Devang

Tales from the trenches: Real life assume breach of a cloud-only org *No on-prem Active Directory domain. 90% fully remote company. Started from a Mac with an account to login to the Mac and a cloud-only account. I ended up getting access to their production containers deployment management plane. I could run commands as root on thousands of containers. Not only that…. I found numerous ssh keys in their cloud-only document repositories. I found credential in their ticketing platform. I found credentials in slack. I even found conversations where they were talking about the pentest. 😅 Cloud only is not without its challenges. Active Directory is also not without its challenges. Both have their advantages. Both require hard work and effort to maintain and secure. This idea that “pentesters get domain admin too easily in Active Directory therefore it’s insecure” just doesn’t fly with me. Cloud-only orgs can be just as “insecure.” This organization by the way, you would for sure recognize the name if I told you.

Secure defaults in Entra is great. It’s a net benefit for orgs who don’t know any better or are just spinning up tenants. Thats exactly the orgs it’s made for and that’s fine. Microsoft has done a great thing by offering this. It’s helped mitigate password spraying and credential stuffing attacks. But there is more to do to secure an Entra tenant. We can’t let the conversation stop there.