Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In August, I shared a blog on my most recent research project called Windows Downdate, which I first presented at Black Hat USA 2024 and DEF CON 32 (2024). In it, I explained how I was able to develop a tool to take over the Windows Update process to craft custom downgrades on critical OS components to expose previously fixed vulnerabilities. By using this downgrade ability, I discovered CVE-2024-21302, a privilege escalation vulnerability affecting the entire Windows virtualization stack.

Cyberattacks are getting more sophisticated and frequent. Malicious attackers take advantage of vulnerabilities in security systems, resulting in data breaches, ransomware, and downtime. Tools like EDR and NDR are usually used separately, which may not give the complete effectiveness one is looking for. Whereas Extended Detection and Response (XDR) is a solution that unifies all security data, giving you better insight and quicker threat detection.

The DNS involves resolving client’s queries with multiple hosts across different regions. Multiple servers help many organizations by increasing response rate and network efficiency for clients. But, some organizations have special demands that require a specific server to resolve queries for a particular domain name. DDI Central can solve this problem with its domain view feature.

When security information and event management (SIEM) tools came to the market over a decade ago, many practitioners considered the combination of information management and event management groundbreaking. Since then, the technology has gone through iterations to improve and enhance its capabilities, including the incorporation of user and entity behavior analytics (UEBA), machine learning and AI capabilities, and “out-of-the-box” configurations for smaller organizations to rely on.