Sahil Deshpande

Penetration Tester to Application Security Engineer Remote (Must be in Australia) $150k package Not many jobs come around where you can get employed for your current skills and get training on the job to transition to your next role. Are you ready to turn from a breaker to a builder? Our customer believes software should be the status quo. Their aim is to fundamentally change the approach to secure software, ensuring it influences every aspect of software engineering and customer experience. If this resonates with you, this could be the transition you’ve been looking for. Maybe you’re frustrated with finding bugs but not solving the real issues. And you like the idea of getting closer to the root cause. This is a mid-level role, meaning you’ll be dedicated to a customer for a period of time, predominantly focused on testing web apps. You’ll need to have experience working as a pentester. It wouldn’t be suitable for someone who believes engineers are the problem; instead, they are looking for someone that wants to support, educate, and influence. You need experience in coding/scripting. You should be able to write and understand code in any language. You can be taught manual code review and help build your skills in the application security industry. You’ll work on solving problems and improving secure software, influencing software engineering functions and customer experience. As part of the interview process, you will take part in a coding challenge. It’s not about syntax but about thinking like a programmer. Tasks could include reversing a linked list or building an algorithm to count a grid of emotions. The goal is to demonstrate your ability to think and write software. The other day I posted about this role and highlighted that it was in Australia and did not offer sponsorship. 99% of people who reached out to me were from overseas, unfortunately, people that the customer can’t hire. For clarification, you can’t be considered for this role if you aren’t in Australia and don’t have working rights; you won’t be eligible. I had several people say something like, “Don’t worry about the visa, I can sort it, just get me an offer.” Sorry, but visas in Australia don’t work like that. If you like the idea of switching from breaker to builder, reach out to Yas Bourne for more info.

76

3 Comments

Cyber Security Threats to the Australian Education Sector: Insights from Penetration Testing (2022-2024) The document highlights the significant cybersecurity vulnerabilities faced by the Australian education sector due to rapid digital transformation and reliance on cloud services. ​ Key findings from penetration tests conducted between 2022 and 2024 reveal critical weaknesses in internal networks, external applications, and cloud infrastructures, exposing institutions to data breaches, operational disruptions, financial losses, and reputational damage. Key Findings: * Internal Vulnerabilities: - Outdated protocols and weak security practices. - Use of end-of-life operating systems like Windows Server 2012. - Lack of LDAP signing, making systems vulnerable to man-in-the-middle attacks. * External Vulnerabilities: - Weak password management on external portals. - Use of outdated web components and libraries. - Directory indexing enabled, exposing sensitive information. - Weak SSL/TLS protocols and missing security headers. * Cloud Vulnerabilities: - Weak password management and lack of Multi-Factor Authentication (MFA). - Missing conditional access policies. - Unmanaged accounts and devices. - Excessive user permissions. Source: https://lnkd.in/g7b-Xqmi Company: Spartans Sec - https://lnkd.in/gqatya9t #SpartansSec #CyberSecurity #EducationSector #DataProtection #MFA #CloudSecurity #PenetrationTesting

14

1 Comment

DID YOU GET BSOD TOO? #CROWDSTRIKE It's not just you! Laptop blue screen errors.. Due to a recent end point protection update by Crowdstrike, a number of laptops are suffering a bluescreen of death error and are unable to successfully reboot. This issue has impacted a significant number of organisations within Australia. Crowdstrike is currently investigating the issue as a top priority. Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally.

