Semperis

The Foxconn attack didn't start with ransomware. It started with a username and a password. That's the part most post-mortems skip over. By the time encryption hits, the attacker has already spent weeks inside your identity layer — escalating privileges, identifying backup systems, staging exfiltration quietly in the background. Eight terabytes doesn't move overnight. 83% of ransomware attacks on global manufacturing organisations compromised identity infrastructure first. Not endpoints. Not perimeter. Identity. And yet, in most manufacturing environments I walk into across Southeast Asia, Active Directory gets audited once a year — if that. Meanwhile, the environment has grown through M&A, cloud migrations, IoT integrations — all quietly adding misconfiguration debt that nobody is tracking. Kerberoastable service accounts. Unconstrained delegation. ACL paths that let a standard user reset a Domain Admin's password. Attackers find these in hours. Defenders often don't know they exist. The industry keeps talking about EDR and perimeter. Both matter. But neither can see — let alone stop — an attacker who's already authenticated with a valid credential and is moving laterally through AD using legitimate admin channels. That's not a detection gap. That's an architecture blind spot. Foxconn is the latest proof. It won't be the last. If you're in manufacturing, critical infrastructure, or tech supply chain, when did you last actually look at what an attacker can see inside your identity environment? That question is worth sitting with before someone else answers it for you. https://lnkd.in/gjU7MsxN #ActiveDirectorySecurity #Ransomware #ITDR #CyberSecurity #Manufacturing

For 🆔Entra ID, recovery challenges span two very different problem spaces: security posture and advanced recovery on one side, and everyday accidental change or deletion on the other. To understand these challenges and the tools you need to address the problems they cause we need to look at how the identity threat landscape has changed over the past 15 years. 📆 Read more of my thoughts and recommended best practices on this here: https://lnkd.in/dBw2Cvjd #EntraID #Cybersecurity #Resilience #Identity #InfoSec ##BusinessContinuity #IncidentResponse #BreachRecovery #IdentitySecurity #IdentityRecovery #RiskManagement #SecurityOperations #CyberDefense #Semperis @Semperis

Hot take: RC4 disablement isn’t a problem for your migration. Your migration is the solution to RC4. Think about what you’re already doing during an AD migration or consolidation. You’re rebuilding trusts. Re-provisioning service accounts. Standing up a clean target forest. Re-keying is already part of the motion. So why would you carry RC4-only keys into the new environment? I’ve led migrations at Quest, Binary Tree, and now Semperis. The pattern I’ve seen for 20 years: teams treat “security remediation” and “migration” as two separate projects with two separate timelines and two separate budgets. They shouldn’t be. Microsoft’s enforcement timeline gives you a hard deadline. If you have a migration on the roadmap, use it as the forcing function to shed the cryptographic debt instead of lifting and shifting it. Audit your source environment for RC4 dependencies before you start syncing objects. Build AES-only as a design requirement for the target forest, not a cleanup task after go-live. The migration touch point is the cheapest, cleanest place to fix this. 🔗 Start your audit here — Guido Grillenmeier and Rich Peckham walk through the process: https://lnkd.in/ebevFn8e 🔗 Context on Microsoft’s timeline: https://lnkd.in/eXTdTxku #ActiveDirectory #ADMigration #RC4 #Kerberos #CyberResilience #Semperis

RC4 enforcement is active now. If you’re mid-migration, that’s not just an inconvenience - it’s a potential project-stopper. Here’s what most people miss: during an AD migration, you’re running two forests with cross-domain trusts, service accounts spanning both environments, and coexistence tooling that depends on Kerberos working cleanly in both directions. Now that Microsoft has defaulted to AES-only, any service account in your source domain that only carries RC4 keys won’t just fail locally. It can break authentication across the bridge - impacting users, applications, and resources you’ve already migrated or are mid-flight on. The audit that my colleagues Guido Grillenmeier and Rich Peckham walk through isn’t just a security hygiene exercise. If you’re planning a migration in 2026, it’s a pre-migration gate. You don’t want to find your RC4 dependencies the hard way - at 2am, mid-cutover, with a coexistence trust that suddenly stops working. Audit first. Migrate second. 🔗 Full walkthrough from Guido and Rich: https://lnkd.in/ebevFn8e 🔗 Original discussion: https://lnkd.in/eXTdTxku #ActiveDirectory #ADMigration #Kerberos #RC4 #IdentitySecurity #Semperis

Cyber incidents aren’t just becoming more frequent—they’re becoming more complex. Gartner's recent Innovation Insight on Cybersecurity Incident Response Management (CIRM) reinforces something many of us see every day: As impact, regulatory pressure, and cross-functional involvement increase, the way we manage incidents must evolve. Garter’s focus on primary and secondary impacts reflects a meaningful shift toward quantifying—and intentionally managing—the financial consequences of cyber events. If you know me, you know I love a good, quantified analysis. 😊 Manual processes, scattered communications, and loosely coordinated response efforts simply don’t match the scale of today’s business environment. When handling is inconsistent, the ripple effects extend well beyond the technical event into legal exposure, regulatory scrutiny, operational disruption, and reputation. Managing these cross-functional dynamics matters. Doing it well can meaningfully change the financial blast radius of an incident. What gives me optimism is this: 💡 As an industry, we’re recognizing it. 💡 We’re evolving incident response from a technical workflow to a coordinated business discipline—one that requires structure, clarity of roles, executive visibility, and measurable outcomes. The conversation is moving from “Did we respond?” to “Did we respond well—and did it reduce impact?” That shift matters. Now is the time to define what “good” looks like in our organizations—and to build toward it intentionally. You don’t have to do it all at once. Take small, manageable steps like: - Reviewing current risks and align scenario runbooks to ensure you’re spending time in the right place. - Build RACIs for core response teams to enable those responders on their individual and team responsibilities—do this ahead of a tabletop. - Start right where you are. Evaluate your current crisis management maturity. And don’t hesitate to get expert help.

An identity outage anywhere can become a business crisis everywhere. Resilience means operations can continue. And you stay in control.