AtlantSECURITY Let’s talk
Menu

ATLANT SECURITY / INSIGHTS

Intelligence & Analysis

Deep dives into the evolving threat landscape and practical guides for scaling security programs.

Research. Perspective. Practical advice.

Personal Cybersecurity: The Complete Guide to Protecting Your Devices, Accounts, Home, and Family

Personal Security / 16 min read

Personal Cybersecurity: The Complete Guide to Protecting Your Devices, Accounts, Home, and Family

A practitioner's end-to-end personal cybersecurity guide for executives, founders, investors, and families who are personally targeted by hackers, scammers, and SIM-swappers. It covers device security, phishing-resistant MFA, SIM-swap protection, home and smart-home networks, data-broker removal, family security, and incident response, plus a prioritized checklist you can start acting on today.

7/1/2026

Read article ↗
Building an NTFS Forensic Timeline from the MFT and USN Journal

Digital Forensics / 9 min read

Building an NTFS Forensic Timeline from the MFT and USN Journal

The single most useful artifact in a Windows investigation is a clean timeline: what happened, in what order, and when. On NTFS, two structures carry most of that story, the Master File Table with its MACB timestamps and the USN change journal that records every file change as it happens. This guide explains what each one contains, why correlating them into a single path-resolved super-timeline beats reading either alone, how to scope a timeline to the window that matters instead of drowning in millions of records, and which export formats feed Timeline Explorer, plaso, and The Sleuth Kit. It then shows how Atlant Scalpel builds and carves that timeline for free in seconds.

6/30/2026

Read article ↗
Recovering Deleted Files from NTFS: What Actually Works, and the SSD TRIM Trap

Digital Forensics / 8 min read

Recovering Deleted Files from NTFS: What Actually Works, and the SSD TRIM Trap

When a file is deleted on NTFS, the data usually is not gone immediately. The Master File Table record is marked free and the clusters are released, but the contents often survive until something overwrites them. That is the window file recovery exploits. This guide explains how NTFS deletion really works, why recovery succeeds on hard drives but frequently fails on SSDs because of TRIM, how to tell an intact recovery from a partially overwritten one, and why honest integrity labeling matters more than a long list of file names. It then shows how to recover a folder for free with AtlantImage, including the volume-bitmap cross-check that flags content already discarded by TRIM.

6/24/2026

Read article ↗
Detecting Timestomping: How Attackers Forge NTFS Timestamps and How to Catch It

Digital Forensics / 8 min read

Detecting Timestomping: How Attackers Forge NTFS Timestamps and How to Catch It

Timestomping is one of the oldest anti-forensic tricks there is: an attacker backdates a malicious file so it blends into the noise of an old Windows install and slips past a timeline review. But NTFS keeps timestamps in two places, $STANDARD_INFORMATION and $FILE_NAME, and most timestomping tools only change one of them. That mismatch, along with zeroed sub-second precision and reused MFT slots, leaves fingerprints. This guide explains how NTFS timestamps work, the specific anomalies that betray manipulation, why the $SI versus $FN comparison is so reliable, and how to surface these flags automatically with Atlant Scalpel instead of hunting for them by hand.

6/22/2026

Read article ↗
Ransomware Negotiation Services: When They Help, When to Avoid Them, and What to Do Instead

Incident Response / 17 min read

Ransomware Negotiation Services: When They Help, When to Avoid Them, and What to Do Instead

The ransom note is on the screen and your first instinct is to find someone who can make a deal. There is a whole industry ready to take that call, and sometimes a professional negotiator genuinely earns their fee by buying time, getting proof the decryptor works, and talking a demand down. But far more often, companies reach for negotiation as a panic reflex when the better answer is to contain, scope, and recover from clean backups. This guide separates the two. It explains what ransomware negotiation services actually do, the narrow set of situations where negotiation genuinely helps, and the disqualifying conditions where paying or even negotiating is the wrong move: when you have recoverable backups, when the attacker is on a sanctions list and payment may be unlawful, when the data is already published, when the decryptor is known to be broken, and when you are facing double or triple extortion where payment guarantees nothing. It covers why the decision to negotiate is one you make deliberately with breach counsel, your cyber insurer, and sanctions screening, never alone in the first panicked hour, and what to do instead while that decision is pending. Seven sections, four diagrams, and six FAQ entries cover the legality of paying, what a negotiation firm really provides, whether backups change the calculus, what payment does and does not buy you, how insurance shapes the decision, and whether a small company without a security team can handle any of this.

