The Gap Where the Provider’s Responsibility Ends

November 3, 2022July 28, 2026 ~ Ulv Bjørnsson ~ 5 Comments

Cybersecurity is a significant challenge in the cloud environment with the rapidly evolving threat landscape. Furthermore, with more businesses adopting cloud computing and its amalgamation with emerging technologies, the challenges have increased correspondingly. Hence, the focus should be on identifying these next-gen cybersecurity challenges and preparing to overcome them.

Cloud computing has improved IT efficiency, flexibility, and scalability. However, all these features have one common challenge, security. The problem with cloud computing cybersecurity is that organizations must correctly distinguish where the CSP’s (Cloud Service Provider) responsibility ends and theirs begins. This gap increases the organization’s potential attack surface and enables malicious actors to infiltrate information systems. This article discusses next-gen challenges and risks and looks at how organizations can prepare themselves to overcome them to keep critical information assets’ confidentiality, integrity, and availability intact.

Continue reading →

Smart Cities Need Their Own Security Model

August 18, 2022July 28, 2026 ~ Ulv Bjørnsson ~ Leave a comment

Smart cities have become a reality today, with governments, businesses, and residents, making use of advanced technology to increase productivity and efficiency at home and the workplace and make lives better. However, the challenges to ensuring safety, security, and data privacy have risen proportionately, leading to the requirement for a unique cybersecurity model for smart cities.

A city using advanced technology infrastructure and other cutting-edge solutions to improve its operational efficiency, provide better services, and improve the lives of its citizens qualifies as a smart city. The technology ecosystem often consists of ICT (Information and communication technology), IoT (Internet of Things), AI/ML (Artificial Intelligence/Machine Learning), Blockchain, Cloud computing, etc. However, using the latest technologies has its challenges of cybersecurity risks, compromising the confidentiality, integrity, and availability of PII (Personally Identifiable Information) of its citizens. Below is a closer look into cybersecurity risks in smart cities, their challenges, the threats they are exposed to, and the potential solutions to overcome such hurdles.

Continue reading →

Azure Governance Never Finishes

September 3, 2019July 25, 2026 ~ Ulv Bjørnsson ~ Leave a comment

In this blog post, we will discuss the management and operational principles which underpin enterprise governance in Azure which is a necessity for successful cloud adoption and one of the first rails to enable a culture that facilitates digital innovation.

The core components of Azure management are the challenges of Enterprise Cloud Adoption and the components which make up the full set of governance capabilities in Microsoft Azure.

The Azure governance principles are a continuum of tasks, projects and initiatives, therein you build natively in Cloud and also migrate workloads into Azure, securing and protecting those workloads so that they are robust and resilient. You then proceed to monitoring these workloads, so that you can pick up any problems and ensure that they are consuming resources in a manner which is both performant and cost-effective.

Next, you invest in automated configuration to ensure that any changes to your workloads are holistic but also auditable and immutable. Governance ensures that your workloads and the platform on which they run are compliant with your company’s policies and regulatory obligations. This, in turn, creates a more robust enterprise platform, ready to receive new workloads and in turn, a becomes a hub for innovation with the necessary guard rails in place.

Continue reading “Azure Governance Never Finishes” →

In China, Someone Else Operates Your Cloud

August 29, 2019August 8, 2026 ~ Ulv Bjørnsson ~ 1 Comment

When Westerners think of hyperscale cloud providers, the usual suspects that come to mind are named Amazon Web Services, Microsoft Azure, Google Cloud Platform, Oracle, and IBM Cloud. Seldom do you hear another name, which tends to be odd since it is already the world’s third-biggest cloud service provider according to the numbers: Alibaba Cloud. And with yearly revenue growth between 60 and 140%, they sure are catching up fast.

However, to operate a cloud within China there are some hoops you need to jump and you have to collaborate with the regional administration. Provisioning and relocation times, thus, are fundamentally increased, in no little part since tasks must be directed by the local partners. The truth of the matter is that, while it is conceivable, receiving a cloud foundation that does not have a physical presence in China places organizations that operate in China at a colossal detriment.

Continue reading “In China, Someone Else Operates Your Cloud” →

Cybersecurity on the Blockchain

March 20, 2019July 28, 2026 ~ Ulv Bjørnsson ~ 2 Comments

Blockchain technology, or distributed ledger technology (DLT), as it is alternatively often called, is one of the hottest topics in the technology sector as of now. A blockchain is a specific type of distributed ledger that stores data in blocks that are linked together via a cryptographic signature function.

This, in short, works by always using the signature of the last block plus the data of the current block to sign the current block. Given enough computing power behind creating the hash signatures for new blocks, a process that is known as mining (PoW), the resulting public ledger is virtually unmodifiable for malicious actors, commending itself for applications that rely on mutual trust where trust cannot be easily applied.

