Flat Networks, Fast Breaches, and How Shared Services Undermine Internal Segmentation

Cyber Millennial
in ,

In full posture assessments and incident response engagements I often found internal networks still flat. VLANs separated users, servers, management, or wireless, but without internal firewalls these zones offered little resistance and attackers could move freely. Even where segmentation existed, shared services like storage, Citrix, or management platforms spanned environments and bridged production with non-production. This was usually a trade-off between cost, complexity, and legacy design. Cloud stood out more positively, with Azure vNets, AWS VPCs, and GCP VPCs applying ACLs to segment traffic, though gaps remained around shared infrastructure. On paper segmentation looked effective, yet in practice it left broad paths open.

Read More

Lessons from OWASP AppSec NZ: Culture, Code, and AI’s Impact on Development

Cyber Millennial
in ,

AI introducing additional risks in development is no longer theoretical or fringe. At OWASP AppSec NZ, session after session reinforced the double-edged nature of AI in cybersecurity. LLMs are accelerating delivery, but they also generate vulnerable code nearly 40 percent of the time, and most of it is still pushed to production. Banning them is pointless, because developers, like any other role, will find a way to use these tools whether in a controlled environment or outside it. Until these systemic issues are removed from the training data of future models, if that ever happens, we are essentially living through Stack Overflow 2.0, but with vulnerabilities baked in at scale.

Read More

Defending Aotearoa New Zealand from the Inside Out | NZSIS Brief Analysis

Cyber MIllennial
in ,

Aotearoa New Zealand may be geographically remote, but the digital threat environment has no borders. The NZSIS Security Threat Environment 2025 report highlights violent extremism, foreign interference, espionage and insider risks, all of which I have seen unfold in US and global contexts. The lesson is clear. Defending the crown jewels requires an inside out approach. Assume breach, watch for insiders, and recognise that foreign state activity and ransomware groups can just as easily exploit local infrastructure and people as they can in larger nations.

Read More

Perimeter Firewalls: Strong Technology, Weak Defences

in ,

Perimeter firewalls in most enterprises start strong, but in a number of assessments I found organisations not getting the full value of what they paid for. A few had intrusion prevention enabled only in monitor mode, others skipped SSL inspection altogether, some allowed servers to reach the internet as if they were laptops, and many carried forward undocumented rules that no one could fully explain. I also encountered firewalls without application-aware rules, IPv6 left enabled where the business did not support it, exposed management planes reachable from the internet, and VPN web portals like GlobalProtect that have been exploited repeatedly. Features such as user identification, which can provide valuable context, were often left unused. On their own, these gaps may seem manageable, but in combination they create blind spots and pathways that adversaries can exploit. The result is a firewall estate that looks modern and capable on paper yet delivers less defence than the investment should provide.

Read More

DMARC Reject: The Policy Everyone Tests, Only 25% Enforce

Cyber Millennial
in

Aotearoa New Zealand government mandates around DMARC are forcing agencies to act, but the struggle to enforce reject is hardly limited to the public sector. In my own work with medium and large enterprises, I have seen the same hesitation: once enforcement disrupts mail flow with partners or vendors, it is quickly rolled back. Proofpoint’s figure that only 25% of organisations enforce reject mirrors what I’ve observed in the field. The technology is straightforward, but the organisational tolerance for disruption is not.

Read More

Post-Quantum Cryptography: How Global Guidance is Taking Shape

Government guidance on post quantum cryptography (PQC) is moving from theory to detailed migration planning. In the last nine months, as highlighted by Zygmunt Łoziński of IBM Research via LinkedIn, countries including Australia, Canada, the EU, France, Germany, Israel, the Netherlands, New Zealand, the UK, and the US have refreshed their positions. A consensus is forming: plan now, migrate high priority systems by 2030 or 2031, and complete the transition by 2035 using NIST approved algorithms such as ML KEM and ML DSA, with the first three standards already finalised in August 2024 and a fourth on the way. These deadlines are critical when factoring in Q Day, the point at which quantum computers can break today’s public key encryption, and the harvest now, decrypt later risk it amplifies. If Q Day happens quietly in a confidential vacuum, the wider world may not realise it for some time. New Zealand has added PQC preparation to its national security manual, signalling that the shift is no longer optional.

