Su Zhang, Ph.D.

🎯 Finally, A Smarter Approach to Kerberoasting Detection! Just read an excellent piece from The Hacker News about BeyondTrust's research on revolutionizing Kerberoasting detection. As someone who's dealt with the frustration of legacy detection methods, this hits close to home. The Problem We've All Faced: For over a decade, we've been fighting Kerberoasting attacks with the same brittle tools: - Volume-based alerts that cry wolf on legitimate service spikes - Encryption-type analysis that misses sophisticated "low-and-slow" attacks - Static rules that generate more noise than signal The Game-Changer: BeyondTrust's research team developed a statistical model that actually learns normal behavior patterns instead of relying on rigid thresholds. Their approach focuses on four critical constraints: 🔍 Explainability - Results you can actually understand and act on 📊 Uncertainty - Confidence levels, not just binary alerts ⚡ Scalability - Efficient processing under 30 seconds 🔄 Nonstationarity - Adapts to changing environments over time Real-World Results: - Tested across 50 days of production data - Successfully identified 6 anomalies (including 2 pen tests and 1 simulated attack) - Handled extreme variability without drowning SOC teams in false positives - Adapted to infrastructure changes in real-time My Take: This is exactly the kind of innovation our industry needs. We can't keep fighting modern threats with decade-old detection logic. The combination of security expertise with advanced statistics is the path forward. Key Lesson: Sometimes the best defense isn't building higher walls—it's getting smarter about what's actually suspicious. #CyberSecurity #ThreatDetection #Kerberoasting #ActiveDirectory #SOC #InfoSec #MachineLearning #SecurityResearch https://lnkd.in/gph5528S

9

I just added support for AWS IAM Outbound Identity Federation to the Nymeria cross-cloud identity repository. Previously, AWS workloads required the target service to accept pre-signed Signature Version 4 headers for identity verification. This approach was not supported by Azure identity federation, so accessing Azure resources required an additional OIDC identity provider (for example, AWS EKS or Amazon Cognito) to issue tokens to AWS workloads. Now, with IAM Outbound Identity Federation, AWS workloads can request signed OIDC identity tokens (JWTs) using the sts:GetWebIdentityToken API. These identity tokens enable OIDC federation into external cloud services. This blog post demonstrates how to use AWS IAM Outbound Identity Federation to access data hosted in Azure Storage: https://lnkd.in/gcatS7FU GitHub repository: https://lnkd.in/gZHJg8cj

50

“Your AI stack sits still?" "That’s cute.” ADA rotates your AI workloads before the attacker can even lift a recon script. No honeypots. No deception. Just infrastructure that fights back. AMTD for the AI age—finally, security with teeth. #AISecurity #AMTD #Kubernetes #EdgeAI #AdaKnows https://lnkd.in/d9M2XWqi

5

SOTA agent frameworks rely on probabilistic "vibes" and lack deterministic User-to-Agent Authorization mapped to data classification. This makes them mission-unsuitable for military use, where multi-level security requires microsecond, pre-computed gating instead of slow, bypassable LLM reasoning...

“Who approved this agent?” AI agents are reshaping how work gets done across the enterprise. They schedule meetings, trigger workflows, access sensitive data, and can take action across systems. Productivity is accelerating, but so is the security risk. One of the most concerning issues for CISOs and security leaders is that shared organizational agents are becoming authorization bypass paths. A user who is not authorized to access certain data or perform specific actions directly may still be able to do so by operating a shared AI agent that has broader permissions. Because the agent acts under its own authorization, not the user’s, these actions appear legitimate to security systems. As a result, the user effectively gains capabilities beyond their own permissions, and traditional controls fail to detect or flag the activity. In my latest article in The Hacker News I break down this challenge. I'd love to hear how other pros in the cybersecurity world are approaching AI agent access and oversight. Link in the comments 👇 #AIsecurity #AIrisks #AIagents #agenticAI #AIagentsecurity

59

6 Comments

The official MCP registry has been released! Model Context Protocol (MCP) Registry is an open catalog and API for publicly available MCP servers to improve discoverability and implementation https://lnkd.in/gWyatanm

21