches listed in the 'Fixed Version' column of the 'R
Microsoft 365 formerly referred to as Office 365 is a SaaS application that provides productivity and collaboration through a diverse set of micro-services and applications such as Exchange Online, SharePoint Online, Skype for Business Online, Microsoft Teams, Exchange Online Protection, Office in a browser, and many others. Microsoft recently made a distinction between M365 and O365. Therefore, M365 is a bundle of services that includes O365, and many other services as mentioned previously. I will be discussing these details in a subsequent guide. Here are some related guides that might interest you: How to Cancel Office 365 Family Subscription, how to complete Microsoft Office 365 Family Subscription, how to install Microsoft Teams on a Mac PC, and how to install and activate Office 2019 on your Mac PC.As of today, data is the most critical resources and one of the most valuable currency in the world. In Cyber Security, we refer to data as the New Oil. This Forbes link will highlight
Object First is an enterprise-grade object storage appliance designed specifically for Veeam Backup and Replication. It provides a fast, ransomware-proof storage that is easy to deploy and manage.Before diving into this setup and connection methods fully, I would like to seize this opportunity to appreciate @Geoff Burke and Object First for the opportunity to test a 128TB-Object First Storage. Since my hardware developed some issues and will be replaced, I have decided to discuss how to access Object First (OOTBI) remotely. This is because the IPMI technology is crucial for IT administrators to access and manage servers, such as OOTBI remotely. Why should you choose OOTBI by Object First?Object First acknowledges the persistence and landscape of ransomware attacks targeting businesses. This is where OOTBI comes in and stands out with its out-of-the-box immutability, rendering backup data impenetrable to attacks.OOTBI, designed around Zero Trust and Data Security Principles, integrates
For some of you that would like to manage K8, but not very confident working from the command line may want to see how Portainer works. What is Portainer? Portainer is a self-service container service delivery platform. It is the definitive container management GUI for Kubernetes, Docker and Swarm.Here is a link on how to install on Linux and create a container: https://techdirectarchive.com/2022/07/24/how-to-install-docker-portainer-on-linux/
Already have an account? Login
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.
Sorry, our virus scanner detected that this file isn't safe to download.