Read More

The Front Door Is Monitored, but Not the Hallways: When Network Visibility Ends at the Perimeter

Cyber Millennial

Many organisations invest heavily in perimeter defences, yet leave the inside of their networks unlit. Internal firewalls are rare, SIEM inputs are often unfiltered and overloaded, and network detection tools are absent. The result is a perfect environment for attackers to move laterally, hide data in seemingly normal DNS traffic, and persist for months without a single alert.

Read More

When Familiar Names are Phishing?

Cyber Millennial
in

This post breaks down a real phishing attempt that targeted ITP NZ members using a spoofed display name. It wasn’t a compromised account, but a crafted message designed to exploit familiarity and provoke a reply. By unpacking how this tactic works and what subtle signals gave it away, we hope to sharpen member awareness, encourage better reporting practices, and help readers think like an adversary. If you receive something suspicious, please send it as an attachment to info@itp.nz so the headers can be analysed properly.

Read More

High Privilege, Low Discipline: The Risk of Everyday Admin Use in Shared Infrastructure

Cyber MIllennial
in ,

Most IT professionals know they shouldn’t use elevated accounts for everyday tasks. But knowing is not the problem, leaving it enabled by default it is. This article looks at how exposure happens by design when administrative accounts are allowed to log into workstations, Citrix sessions, or virtual desktops without controls. Deny the possibility by default. If an attacker compromises a single endpoint, your architecture should prevent it from becoming a breach-level incident.

Read More

PAM is Not Enough: When Forgotten Accounts Bypass Your Controls

Cyber Millennial
in ,

Even mature environments misjudge the scope of their privileged access exposure. This article unpacks how real-world privilege creep unfolds, from nested AD groups to unmanaged service accounts, forgotten appliance credentials, and newly created local admins. PAM tooling helps, but it is often blind to the accounts that matter most. If your visibility stops at Domain Admins or naming convention–based groups like CyberArk-Admins-VMWare or Delinea-SA-Storage, you are not seeing the breach path.

Read More

Legacy by Design: How Protocol Defaults and Hash Exposure Still Get Us Breached

Cyber Millennial
in , ,

NTLM has not gone away. In many environments, it still underpins logon flows, service account authentication, and credential relay paths that defenders assume are deprecated. Protected Users is rarely enforced. Credential Guard is rare. Even when Kerberos is in use, fallback to NTLM is often quietly enabled. Add LLMNR, NetBIOS, SMBv1, Telnet, and plaintext LDAP, and attackers have everything they need to steal or relay credentials without malware, without exploits, and often without detection. This article breaks down the legacy defaults still exposing modern networks, and what defenders, incident responders, and CISOs can do to harden these protocols before someone else exploits them.

Read More

The Quiet Backdoor: AD Certificate Services Misconfigurations

Cyber Millennial
in

Misconfigured ADCS templates continue to enable stealthy privilege escalation in environments that otherwise look secure. These are not niche attacks. They’re practical, repeatable, and often invisible to standard monitoring. This article explores how certificate services quietly undermine security controls and why they remain one of the least reviewed yet most impactful misconfigurations in Active Directory.

Read More

Starlink for NZ Defence: Is Elon's DOGE and Palantir Connection Worth the Cybersecurity and Privacy Risks?

Cyber Millennial
in

New Zealand’s approval of Starlink for military use may offer operational agility, but it introduces uncomfortable trade-offs around data sovereignty, encryption, and corporate entanglement. Elon Musk’s links to controversial US data projects like DOGE and Palantir raise valid concerns about privacy, persistence, and trust. This article unpacks those tensions and the minimum safeguards NZDF should demand.

Read More

Custom GPT's for Cybersecurity Professionals in NZ

Cyber Millennial
in

Custom GPTs are tools no different than a hammer. Useful in the right hands, but counterproductive if misapplied. You wouldn’t install a lightbulb with a hammer, and you shouldn’t delegate strategic judgment to a chatbot without sufficient context. These GPTs are designed to prompt reflection, not replace thinking. Each one helps cybersecurity professionals surface lived experience, clarify trade-offs, and turn real work into shareable insight.

Read More