9

🇦🇺 𝐈𝐦𝐩𝐫𝐨𝐯𝐢𝐧𝐠 𝐀𝐮𝐬𝐭𝐫𝐚𝐥𝐢𝐚’𝐬 𝐜𝐲𝐛𝐞𝐫 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐜𝐨𝐧𝐬𝐢𝐬𝐭𝐞𝐧𝐭 𝐰𝐢𝐭𝐡 𝐢𝐭𝐬 2023-2030 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐲 The Government has released a legislative package known as the 𝐂𝐲𝐛𝐞𝐫 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐁𝐢𝐥𝐥 2024 that implements a range of initiatives aimed at improving cyber security. These initiatives include: ➡️ Mandatory standards for improving the security of Internet of Things (𝐈𝐨𝐓) devices ➡️ Australian businesses will have to report ransomware payments within 72 hours of being made ➡️ Establishing a cyber review board to investigate serious cyber security incidents ➡️ Making changes to security of critical infrastructure legislation relating to data storage systems ➡️ Establishing a National Cyber Security Coordinator 💥 These initiatives are still undergoing review but if passed before the end of the year will require organisations to act and start focussing a lot more on cyber! 💥 #Cybersecurity #Informationsecurity #Australia

6

Small Business Cyber Security: How to secure your small business from common cyber security threats. Credit: The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) #cybersecurity #Smallbusiness

5

https://lnkd.in/etFZF7PQ Cyber security training once a year isn’t working We all know how important it is to keep our people up-to-date on the latest cyber threats. After all, with cyber attacks on the rise, staying one step ahead is crucial to protect your business from potential breaches. But here’s the thing – annual cyber security training just isn’t cutting it anymore. Sure, it’s become a routine part of the calendar for many organisations. And it’s great that it’s happening at all. But ask any security leader, and they’ll tell you… employees find it time-consuming and uninspiring. From clicking through slides to skimming through videos at double-speed, it’s usually seen as just another box to tick. And let’s be honest, even for those who do engage with the training, there’s little evidence it leads to real behaviour change. That’s because the traditional approach lacks interactivity and doesn’t connect with employees on a personal level. It’s more about ticking boxes than building a culture of cyber security vigilance. Guess what? There’s a better way. It’s all about small, regular, human-centric interventions. Think of it like the speed signs you see when you’re driving. They remind people to stop and think before they engage in risky behaviour. Just as the signs work for driving, this kind of training makes your employees more aware of what they’re clicking. By nudging employees toward safer decisions in real-time, we can help them develop better cyber hygiene habits without overwhelming them with information overload. It’s about empowering them to make smarter choices every day. And with the amount of Generative AI and third-party tools we’re surrounded with right now, it’s more important than ever to give employees the guidance they need to navigate potential risks. Whether it’s through real-time coaching or policy reminders, we can help employees understand the importance of safeguarding sensitive data. So, while there may be a place for annual training, it’s time to think about using a more proactive approach to cyber security education. This is something we can help you with. If you want to learn more, get in touch.

1

The energy sector is becoming increasingly digitised, and as such, the risks associated with cyber threats are escalating. The frequency and complexity of attacks are growing, making traditional once-a-year pentesting inadequate for ongoing security management. Why Energy Companies in New Zealand Should Embrace Agile Pentesting For the energy sector responsible for maintaining critical infrastructure, adopting agile pentesting is the smart choice. Traditional, once-a-year pentesting is costly, time-consuming, and fails to provide continuous protection against emerging threats. Agile pentesting, on the other hand, offers a more affordable, scalable, and secure solution that aligns with the fast-paced, dynamic nature of todays energy sector. Read the blog: https://lnkd.in/gpRugzd7 Follow us: https://lnkd.in/gW6vPvki #AgilePentesting #NewZealand #EnergySector #CyberSecurity

11

Gain professional development in cyber security with Essential Eight Training! 💻 In today’s digital landscape, strong cyber security skills are essential. This course, designed by the Australian Signals Directorate, Australian Cyber Security Centre and delivered by TAFEcyber, equips cyber security and IT professionals with the knowledge and hands-on training needed to thrive. Throughout the course, you’ll delve into the Essential Eight strategies, gaining insights to assess and enhance your organisation’s cyber security posture effectively. With a mix of expert-led sessions and practical exercises, you'll develop the skills to identify vulnerabilities, implement robust security measures, and stay ahead of potential threats. Whether you’re looking to upskill, advance your career or ensure your organisation’s safety, this course is your pathway to success! Ready to take the next step? Discover more and enrol for Term 4 👉 https://lnkd.in/dDxnj9M4 #TAFEcyber #EssentialEight #CyberSecurity #ProfessionalDevelopment