Continue reading “Cybersecurity on the Blockchain” →

Cryptography in a Post-Quantum World

February 23, 2019July 25, 2026 ~ Ulv Bjørnsson ~ 2 Comments

So in my previous article on quantum computing, we talked about where we are today, and where we are headed in regards to breakthroughs in the technology as well as touching on some basics of “what is quantum computing“. In this article, I explore what quantum cryptography and cryptography is like in a post-quantum world.

So, a refresher: quantum computing is set to transform cryptography due to the revolutionary, non-deterministic way of operating.

How will they affect existing cryptography algorithms and which options do we know today for doing cryptography in a post-quantum world?

Continue reading “Cryptography in a Post-Quantum World” →

AI Arms Both Sides of Security

February 13, 2019July 25, 2026 ~ Ulv Bjørnsson ~ 1 Comment

Within the ongoing arms race in the perimeter of information security, artificial intelligence and machine learning are two of the most promising innovations.

While AI in common „personal assistants“, like those developed by Amazon, Alibaba and Google has recently reached levels at which it can convincingly make phone calls on behalf of their users, the capabilities of AI in the hands of defenders, as well as attackers, will likely evolve from buzzword to technology of significant importance over the next years.

On the defensive side, artificial intelligence powered intrusion detection will deliver the ability to pick up on anomalies within an organizations network or perimeters and raise alerts or even countermeasures much quicker than would be possible for any human security team. AI technologies supreme and literally superhumanly quick pattern recognition capabilities enable it to consistently collect intelligence regarding new threats, attempted attacks, acceptable user behaviour and constantly evolve its knowledge. This does allow AI-powered intrusion detection mechanism to find the proverbial needle in the haystack (and react to it) much faster and more concise than classical signature-based intrusion detection systems or a human security analyst.

azure-security-center-and-fortinet-integrated-threat-management-solution-for-cloud-workloads-201 — Azure Security Center is a cybersecurity solution that leverages artificial intelligence and machine learning integrating with the organization’s digital estate.

This does have a flip-side, of course: The same AI capabilities could be used to learn about specific defences and normal user behaviour pattern in an organization and mask the malicious behaviour so it will not be recognized by classical intrusion detection systems or human onlookers.

Continue reading “AI Arms Both Sides of Security” →

Four Azure Tools for Securing What You Run

January 10, 2019July 25, 2026 ~ Ulv Bjørnsson ~ 2 Comments

In today’s interconnected cloud-first, mobile world, securing your online apps and services is vital. However, building secure solutions which deliver value in today’s complex and regulated environment can be a challenge. With information essentially becoming the currency of the digital age, the creation of multiple compliance regulations has forced organizations to implement technical security measures to protect their online systems and customers. Meeting these compliance requirements can be challenging, especially if you are leveraging the benefits of the cloud. Not only do you need to build and configure your apps and services securely, but you also need to ensure your chosen cloud provider meets any necessary compliance requirements.

Compliance in the Cloud Compliance Is a Shared Responsibility

On Azure, Microsoft is responsible for meeting the compliance requirements for its platform while you are responsible for any compliance measures which relate to your cloud service.

With more certifications than any other cloud service provider, Azure meets a broad set of international as well as industry-specific compliance standards. These include the GDPR, ISO 27001, HIPAA, SOC, among others. Microsoft also conducts regular comprehensive audits to ensure it maintains these standards and adheres to the security controls needed.

However, as stated, ensuring your services that are running on Azure meet compliance requirements is your responsibility. Thankfully Microsoft Azure provides a few tools which can help you secure your cloud services and meet the necessary compliance standards.

Continue reading “Four Azure Tools for Securing What You Run” →

Coco Is a Framework, Not a Ledger

February 5, 2018July 25, 2026 ~ Ulv Bjørnsson ~ 2 Comments

Coco Framework, is NOT a blockchain ledger.

Coco is a blockchain ledger framework.

It leverages a combination of trusted execution environments, advanced cryptography and innovative blockchain-focused consensus mechanisms to enable new ways of utilizing the blockchain. Coco stands for Confidential Consortium.

If you want a deeper dive, I suggest you check out the Coco Framework whitepaper, here.

Additionally, Microsoft offers BaaS (Blockchain-as-a-service) and was chosen by Bankchain which is a platform for banks that want to implement blockchain technology; members include State Bank of India, ICICI Bank, DCB Bank, Kotak Mahindra Bank, Federal Bank, Deutsche Bank and UAE Exchange.

Continue reading “Coco Is a Framework, Not a Ledger” →

AI Moved Fraud Detection Into Real Time

November 24, 2017July 25, 2026 ~ Ulv Bjørnsson ~ 4 Comments

Over the last few years, cloud computing has been the buzz. Cloud computing services offer an infrastructure that is highly scalable and supports high-performance computing. With high adoption by businesses of all sizes. Development and deployment of applications within the cloud platform are easy and time to market is done in a fraction of the time.

Artificial intelligence is not a new technology. It has been here for a long time and has helped develop computers and software that perform tasks that are associated with intelligence. Machine learning and deep learning are subsets of artificial intelligence that involve the development of algorithms that learn from data inputs and give intelligent output based on that data and the learned patterns.

