Final Connect @finalconnect

I am the Chief Information Officer of a global enterprise. Last quarter, I eliminated MFA. Multi-factor authentication. The thing where you need two things to log in instead of one. It created friction. Employees complained. "Why do I need a code from my phone?" "This slows me down." "I forgot my authenticator app." I listened. That's leadership. I told the board: "We're removing barriers to productivity. Empowering our workforce. Choosing agility over friction." They promoted me on the spot. The CISO wept, no one likes him anyway.  Our CISO is a Debby Downer. Our file-sharing portal now requires one thing: a password. Passwords are secure. People choose strong ones. They definitely don't reuse them across every website they've ever visited. That's just common sense. Last week, a criminal named Zestix stole our data. Also 49 other companies. Fifty organizations. One guy. One method: log in with stolen passwords. No exploits. No zero-days. No sophisticated nation-state attack. Just... passwords. The passwords came from infostealer malware. Employees downloaded infected files. The malware grabbed their saved credentials. Some of those credentials had been sitting in criminal databases for years. We didn't rotate them. Password rotation creates friction. Zestix targeted our ShareFile portal. The one with all our sensitive documents. Engineering data for three major utilities. He's selling that for $585,000. Military robotics intellectual property from an aerospace company. 2.3 terabytes of Brazilian Military Police health records. Active legal strategies from a law firm representing Mercedes-Benz. Technical safety data from Spain's largest airline. SCADA drawings and GPS coordinates of control rooms for a rail company. Fifty organizations. No MFA. Hudson Rock, the security firm that tracked this, wrote: "The attacker walks right in through the front door. No exploits, no cookies – just a password." I prefer to frame it differently. The attacker was welcomed in through an optimized authentication experience. We trusted our employees. We trusted our partners. We trusted that everyone uses unique, complex passwords that they never share or reuse. That's culture. Some people will say we should have enabled MFA. Those people don't understand velocity. Some people will say we should rotate credentials. Those people haven't seen our Q4 productivity metrics. Some people will say Zestix is a criminal. I prefer "external penetration testing consultant we didn't hire." The data is now on the dark web. Our security team is investigating. Our legal team is drafting statements. Our HR team is preparing the employee communication. Subject line: "Protecting What Matters: Our Commitment to Your Data." We're also launching a mandatory cybersecurity training. Module 1: "Why Passwords Are Your First Line of Defense." Module 2: "Recognizing Phishing Emails." Module 3: "The Importance of Multi-Factor Authentication." That last module is new. We're requiring it for all employees. The training, I mean. Not the MFA. MFA still creates friction.

Work smarter with Microsoft 365 Copilot. Take a look at the prompting formula we recommend to our customers to get the most effective and accurate answers when using #Copilot. dmc.partner.microsoft.com/links/14821eb7…

Work smarter with Microsoft 365 Copilot. Take a look at the prompting formula we recommend to our customers to get the most effective and accurate answers when using #Copilot. dmc.partner.microsoft.com/links/ae6f1256…

🛑 Attention to this, I searched for "rvtools download" in Microsoft #Bing and Microsoft #Copilot itself recommended the rvtools[.]org site (x.com/tsnikle/status…) which leads to the Bumblebee download (+signed) 🤦‍♂️ As we have said many times, DO NOT BLINDLY TRUST the ads/suggestions of any page, search engine or AI, be careful where you click, investigate, confirm. ⚠️ REF: cyjax.com/resources/blog…

MalwareHunterTeam @malwrhunterteam

a year ago

Some people (even some "big name" sites) are shouting in recent days that the official RVTools sites got pwned and spreading BumbleBee. Meanwhile in reality it seems there is nothing else than the usual fake sites in Google & etc spreading shit. RVTools, WinMTR, Zenmap... 🤷‍♂️

keyboard_arrow_left Previous keyboard_arrow_right Next

1 7 31 21K 4

Let's hope it can actually do something when we need it

BleepingComputer @BleepinComputer

a year ago

Microsoft tests new Windows 11 tool to remotely fix boot crashes - @LawrenceAbrams bleepingcomputer.com/news/microsoft… bleepingcomputer.com/news/microsoft…

4 32 127 20K 31

@ThomasSowell They cannot afford California. They cannot afford Greenland.

@UnitedHealthGrp and @UHC - why are you being so difficult with approvals in 2025. I have employees and family members getting denials on medical procedures. Then when we call, you blame "Evicore" but wait UHC is the provider. So STOP hiding behind Evicore and their crappy AI to reject procedures. AND preapprovals from 2024 are not being carried over because YOU changed the plan not us.

@FinanceLancelot No way. You haven't followed the election there. People somehow don't equate these things to politics.

@YahooFinance It was sure easy to move all that away from the US, but it is such a "challenge" to bring it back.

Heads up: Microsoft Office, like many companies in recent months, has slyly turned on an “opt-out” feature that scrapes your Word and Excel documents to train its internal AI systems. This setting is turned on by default, and you have to manually uncheck a box in order to opt out. If you are a writer who uses MS Word to write any proprietary content (blog posts, novels, or any work you intend to protect with copyright and/or sell), you’re going to want to turn this feature off immediately.

@DecryptedTech @binarymoovs Same here!

Microsoft warns that some Windows systems are entering reboot loops or might freeze with blue screens after installing the Windows 11 KB5043145 preview update. bleepingcomputer.com/news/microsoft…

@RachelTobac Much appreciated!

@QuickBooks unfortunately, we have a legal requirement to pay employees on time and in a compliant way. What can you do to help us and clients make their payroll?

@Intuit @tsheets @QuickBooks Why can't you get customer's access to Quickbooks online payroll during a payroll cycle. INV-111536 (investigation) is going on 24-hours. In case your overseas support is not aware, it is Federal and State law to pay employees on time - fix it

@thekitze Going back old school!

Great idea, but how do they enforce it? bit.ly/3ArbrM3

Microsoft removed the FAT32 size limit in the latest Windows 11 preview build and increased the maximum partition size from 32GB to 2TB. bleepingcomputer.com/news/microsoft…

US dismantles laptop farm used by undercover North Korean IT workers - @serghei bleepingcomputer.com/news/security/… bleepingcomputer.com/news/security/…

😂