Suggestions
Gal Nakash
Co-Founder at Stealth Mode Startup Company
Gal Nakash is a serial entrepreneur and technology executive currently serving as the Co-Founder and Chief Product Officer (CPO) at Reco AI, a company focused on enabling secure collaboration for businesses.14 He is based in the Tel Aviv District, Israel.1
Professional Experience
- Reco AI: Co-Founder and CPO (December 2022 - Present)1
- Bonfy.AI: CEO and Co-founder (as of January 2025)3
- Office of the Prime Minister of Israel: Held various positions including Head of Research and R&D Team Leader (2011 - 2020)1
Background
Gal Nakash has a strong background in cybersecurity and research. He is a former Lieutenant Colonel in the Israeli Prime Minister's Office.6 His experience includes:
- Managing research and projects from idea to completion
- Designing educational training programs
- Coaching individuals to success
- Technical strategy and risk management
Recent Activities
As of early 2025, Gal Nakash has been active in discussions about:
- Making Generative AI safe and trustworthy3
- Security concerns related to SaaS (Software as a Service) applications5
- Data protection and governance in the age of generative AI6
Gal Nakash's LinkedIn username is indeed "naksec", as mentioned in the query.235
Highlights
Traditional network security falls short when it comes to SaaS. With data stored remotely and accessed from anywhere, security gaps can emerge.
SaaS Security Posture Management (#SSPM) automates security risk management for SaaS applications. It scans for misconfigurations, user permissions, compliance issues, and more to ensure battle-ready SaaS apps.
At Reco AI, we offer a SaaS #security solution that efficiently detects and mitigates risks associated with exposed files on Google Drive and other security concerns in SaaS applications.
𝗧𝗵𝗲 𝗚𝗼𝗹𝗱𝗲𝗻 𝗦𝗔𝗠𝗟 𝗔𝘁𝘁𝗮𝗰𝗸: 𝗔 𝗦𝘁𝗲𝗽-𝗯𝘆-𝗦𝘁𝗲𝗽 𝗚𝘂𝗶𝗱𝗲 🆘 Golden SAML was one of the major techniques used by the threat actor as part of the SolarWinds attack by compromising the SAML signing certificate using their Active Directory privileges.
An attacker must first gain administrative access to the ADFS server and extract the necessary certificate and private key to successfully leverage Golden SAML.
Once these privileges are obtained, the attack will proceed according to the following steps:
1️⃣ 𝗜𝗻𝗶𝘁𝗶𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀 𝗮𝗻𝗱 𝗞𝗲𝘆 𝗘𝘅𝘁𝗿𝗮𝗰𝘁𝗶𝗼𝗻: The attacker first accesses the ADFS (Active Directory Federation Services) server and extracts the private key and certificate.
2️⃣ 𝗧𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗲.𝗴., 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗢𝗳𝗳𝗶𝗰𝗲): The user (in this case, the attacker) attempts to access a federated service, such as Microsoft Office.
3️⃣ 𝗥𝗲𝗱𝗶𝗿𝗲𝗰𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻: The Service Provider (SP) redirects the attacker to ADFS for authentication.
4️⃣ 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗮𝗻𝗱 𝗙𝗼𝗿𝗴𝗲𝗱 𝗦𝗔𝗠𝗟 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲: Here’s where the 'golden' aspect comes into play. The attacker bypasses ADFS #authentication by signing a forged #SAML response using the stolen certificate and key.
5️⃣ 𝗚𝗮𝗶𝗻𝗶𝗻𝗴 𝗔𝗰𝗰𝗲𝘀𝘀: This forged SAML response is then presented to the desired service, granting the attacker access.
Reco AI driven platform effectively combats Golden SAML attacks by enhancing visibility and control in SaaS environments, utilizing key features like Identity & Access Governance and SaaS Detection & Response to prevent unauthorized access and certificate exploitation.