A lot of research has been done and still is being done on implementing artificial intelligence into cloud computing. Cloud service providers such as Amazon, Google and Microsoft have already integrated AI into their clouds to improve service delivery. AI brings about capabilities such as machine learning, recognition of patterns and robotics to the cloud. On the other hand, the cloud is able to provide a wide range and large volumes of data since these capabilities are largely dependent on data as input so as to produce the desired output. The cloud also allows the systems to open-access and open-source data which is very crucial in facilitating collaborative learning.

Continue reading “AI Moved Fraud Detection Into Real Time” →

Microsoft new bug bounty program will pay up to $250,000

August 1, 2017July 24, 2026 ~ Ulv Bjørnsson ~ Leave a comment

To some it may have passed under the radar, for others it might be of interest.

Microsoft has released a bug bounty program for hackers, white hats, bug hunters and security researchers alike to discover, find and report vulnerabilities to Microsoft to strengthen the Microsoft portfolio.

Microsoft having dominated the market for home users and business computers have long been a favored target for cyber criminals, hobby hackers and other nefarious operatives. Meaning that just a zero-day vulnerability or any breach can cause a crisis like the recent WannaCry ransomware attack.

Microsoft has previously had bug bounty programs, but mostly they have been limited in time, or for specific suites.

Continue reading “Microsoft new bug bounty program will pay up to $250,000” →

WannaCrypt – What is it?

May 16, 2017July 24, 2026 ~ Ulv Bjørnsson ~ 2 Comments

What is WannaCrypt?

A large Ransomware campaign that spread across the world.
The attack used a vulnerability that was patched in March 2017 Security Update (MS17-010, SMBv1)
How can I mitigate WannaCrypt?

Timeline

August 2016
The Shadow Brokers attempt to auction NSA tools

Claims they hacked Equation Group, author of Stuxnet and Flame
Auction lists attack-ready code with 0-day exploits and trojans.

September 2016
Microsoft encourages users to stop using SMB1

March 2017
Microsoft releases Security Update to address the MS17-010 for SMB1 vulnerability

April 2017
The Shadow Brokers release the toolbox

Includes SMB (Eternal Blue) and the Trojan Code (Double Pulsar)
Microsoft releases an advisory that no new vulnerabilities are found in Shadow Brokers release

May 2017
WannaCrypt is released by unknown attacker
Which utilizes [ETERNALBLUE] with [DOUBLE PULSAR] and a ransomware payload that demands 300-600 USD in Bitcoins from its infected hosts.

What does WannaCrypt do?

Infects

It attacks through [ETERNALBLUE] if MS17-010 is not installed.
Installs the Trojan if the attack is successful [DOUBLEPULSAR]

Encrypts

Encrypts 179 file types
Shows a message that demands for payment of 300$-600$ in bitcoins to a listed wallet.

Spreads

It scans the local LAN and wider internet for port 445
Attempts to infect over SMBv1 [ETERNALBLUE] if port is open.

Payments

We find references to three different wallets these are:

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn 73 transactions, total of 17460 USD
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 98 transactions, total of 26570 USD
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw 82 transactions, total of 23450 USD

Which gives the attackers wallet a total of 67480 USD (14:00 GMT 16.05.17)

Curious of how to mitigate it, or want to read how to disable the SMBv1 vulnerability or patch it? Check out my previous article on mitigation.

As always, if you have suggestions on topics you want to read more about, or feedback. Leave a comment or tweet me at UlvBjornsson

WannaCrypt – What can I do to mitigate?

May 15, 2017July 24, 2026 ~ Ulv Bjørnsson ~ 2 Comments

Let’s try to reduce the attack vectors, I’ll walk you through the practical remedies and reduction of attack vectors you can do; now.

Turn off SMB 1

Why? Because WannaCry utilizes the exploit, and unless you are on XP or 2003, you have no use for SMB1, and will be using SMB2/SMB3.
To disable SMBv1 on the SMB server, run the following cmdlet:

Windows 8 and Windows Server 2012

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Windows 7, Windows Server 2008 R2 and Windows Vista

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force

You can also remove it with “Server Manager” or use this snippet:

Remove-WindowsFeature FS-SMB1

If you want to check whether or not SMB 1.0 is active on your server you can run:

Get-SmbServerConfiguration

As you can see it states that EnableSMB1Protocol is currently True we want to set this to False.

We can accomplish this by running the following snippet:

Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force’ cmdlet, as shown below.

(Force is added to prevent it from pausing for confirmation, and run through.)

Let’s run this again to see if the configuration changed:

Get-SmbServerConfiguration

It is now set to false.

Patch your clients and servers.

WannaCrypt takes advantage of the MS17-010 vulnerability also known as the SMBv1 vulnerability, thankfully it has been patched with MS17-010. Depending on your patch regime, you should expedite and ensure that this patch goes through.

If your systems have been affected; DOUBLEPULSAR will have also been installed, so this will need to also be removed. A script is available (by COUNTERCEPT) that can remotely detect and remove the DOUBLEPULSAR backdoor.