Kristian Mansfield

Penetration Tester to Application Security Engineer Remote (Must be in Australia) $150k package Not many jobs come around where you can get employed for your current skills and get training on the job to transition to your next role. Are you ready to turn from a breaker to a builder? Our customer believes software should be the status quo. Their aim is to fundamentally change the approach to secure software, ensuring it influences every aspect of software engineering and customer experience. If this resonates with you, this could be the transition you’ve been looking for. Maybe you’re frustrated with finding bugs but not solving the real issues. And you like the idea of getting closer to the root cause. This is a mid-level role, meaning you’ll be dedicated to a customer for a period of time, predominantly focused on testing web apps. You’ll need to have experience working as a pentester. It wouldn’t be suitable for someone who believes engineers are the problem; instead, they are looking for someone that wants to support, educate, and influence. You need experience in coding/scripting. You should be able to write and understand code in any language. You can be taught manual code review and help build your skills in the application security industry. You’ll work on solving problems and improving secure software, influencing software engineering functions and customer experience. As part of the interview process, you will take part in a coding challenge. It’s not about syntax but about thinking like a programmer. Tasks could include reversing a linked list or building an algorithm to count a grid of emotions. The goal is to demonstrate your ability to think and write software. The other day I posted about this role and highlighted that it was in Australia and did not offer sponsorship. 99% of people who reached out to me were from overseas, unfortunately, people that the customer can’t hire. For clarification, you can’t be considered for this role if you aren’t in Australia and don’t have working rights; you won’t be eligible. I had several people say something like, “Don’t worry about the visa, I can sort it, just get me an offer.” Sorry, but visas in Australia don’t work like that. If you like the idea of switching from breaker to builder, reach out to Yas Bourne for more info.

76

3 Comments

🇦🇺 𝐈𝐦𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐀𝐮𝐬𝐭𝐫𝐚𝐥𝐢𝐚’𝐬 𝐜𝐲𝐛𝐞𝐫 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐧𝐬𝐢𝐬𝐭𝐞𝐧𝐭 𝐰𝐢𝐭𝐡 𝐢𝐭𝐬 2023-2030 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 The Government has released a legislative package known as the 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐁𝐢𝐥𝐥 2024 that implements a range of initiatives aimed at improving cyber security. These initiatives include: ➡️ Mandatory standards for improving the security of Internet of Things (𝐈𝐨𝐓) devices ➡️ Australian businesses will have to report ransomware payments within 72 hours of being made ➡️ Establishing a cyber review board to investigate serious cyber security incidents ➡️ Making changes to security of critical infrastructure legislation relating to data storage systems ➡️ Establishing a National Cyber Security Coordinator 💥 These initiatives are still undergoing review but if passed before the end of the year will require organisations to act and start focussing a lot more on cyber! 💥 #Cybersecurity #Informationsecurity #Australia

6

Curious as to why the AssetCacheLoacator service on my MacOS is trying to connect to Australia to perform an Apple Update per Little Snitch. I have a whole thread going on X right now. Still waiting for followers to pick up on BlueSky. I tried different Laptops and networks and have come to the conclusion that so far either my firewall has been compromised or is simply malfunctioning or something is wrong with Comcast. DNS is doing some really strange things. Someone is trying to point my laptops to a DNS record instead of an IP, and as you know if you are into this sort of thing, DNS rebinding can change IPs, and DNS caches can be compromised. When I set the allow rule for the DNS record, I still block any invalid DNS servers based on IPs. DNS is not working on that network and I haven’t changed anything on the network side. The only thing in my firewall logs getting blocked is traffic to 1.1.1.1 which the family DNS record should not resolve to. I’m not getting any DNS responses at all. When I move my laptop to another network, the DNS records were somehow altered. When I fixed that DNS worked. But Little Snitch reports that the MacOS asset service mentioned above is apparently still trying to reach Australia and softwareupdated is trying to reach an address in Rio de Janeiro. Hmm. Do you block invalid DNS servers on your network? If you don’t, things might be resolving to unexpected or unauthorized IP addresses.

2

Last week, there was big news in the fight against cybercrime! The Australian Federal Police made 37 arrests and shut down hundreds of sites used for phishing. It’s awesome to see countries working together to keep our data safe. This operation highlights the effectiveness of international cooperation in cybersecurity. What steps do you think organizations should take to further enhance their defenses based on these ongoing threats?

