Varonis Blog

[REMOTE] Marketing Demand Gen (PPC/SEO/Content) at Varonis - https://www.varonis.com Varonis is an enterprise software company (B2B) that helps organizations better secure their data. This is perhaps not the most glitzy thing, but I really appreciate that: * The software does what it says * It's pretty unique in how it does it * Actually, genuinely useful to the people that use it daily * Helps protect basically everybody else on the internet In short, it's something I feel really good about representing and I think that makes marketing it much easier. The Inbound group is fully remote, large enough to have an actual budget for things, small enough to have some flexibility in execution and be open to new ideas. We're looking for a very hands-on person who can help increase the number of inbound leads generated by leveraging the work of the existing content and sales teams. We want to build intelligent multi-step campaigns that educate and inform prospects as the first introduction to our company, explore new campaign platforms and make smart data-driven decisions about what to pursue. I realize marketing jobs aren't usually what gets posted here, but the people who have really thrived at Varonis are both really technical (a third of the marketing team are full stack devs who moved into marketing, myself included) and adept at marketing. Our biggest wins have been when we've been able to cross those two disciplines in a unique way. If you're interested, please use the…

* "CIFS vs SMB: What's the Difference?" "CIFS, SMB, Samba, and NFS are technologies used to network client and server systems. Learn the difference between them and which to use when.": https://www.varonis.com/blog/cifs-vs-smb * "Mount Windows 11 Home Folders on WSL2 for Better Performance": https://gist.github.com/flamewave000/6958ac263e194d3f1962f517258d4c41 (gist.github.com/flamewave000/6958ac263e194d3f1962f517258d4c41)

That’s partially due to SF devs not knowing enough about the product but also due to Salesforce treating security as an afterthought. For a poorly configured implementation it takes 2 web requests as an unauthenticated user to know all of the data you can pull down and then do it. Don’t even get me started on the complete lack of monitoring. I basically had to design an entire security monitoring setup outside of Salesforce using their (absolutely awful) logs to get anything close to usable. Edit: here’s a guide someone wrote. https://www.varonis.com/blog/misconfigured-salesforce-experi... Seriously, you can automate this and then throw it at the end of recon to find SF sites. I’ve done it.

This and the privacy laws that illinois has like the Personal Information Protection act make me happy too. https://www.varonis.com/blog/illinois-privacy-law

Sounds like a lot of fun (actually)! What OS? I assume Windows? What kind of artifacts have you already discovered? DNS is a surprisingly fruitful thing to pay attention to. Some viruses will delete themselves if they detect things like Wireshark or Python are installed. I believe this is one of the big boy tools, though I haven't used it: https://www.volatilityfoundation.org/about https://www.varonis.com/blog/how-to-use-volatility looks like a fun exercise.

I wouldn't say easily over 50%. For example https://www.varonis.com/blog/inside-world-insider-threats-part-motivat… says roughly about half, and that sample might be biased as i assume its easier to take someone to court if they did it for money. Still your point stands that money is a common factor. However you still have the problem that bribes usually aren't a one time payment but an ongoing thing, so a purely financially motivated adversary would take the total value into account.

There is absolutely a technical difference, but in 2021 it has become a bit like kleenex. SMB/CIFS are used interchangeably by most folks. CIFS was the specific Microsoft implementation of the original SMB protocol. https://www.varonis.com/blog/cifs-vs-smb/

For those who don’t know: ITAR is International Traffic in Arms Regulation. https://www.varonis.com/blog/itar-compliance/

Before cryptocurrency you had to buy things from shady online pharmacies or send/fund Visa gift cards. Source: https://www.varonis.com/blog/a-brief-history-of-ransomware/ Crypto is really what's made ransomware at the scale we see it now possible.