6/17/2026

Read article ↗
Cybersecurity Maturity Assessment: NIST CSF vs CMMI, and How to Pick the Right Scale Before the Board Asks for a Number

Audits and Compliance / 19 min read

Cybersecurity Maturity Assessment: NIST CSF vs CMMI, and How to Pick the Right Scale Before the Board Asks for a Number

Your board wants a single maturity score. Your biggest customer wants a NIST CSF tier. Your auditor keeps talking about Level 3. These are three different scales measuring three different things, and presenting the wrong one to the wrong audience is how a perfectly good security program ends up looking immature on paper. This guide separates the two models that dominate cybersecurity maturity assessment. NIST CSF asks what you do and rates implementation on a four-tier scale across Govern, Identify, Protect, Detect, Respond, and Recover; the Tiers are explicitly not maturity levels, and treating Tier 4 Adaptive as the universal goal is the most common assessment error. CMMI asks how well you do it and rates process discipline on a five-level scale from Initial to Optimizing, the same construct CMMC wrapped around NIST 800-171 for the defense base. For most mid-market organizations the right answer is a hybrid: use NIST CSF 2.0 as the control taxonomy and apply a CMMI-style 1-to-5 capability score to each category, producing a current-state radar, a target-state radar set deliberately below the maximum, and a costed gap-closure roadmap. The post walks through how a real assessment runs, the five scoring mistakes that make a report worthless, what a defensible deliverable must contain, and four delivery models with real pricing from USD 8,000 for a targeted deep-dive to USD 35,000 for a multi-entity baseline. Six FAQ entries cover Tiers versus CMMI levels, the single-number question, whether to target 5 everywhere, how maturity differs from SOC 2 and ISO 27001, self-assessment limits, and re-assessment cadence.

6/13/2026

Read article ↗
Active Directory Security Assessment for Banks: Examiner Expectations, Real Cost, and the Findings That Reach the Wire Room

Audits and Compliance / 18 min read

Active Directory Security Assessment for Banks: Examiner Expectations, Real Cost, and the Findings That Reach the Wire Room

Every federally supervised bank and credit union faces an identity-infrastructure risk a generic assessment never tests: the path from a compromised teller workstation through Active Directory to the core banking platform and the wire room. An attacker who Kerberoasts a Fiserv or Jack Henry service account whose password has not changed since deployment does not just hold a domain account, they hold the credentials that run the bank's transaction engine. From there, Domain Admin to a wire-room jump host can take under 40 minutes on a typical community-bank forest. This post lays out the bank-specific AD assessment model that closes examiner Matters Requiring Attention and satisfies the evidence burden for FFIEC safety-and-soundness IT examinations, the GLBA Safeguards Rule periodic-testing requirement, NYDFS 23 NYCRR Part 500 privileged-access obligations, NCUA ACET controls, and SOX IT general controls for publicly traded institutions. It explains what makes bank forests structurally different: core banking service accounts wired into Fiserv, Jack Henry, and FIS with passwords unchanged since go-live; MSP and vendor RMM agents running under standing Domain Admin; wire-room jump hosts reachable from a teller workstation through a single BloodHound path; and bidirectional trusts inherited from acquisitions with SID filtering disabled and stale privileged accounts still live. It details the toolset (PingCastle, BloodHound CE, PurpleKnight, plus a manual core-platform service-account inventory), the deliverable structure that satisfies both the IT remediation team and the examiner evidence package, the four delivery models aligned to banking triggers (MRA response, pre-exam prep, quarterly retainer, post-M and A integration), the 60-day remediation and examiner-evidence timeline, and fixed-fee pricing tiers for community banks, regional banks, and multi-charter holding companies. Six FAQ entries on hybrid Entra ID scope, pentest vs assessment, auditor access, internal vs external delivery, re-assessment cadence, and data-collection safety.

