Varonis's company blog on data security, covering Windows and cloud vulnerabilities, malware, file protocols like SMB, and privacy law.
HN links it for its explainer on CIFS versus SMB, its vulnerability research on Copilot and Azure, and its pieces on privacy law.
Group policy just sets registry keys. That's nothing you can't do any other way. The important bit is the inertia of 30 years of Windows subsystems and integration with Active Directory and 3rd party Windows ecosystem software all being written to expose internal config and look to registry keys for the settings.
For the first part, Group Policy (GPO) can set the screen to lock after 2 minutes of inactivity, say, which works because there are Windows subsystems built to look for a reg key for their config, and policy templates exposing that config in the GUI management tools. Or group policy configures which security group can "logon as a service" which works because Windows has system-wide and domain-wide pervasive Access Control Lists (ACLs). GPO configures that Background Intelligent Transfer Service (BITS) should limit its bandwidth use, which works because Windows Updates use BITS. Or sets the machine-wide SSL cipher order, because Windows software uses system-wide schannel not OpenSSL. Or GPO sets what your default printer will be and that's only useful because decades of 3rd party Windows software was written to use the standard Windows printer dialog, or User Documents path, or whatever.
For the second part, Active Directory is a tree-shaped organization tool; in screenshot[5] that I quickly Googled, the tree on the left has a folder named "Sydney" and below that "Sydney Users"; this lets sysadmins organise the company computer accounts, user accounts, and security…
[REMOTE] Marketing Demand Gen (PPC/SEO/Content) at Varonis - https://www.varonis.com
Varonis is an enterprise software company (B2B) that helps organizations better secure their data.
This is perhaps not the most glitzy thing, but I really appreciate that:
* The software does what it says
* It's pretty unique in how it does it
* Actually, genuinely useful to the people that use it daily
* Helps protect basically everybody else on the internet
In short, it's something I feel really good about representing and I think that makes marketing it much easier.
The Inbound group is fully remote, large enough to have an actual budget for things, small enough to have some flexibility in execution and be open to new ideas.
We're looking for a very hands-on person who can help increase the number of inbound leads generated by leveraging the work of the existing content and sales teams. We want to build intelligent multi-step campaigns that educate and inform prospects as the first introduction to our company, explore new campaign platforms and make smart data-driven decisions about what to pursue.
I realize marketing jobs aren't usually what gets posted here, but the people who have really thrived at Varonis are both really technical (a third of the marketing team are full stack devs who moved into marketing, myself included) and adept at marketing. Our biggest wins have been when we've been able to cross those two disciplines in a unique way.
If you're interested, please use the…
The security of GCP rests on the security of Google. If Google gets hacked, GCP customers are not secure.
Additionally:
Google offers BeyondCorp products as GCP products. A big example is IAP. Do AWS and Azure offer something like IAP? If so, I think they were created in response to IAP.
Another Google/GCP security product related to zero trust is Chrome Enterprise Premium: https://cloud.google.com/blog/products/identity-security/introducing-chrome-enterprise-premium .
Another innovative GCP security product is VPC Service Controls. Do AWS and Azure offer something like that? If so, I think they were created in response to VPC Service Controls.
Security keys: I mentioned in my previous comment how they're used by consumers (that includes GCP customers). GCP is making MFA mandatory this year: https://cloud.google.com/blog/products/identity-security/mandatory-mfa-is-coming-to-google-cloud-heres-what-you-need-to-know
Bug bounties protect GCP customers by making sure GCP products don't have vulnerabilities.
Project Zero protects GCP customers by finding vulnerabilities in products that GCP customers use (although it also finds vulnerabilities in products that AWS and Azure customers use).
When Microsoft got hacked by China in 2023, China stole Microsoft's signing key, and used it to mint tokens to impersonate Azure AD users of Microsoft customers. That's relevant to security in the Cloud.
GCP products are also recognized for…
I thought the same thing when I saw both names mentioned. My understanding is CIFS is an older dialect of SMB that some servers/clients can still fall back on. Here's some key text from an article on the subject [0]:
> Most people, when they use either SMB or CIFS, are talking about the same exact thing. The two are interchangeable not only in a discussion but also in application – i.e., a client speaking CIFS can talk to a server speaking SMB and vice versa. Why? Because CIFS is a form of SMB.
> 1.) The CIFS implementation of SMB is rarely used these days. Under the covers, most modern storage systems no longer use CIFS, they use SMB 2 or SMB 3. In the Windows world, SMB 2 has been the standard as of Windows Vista (2006) and SMB 3 is part of Windows 8 and Windows Server 2012.
> 2.) CIFS has a negative connotation amongst pedants. SMB 2 and SMB 3 are massive upgrades over the CIFS dialect, and storage architects who are near and dear to file sharing protocols don’t appreciate the misnomer. It’s kind of like calling an executive assistant a secretary.
[0] https://www.varonis.com/blog/cifs-vs-smb/
[1] https://blog.fosketts.net/2012/02/16/cifs-smb/ (related)
That’s partially due to SF devs not knowing enough about the product but also due to Salesforce treating security as an afterthought. For a poorly configured implementation it takes 2 web requests as an unauthenticated user to know all of the data you can pull down and then do it. Don’t even get me started on the complete lack of monitoring. I basically had to design an entire security monitoring setup outside of Salesforce using their (absolutely awful) logs to get anything close to usable. Edit: here’s a guide someone wrote. https://www.varonis.com/blog/misconfigured-salesforce-experi... Seriously, you can automate this and then throw it at the end of recon to find SF sites. I’ve done it.
I wouldn't say easily over 50%. For example https://www.varonis.com/blog/inside-world-insider-threats-part-motivation says roughly about half, and that sample might be biased as i assume its easier to take someone to court if they did it for money.
Still your point stands that money is a common factor. However you still have the problem that bribes usually aren't a one time payment but an ongoing thing, so a purely financially motivated adversary would take the total value into account.