By default, it uses objects (structured data) instead of plain strings. I'm also not extremely familiar with the concept, so at the moment, I'm reading this document to understand it better https://www.varonis.com/blog/how-to-use-powershell-objects-and-data-pi…

Another good page with stats [1] including this: $63 million in fines issued $57 million of that issued to Google [1] https://www.varonis.com/blog/gdpr-effect-review/

> Another take is that DESPITE there being a lot of 'amateurs' in the industry, the world generally seems to be humming along as normal, if not doing very well. Given that the count of software security incidents and data breaches are skyrocketing by all measures (e.g. https://www.varonis.com/blog/cybersecurity-statistics/), that's not remotely a reasonable view to take.

Group policy just sets registry keys. That's nothing you can't do any other way. The important bit is the inertia of 30 years of Windows subsystems and integration with Active Directory and 3rd party Windows ecosystem software all being written to expose internal config and look to registry keys for the settings. For the first part, Group Policy (GPO) can set the screen to lock after 2 minutes of inactivity, say, which works because there are Windows subsystems built to look for a reg key for their config, and policy templates exposing that config in the GUI management tools. Or group policy configures which security group can "logon as a service" which works because Windows has system-wide and domain-wide pervasive Access Control Lists (ACLs). GPO configures that Background Intelligent Transfer Service (BITS) should limit its bandwidth use, which works because Windows Updates use BITS. Or sets the machine-wide SSL cipher order, because Windows software uses system-wide schannel not OpenSSL. Or GPO sets what your default printer will be and that's only useful because decades of 3rd party Windows software was written to use the standard Windows printer dialog, or User Documents path, or whatever. For the second part, Active Directory is a tree-shaped organization tool; in screenshot[5] that I quickly Googled, the tree on the left has a folder named "Sydney" and below that "Sydney Users"; this lets sysadmins organise the company computer accounts, user accounts, and security…

The security of GCP rests on the security of Google. If Google gets hacked, GCP customers are not secure. Additionally: Google offers BeyondCorp products as GCP products. A big example is IAP. Do AWS and Azure offer something like IAP? If so, I think they were created in response to IAP. Another Google/GCP security product related to zero trust is Chrome Enterprise Premium: https://cloud.google.com/blog/products/identity-security/introducing-c… . Another innovative GCP security product is VPC Service Controls. Do AWS and Azure offer something like that? If so, I think they were created in response to VPC Service Controls. Security keys: I mentioned in my previous comment how they're used by consumers (that includes GCP customers). GCP is making MFA mandatory this year: https://cloud.google.com/blog/products/identity-security/mandatory-mfa… Bug bounties protect GCP customers by making sure GCP products don't have vulnerabilities. Project Zero protects GCP customers by finding vulnerabilities in products that GCP customers use (although it also finds vulnerabilities in products that AWS and Azure customers use). When Microsoft got hacked by China in 2023, China stole Microsoft's signing key, and used it to mint tokens to impersonate Azure AD users of Microsoft customers. That's relevant to security in the Cloud. GCP products are also recognized for…

I thought the same thing when I saw both names mentioned. My understanding is CIFS is an older dialect of SMB that some servers/clients can still fall back on. Here's some key text from an article on the subject [0]: > Most people, when they use either SMB or CIFS, are talking about the same exact thing. The two are interchangeable not only in a discussion but also in application – i.e., a client speaking CIFS can talk to a server speaking SMB and vice versa. Why? Because CIFS is a form of SMB. > 1.) The CIFS implementation of SMB is rarely used these days. Under the covers, most modern storage systems no longer use CIFS, they use SMB 2 or SMB 3. In the Windows world, SMB 2 has been the standard as of Windows Vista (2006) and SMB 3 is part of Windows 8 and Windows Server 2012. > 2.) CIFS has a negative connotation amongst pedants. SMB 2 and SMB 3 are massive upgrades over the CIFS dialect, and storage architects who are near and dear to file sharing protocols don’t appreciate the misnomer. It’s kind of like calling an executive assistant a secretary. [0] https://www.varonis.com/blog/cifs-vs-smb/ [1] https://blog.fosketts.net/2012/02/16/cifs-smb/ (related)