31

2 Comments

Cyber attacks and security breaches have happened to some of the largest companies in Australia - which is why it's absolutely critical to have a governance plan in place for your organisation. The Cyber Security Directorate (CSD) is promoting the work of the Australian Institute of Company Directors (AICD) with this month’s cyber security awareness theme of Governing Through a Cyber Crisis. Included in the publication they have released, are recommendations that can be implemented by directors and board members to prepare for and respond to a cyber crisis. Download the guide and ensure your organisation is prepared to respond to and recover from cyber security risks: https://buff.ly/4dhjw59

1

Did you know that it's Cyber Security Awareness Month? 💻🔒 Australia's authority on cyber security, the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) has selected the theme of ‘Cyber security is everyone’s business’ for this year's Cyber Security Awareness Month, from 1-31 October 2024. The aim of the campaign is to reinforce the importance for all Australians to talk about cyber security with friends, family and colleagues, and take action where required. As a provider of cyber security services to organisations large and small, we felt it was important to share the campaign's four simple recommendations that everyone can use to improve their cyber security posture. 1) Turn on Multi-Factor Authentication (MFA): This means that two or more steps are required before you are able to login to online accounts. MFA is a very simple, but effective way to give your accounts an extra layer of protection. 2) Keep devices and software up to date: This can be as simple as ensuring that automatic updates are enabled, or installing updates as soon as possible after your device prompts you. 3) Use strong and unique passwords, such as a passphrase: A recent article by cybernews (see https://lnkd.in/d2cYn3f) showed that an analysis of over 15 billion passwords found in public data breaches revealed the most common password in 2024 was “123456”, and the second most common was “123456789”. 🫢 Passphrases are the more secure version of passwords and are normally made up of three or more random words that are easy for you to remember, but very hard for someone to guess. 4) Recognise and report phishing: Phishing is a trick used by scammers to get you to give them information such as login details. They may impersonate a business or person you trust, or may send you a dangerous link or attachment. For more information on Cyber Security Awareness Month, or for more resources for your family or business, visit: https://lnkd.in/g-THswin #cybersecurity #disp #securityawareness #defenceandsecurityexperts

8

Another Australian business affected through a 3rd party cyber incident, though in this article great pains are taken to explain that it is not their own systems but rather a 3rd party, yet who owns the data that has been exfiltrated and is now showing up on third party sites? Likening this to a personal situation, if I have household items and valuables stored at a storage facility, I will be damned certain that the storage facility is fully secure and I will expect them through the T&Cs of our agreement to have security in place. Always know what data you are sharing with your third party providers, in this case it would appear to be an unacceptable type of data (sensitive information) without sufficient security of that data, if it did need to be shared with this 3rd party provider. Data that must be shared with a third party, must be: - As little as possible to provide the service - For as short a time as possible to provide the service - At least as securely as your data security policies Thanks Brandon Dunlop for sharing https://lnkd.in/ggurmxhs

11

5 Comments

The State of Cloud Security Platforms and DevSecOps: A new survey by Cisco and Enterprise Strategy Group reveals the true contours of cloud native application development and security

1

Supporting Career Villages at Conferences in 2024! I am organising multiple career villages at conferences in Australia, BSides Canberra, BSides Melbourne, and Australian Information Security Association (AISA) CyberCon (Melbourne) this year. I am looking for industry professionals who want to share their knowledge, experience, and advice with others. Ideas for talks: 👉 Breaking down what you do in your job. 👉 Share your unusual journey into the industry. (help inspire others) 👉 Hiring managers advising on what you look out for when hiring. 👉 CISO sharing advice for aspiring CISOs. I am looking for people to join in on some panel sessions: 👉 Certifications 👉 Neurodiversity in cybersecurity 👉 Student to cybersecurity professional We will also seek volunteers to do resume reviews/ mock interviews. There are formal CFPs for BSides Canberra and BSides Melbourne, which you will need to complete, but if you're interested in helping out and don't know where to start/ want to register your interest, fill out the Google Form in the comments, and I can work with you on your submission. We haven't seen much in the way of gender diversity in submissions so far. It sounds corny, but be the change you want to see.

