Arquitecto de Seguridad de Azure: 2026-09-30

1. Beyond source code: A path to the keys to the kingdom

   Microsoft Defender Experts Cybersecurity Incident Response, 2026-09-29. Leer, 6 min.

   Microsoft's Detection and Response Team (DART) describes an intrusion in which Storm-3068 took over a user account through a self-service password reset, registered its own authentication methods, and used legitimate identity and cloud services rather than malware or software exploits to reach Azure DevOps, pipelines, and Kubernetes resources. The actor created a pipeline to harvest Kubernetes credentials and modified pipeline scripts to install the Atera remote management agent and download the Chisel tunneling utility.

   Por qué importa para este rol: Limit which privileged accounts in the estate can use self-service password reset, since one reset let Storm-3068 register its own authentication methods and move into Azure DevOps.

Arquitecto de Seguridad de Azure