1

BSides Canberra Career Village - Lynore Close presenting "From Fields to Firewalls" Ever wondered how someone from a completely different background makes it into cybersecurity? Let me share my story. As a First Nations woman who worked various jobs like fruit picking and delivery driving, and didn’t finish high school, my path to a cybersecurity career might surprise you. I found my way into this field without a technology degree or the typical background. In this presentation, I propose to take the audience through my journey—how a love for air conditioning, taking chances on new opportunities, embracing a growth mindset, and building resilience helped me grow in this field to cultivate my own version of success. I will also highlight alternative pathways to get into tech and why diversity is crucial for innovation and security. Whether attendees are just starting out or looking to pivot into cybersecurity, this session aims to provide the humorous insights, practical advice and hopefully a wee bit of inspiration needed to carve their own paths. 14:30 26th September

29

4 Comments

🚨MUST READ 🚨: The Australian Signals Directorate has released exceptional content on system hardening for Active Directory. This guidance informs organisations on 17 common techniques used by threat actors to target Active Directory, informed by intelligence services in the Five Eyes. Time and time again, I've personally exploited the same issues outlined in this article to privilege escalate and laterally move within an organisation, to achieve full domain compromise. If the industry followed this advice, it would be hardened against majority of the cyber threats including ransomware and cyber crime. Read now: https://lnkd.in/gExkK2wa

108

2 Comments

PROBLEM: crooks 🦹‍♂️ use hooks 🪝to get your passwords 🤦🏻 SOLUTION: use passkeys 🔑not passwords BACKGROUND myGov is one of the most impersonated 😡Australian Govt websites 🔹 Phishing-fake websites typically steal 🦹‍♂️ your password and username by mimicking the login page of a legitimate website. 🔹When you enter your email and password on the fake website, they are captured by the attacker 🪝 🟣 Good news / news flash 📣 1️⃣ myGov is NOW among the first govt digital services in the world 🌎 to start using passkeys - which are resistant to phishing ✅ 2️⃣ turning off - your myGov password as a sign-in option - and using your passkey 🔑 instead - makes it harder for scammers to access your accounts using stolen usernames and passwords ✅ 3️⃣ On average, more than 860,000 people sign in to myGov each day 🤯 4️⃣ In Australia ♥️ last year scams cost $2.74 billion, with $250 million coming from someone stealing/phishing 🪝 your log in details. For more information on how to set up your myGov passkey ➡️ https://lnkd.in/ggWP5XaH See comments for set up instructions … Bravi to Minister Bill Shorten and Services Australia for being an early govt adopter of passkeys 🏆 📸 Serena Hardwick 📍Wagga Wagga TackleWorld

540

43 Comments

I really love that the Monash University team have open sourced their approach to Microsoft's Enterprise Access Model. In my opinion, its a work of art and something worth sharing. Some of the highlights: - Tiered Active Directory - Smart Card Authentication for Privileged Accounts - Privileged Access Workstations (PAW) - Just In Time (JIT) Access Over the last few years we've seen some organisations targeted with 0 days affecting perimeter devices. To be resilient against this type of threat, you need to ensure that the compromise of accounts using these perimeter devices will not result in the complete compromise of the organisation. Using an approach similar to what Monash have implemented will make your organisation significantly more resilient to targeted attacks of this nature. If one of your IT staff end user systems was compromised tomorrow, would the whole house of cards come crashing down? See Dan's post for a link to the Github repository.

12

CyberSec People has a ticket to give away to BSides Gold Coast! With sub-120 tickets, they are rare :) "How can I get one?" Comment on this post. "What's the catch?" Preference will be given to students/ career changers/ people between jobs. "Seriously, what's the catch?" I've given away many tickets over the years. I love connecting people to the industry, especially those needing extra help. "Anything else I need to know?" This is a ticket only. No travel or accommodation is provided. When I did this in the past, people from overseas messaged me. Also, make sure you can actually attend. I've selected people in the past who hadn't checked where and when the conference was. Make sure you can be there this Saturday :) A winner will be picked by 5pm AEDT on 31st October. Bonus point if you have a Halloween joke.

27

7 Comments

BSides Adelaide starts this Friday - lots of great cyber learning in what I'm sure will be an awesome inaugural BSides for this city. The "Tools of the Dark Side" village features a display of vintage espionage gear, and a fun CTF-style challenge that will see participants hands-on with some restored and operational nation-state toys. In the Cold War the mysterious "Numbers Stations" were shortwave radio transmissions that would chant long strings of seemingly random numbers. These were actually encrypted instructions for remote agents, that were converted to computer generated speech for broadcast. So here's what we've set up for you to recreate the above: - I've programmed a real Stasi "Numbers Station" box with a message - Push a couple of keys and it'll start chanting (German) numbers at you (not a problem - you did some German in Year 7 right? Right?) - Write those numbers down and then the fun starts - Flag 1 is encrypted once - you'll decrypt that with the One Time Pad - Flag 2 however, is double enciphered :-) - Now go to the cipher machine and set the key as Flag 1's cleartext - Then enter Flag 2 to remove the second layer of encipherment The 70's were about more than flares 'n hair - come and check out your grandad's so-retro-they're-cool-again cyber toys. #Adelaide #BSides