82

13 Comments

I just completed ANZ Australia's Cyber Security Management Simulation. In the simulation I investigated e-mails to report suspicious items. Analyzed a Packet Capture file using an open source tools

42

1 Comment

Curious about what the future of cyber security will look like in Australia in 2030? Here’s what the data in Australia’s Cyber Security Sector Competitiveness Plan is telling us: 🔒 The Australian cyber security sector could contribute an additional 32% to our economy by 2030! Based on current growth rates, it’s forecasted to reach a GVA of AU$5.2 billion 📈 🏢 We could see an estimated 500 sovereign cyber security companies thriving by 2030. But to stay globally competitive, we need to amp up our support for: - Cyber security startups and the commercialisation of their technology - Domestic procurement of Australian cyber security products and services - Public-private partnerships to attract and upskill cyber security talent - Attracting more investment in the sector - To meet the increasing demand, our sector will need an additional - - - 4,813 dedicated roles each year, totaling 85,000 roles by 2030 – a 66% increase from 2023! Curious about how we'll achieve this? Read the report here: https://hubs.ly/Q02zysgV0

1

𝗘𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹 𝗘𝗶𝗴𝗵𝘁 𝗳𝗼𝗿 𝗜𝗧 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 ＆ 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿𝘀 Discover the power of the Essential Eight cybersecurity strategy developed by the Australian Signals Directorate (ASD), a cornerstone framework for managed service providers (MSPs) to combat cyber threats effectively. 📌𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗽𝗮𝘁𝗰𝗵𝗶𝗻𝗴: Patching software addresses vulnerabilities, boosting cybersecurity defenses; while automated patching streamlines the process, fortifying against threats. 📌𝗢𝗦 𝗽𝗮𝘁𝗰𝗵𝗶𝗻𝗴: Regularly updating operating systems is essential to address security vulnerabilities. MSPs must assess and prioritize critical fixes to maintain network integrity. 📌𝗠𝘂𝗹𝘁𝗶-𝗳𝗮𝗰𝘁𝗼𝗿 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻: Adding additional authentication layers beyond user credentials strengthens security and mitigates risks in today's evolving threat landscape. 📌𝗥𝗲𝘀𝘁𝗿𝗶𝗰𝘁 𝗮𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗶𝘃𝗲 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝘀: Limiting access to authorized users minimizes the risk of lateral movement in the event of a network breach, enhancing data security. 📌𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗰𝗼𝗻𝘁𝗿𝗼𝗹: Vigilant monitoring and security protocols for third-party applications prevent unauthorized access to corporate data, reducing vulnerabilities. 📌𝗥𝗲𝘀𝘁𝗿𝗶𝗰𝘁 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗢𝗳𝗳𝗶𝗰𝗲 𝗺𝗮𝗰𝗿𝗼𝘀: Careful management of Microsoft Office macros—coupled with security protocols—mitigates risks associated with deprecated or vulnerable services. 📌𝗨𝘀𝗲𝗿 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗵𝗮𝗿𝗱𝗲𝗻𝗶𝗻𝗴: Strengthening user-based applications, particularly browsers, fortifies against potential exploitation by hackers targeting user accounts. 📌𝗕𝗮𝗰𝗸𝘂𝗽𝘀: Regular backups not only protect client data but also mitigate risks associated with ransomware attacks, safeguarding client reputation and data integrity. In conclusion, implementing the Essential Eight cybersecurity strategies outlined here is essential for MSPs to safeguard their clients' digital assets. This helps service providers stay vigilant and proactive in cybersecurity, upholding client trust and resilience in the face of evolving cyber threats. P.S: If you want to know more about ManageEngine MSP and how our partnership elevates your business, please read about us here: https://lnkd.in/g3vFEAKW #msp #mssp #cybersecurity #managedservices

47

6 Comments