In this post, we continue our discussion of use cases involving account take over and credential access in enterprise data sets. In the first part of this series, we introduced the definition of a VIP account as any account that has privileged or root level access to systems/services. These VIP accounts are important to monitor for changes in behavior, particularly because they have critical access to key parts of the enterprise.

Organizations of all sizes are currently under siege by adversaries with unlimited time and enough technical skill to exploit the cracks in our information systems and networks. All organizations have something to protect, whether large or small, and they are always looking for new technology to help against these adversaries. Zero Trust has become the latest framework to solve all of our security woes.

You're probably familiar with the defense-in-depth or castle and moat approach to cybersecurity. It remains a common model that organizations use to think through their information security. However, as organizations have matured they have sought out new models to enable them to better understand how cyber attackers operate and how best to defend against them.

Network/Security Operations Center (NOC/SOC) engineers and service desk personnel are tasked to process numerous incidents as quickly as possible. However, to resolve an incident they are required to to perform various activities including collecting various operations data including metrics, logs, traces and more from different tools. In many cases, the process also involves coordinating with other IT personnel or creating a war room to bring the incident to closure.

The crown Jewels, part of the Royal Collection, are the most powerful symbols of the British Monarchy. They are housed in the ‘Jewel House’, vault at the Tower of London. Ever since attempts have been made to steal the crown jewels their security has been tightened. Conventional methods to protect the crown jewels are not sophisticated enough to stop the highly motivated adversarial threats. Let’s take a closer look at how these jewels are protected.

Webhooks run a large portion of the "magic" that happens between applications. They are sometimes called reverse APIs, callbacks, and even notifications. Many services, such as SendGrid, Stripe, Slack, and GitHub use events to send webhooks as part of their API. This allows your application to listen for events and perform actions when they happen. In a previous article, we looked at how to consume webhooks with Node.js and Express.