68

7 Comments

The Australian Signals Directorate’s ACSC, along with CISA, FBI, NSA, and international partners, have released a must-read guide on "Best Practices for Event Logging and Threat Detection". 📄 [Read the full guide here] (https://lnkd.in/djqqt5AG). Whether you're in IT, OT, network administration, or critical infrastructure, I strongly encourage you to review these best practices and bolster your security measures. Stay secure, stay ahead! 🛡️

1

A step forward, nonetheless. But if we as a country are still focused on reporting and reviewing as opposed to protecting and responding, it feels like we are very far behind the 8 Ball. #cybersecurity #parliament #australia #business

2

🚨 Cyberattack Alert ‼️ 📍 Australia - MediSecure The RansomHub ransomware group claims to have breached MediSecure, an Australian prescription delivery service provider. 🔍 Details of the Attack: Data Exfiltrated: Allegedly 1.9 TB of sensitive information. Ransom Deadline: 25th December 2024. MediSecure has been previously implicated in major cybersecurity breaches, including the unauthorized access of 6.5 TB of patient data earlier this year. This incident further highlights the escalating cyber threats faced by the healthcare sector. Organizations are reminded to bolster their cybersecurity posture to prevent and respond to these attacks effectively. #CyberSecurity #Ransomware #Healthcare #DataBreach #CyberAttack

2

"How's the market?" 💩 "So it's easy to hire right now?" "No." "That doesn't make sense." July 2023 was the peak of cybersecurity job adverts in Australia. Fast forward to July 2024, and the numbers are down by 37.68%! If this were the stock market, it would be classified as a major decline—deep into bear market territory. But in the real world of hiring, this drop doesn’t make things easier. Contrary to what some might think, there aren’t suddenly tonnes of amazing people available or laid off. It feels like people are being a bit more cautious right now. The hiring landscape is challenging, and finding great people is tough. When headhunting (which is how we hire for 95% of our roles), trust is critically important and goes a long way when reaching out to potential candidates. You're not alone if you’re struggling to hire and confused about why great people aren’t applying to your jobs. The best talent in any industry rarely applies to traditional job adverts unless they absolutely have to. For context, we've had 96 phone calls for every hire we've helped make in 2024.

112

7 Comments

Control!!! In the field of cybersecurity there is another approach that pairs up with frameworks to ensure security posture of an organisation The approach is known as the "Security Control" Security controls are designed to mitigate specific security risk and reduce the impact of those risk before they occur. There are 3 main ways to bring in such "Security Controls" : 1)Encryption ↳ Process of converting a readable data to an encoded data which is unreadable by both computers and humans unless it is decrypted. ↳ The readable data can be termed as plaintext and the unreadable data can be termed as ciphertext. 2)Authentication ↳ Process of verifying the identity of a person or system , ex: MFA (Multi Factor Authentication) 3)Authorization ↳ Granting a person or a device to have the access to specific resource in a system. These are the ways how "Security Control" is ensured in an organisation. When it comes to cybersecurity both frameworks and security controls work together to ensure the security posture of an organisation.

9

SHA-3 will likely replace SHA-2 for hash functions in the future as we prepare for evolving cryptographic needs. For encryption, while AES remains secure today, the rise of quantum computing may push us toward larger key sizes like AES-512 or even entirely new quantum-resistant symmetric encryption algorithms by 2030. #security #cryptography

6

Glossed over the email from Firstmac on Friday, reporting that my data has been gathered in a "limited" cyber security breach of their systems, limited now days includes sensitive citizen data clearly. Firstly I do appreciate the "heads up" that's 1 point for Firstmac, though considering I didn't know I worked with them, then I will take the 1 point away. What is confounding to me is that my last interaction with Loans.com.au was in November 2020 - four and a half years ago! and the data of mine that has been exfiltrated is Full name, Drivers license, DOB, Address etc - everything that identifies me as a citizen, FROM A THIRD PARTY PROVIDER TO LOANS! - 4.5 years ago, meaning they retained my information for what purpose?! The data is no longer necessary to be kept by the provider of my enquiry let alone a third party provider, I am extremely disappointed that this is the case as it makes no sense to me. Luckily the Optus Breach happened between then and now *sarcasm so my Drivers license has been changed already. Protecting customers sensitive data is a top priority of any business in operation, consider these things: - What third parties do I share sensitive data with, have they provided us with a risk assessment, what are their data security policies, how do I confirm? - What data do I really need to perform my task (less is best) - Is this data encrypted at rest and by transport? - Do I need to retain this data for any reason, for how long and how do I handle expiring this data. Finally credit to FirstMac for letting me know I would love to know you views Victor Dominello Clare O'Neil

7

1 Comment