Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

An overview of Role-Based Access Control (RBAC) in Sophos Central. Learn about the predefined roles for admins, how to manage role members, and the steps to create a custom role. Ask questions and get expert answers in the Sophos Community.

In Episode 5 of Corelight Defenders, I, Richard Bejtlich, engage with Corelight's co-founder and chief scientist, Vern Paxson, to delve into the intricate world of DNS covert channels. We explore how adversaries exploit DNS lookups to silently communicate within tightly controlled enterprise environments. Vern explains various methods attackers may use, from encoding data in seemingly benign domain names to manipulating the timing of requests. Our discussion highlights the challenges of detecting these covert channels, especially in the presence of network monitoring.

In Episode 4 of Corelight Defenders, I sit down with Angela Loomis, Corelight's Director of Technical Account Management, to explore her remarkable 25-year journey in cybersecurity. Angela shares her unconventional entry into the field, starting from a background in television production to becoming a leader in security strategy. We delve into the importance of curiosity in cybersecurity, discussing how diverse experiences enrich the profession, and whether formal education might dampen that curiosity.

How do you find React2Shell vulnerabilities or detect React2Shell attacks in real environments? In this video, Corelight cloud security researcher David Burkett walks through how to threat hunt React2Shell by focusing on post-exploitation behavior at the network level. Instead of relying on exploit signatures, the approach uses application baselining and network traffic analysis to identify abnormal behavior.

In today's threat landscape, a single compromised privileged session can mean the difference between routine administration and a catastrophic breach. Organizations currently have no automated way to monitor user session recordings for security threats. Teams are forced to manually sift through enormous volumes of session data – including keystrokes, commands, and screenshots, which is slow, inefficient and error-prone.