6/11/2026

Read article ↗
Active Directory Security Assessment: Real Cost, Real Deliverables, and the Findings That Actually Matter in 2026

Audits and Compliance / 19 min read

Active Directory Security Assessment: Real Cost, Real Deliverables, and the Findings That Actually Matter in 2026

A CTO at a 640-employee logistics company forwarded a cyber insurance renewal questionnaire with a fresh annex titled Identity Infrastructure Posture asking for the most recent independent AD assessment, the Critical and High findings count with remediation status, and an attestation letter. Three quotes ranged from USD 4,800 to USD 38,500 for the same thing. We scoped a 12-business-day assessment at USD 11,800 fixed price against one forest, two domains, 7 DCs, 1,840 user accounts. The findings register shipped 31 items ranked Critical to Informational. The BloodHound attack-path graph showed 14 owned paths to Domain Admin. A 4-hour Tier 0 isolation change window closed 11 of the 14 paths on Day 1. The renewal closed at flat premium on Day 19. From 41 AD assessments over 24 months on forests from 180 to 14,000 users, the 10-domain checklist that produces a defensible report. Four pillars (Privileged Access, Authentication Protocols, Object ACLs, Hardening and Logging). The four privileged-access findings that close most real AD compromises (Tier 0 hygiene, Domain Admin sprawl, gMSA migration, built-in Administrator). Auth findings (Kerberoasting in 38 of 41 forests, unconstrained delegation in 19, NTLM relay in 26) with prevalence and exploit-time data. Open-source tooling (PingCastle, BloodHound CE, PurpleKnight) covering 70 percent of paid auditor scope and what each misses. What a real deliverable contains. Three honest pricing tiers (Single-Forest USD 6.5K-11.5K, Multi-Domain USD 12K-18K, Enterprise USD 22K-38K). A 60-day remediation plan. Four delivery models (fixed-fee external, hybrid, quarterly retainer, accelerated pre-deal). Six FAQ entries.

6/9/2026

Read article ↗
The Google Workspace Security Audit Checklist That Catches the Findings Your IT Vendor Missed

Audits and Compliance / 20 min read

The Google Workspace Security Audit Checklist That Catches the Findings Your IT Vendor Missed

A CFO at a 64-person logistics SaaS forwarded us a one-line email from her largest prospect: tenant security evidence requested, signed by a party independent of the IT vendor, within 21 business days, USD 1.1M deal on the line. The vendor's one-page memo said grade A no findings. We pulled the tenant on a Wednesday afternoon and found 16 in three hours, two of them deal-ending. From 31 Google Workspace audit engagements (14 to 410 seats) over the last 18 months, this is the 14-domain checklist that produces a findings register a procurement reviewer accepts. The four pillars (Identity, Data, Mail and Apps, Devices and Audit), the five identity checks that close most real incidents, Drive sharing as the quiet compliance killer (median 1,847 link-anyone items per tenant, 8.4 percent containing regulated data) with the 21-day inventory-restrict-sweep-enforce remediation flow, Gmail hardening including the DMARC migration from p=none to p=reject in 6-10 weeks without a legitimate bounce, marketplace OAuth apps as the supply-chain vector nobody watches (median 22 active grants, the 71-app real example, the 5-step revocation process), Context-Aware Access as the single largest 2026 control improvement (80 percent stolen-session-token attack surface reduction), audit logging and the six findings that hide in plain sight. Three honest pricing tiers (Foundation USD 4.5K-6.5K, Standard USD 7.5K-11.5K, Regulated USD 12K-19K) with what each delivers. A 30-day plan that closes 70 percent of typical findings. Six FAQ entries.

6/5/2026

Read article ↗