Aaron S.

A lot of system admins seem to either be asking or are being asked the question: "Why should we keep antivirus/EDR if it can cause the kind of damage we saw from the Crowdstrike incident?" We have to guide the conversation to the right questions, not the easy questions. This isn't a question about avoiding risk, it's a question about aligning risk posture to strategy. "What does our organization require for operations and competitive advantage?" "How do InfoSec capabilities support our ability to operate?" or "What will go wrong and how can we provide assurance?" "What requirements or limitations exist that can help inform our selection of technologies to deliver an InfoSec capability?" "Are our InfoSec capabilities enhancing our competitive advantage?" This aligns at a high level with the questions that frame the "Threat Modeling With ATT&CK" project. It's a good read and worth the time. https://lnkd.in/gGU3F8EX

1

One of the most common reasons IAM consultants are considering something new right now is that they were promised things that didn't/won't happen... Salary increases, 'we'll pay & give you time in work for your certifications', 'we have loads of projects in One Identity...' There's a demand for IAM consultants. Hiring is hard, but retention is also so important, and so is reputation. A few things to think about: 1. 🆔 Be honest in your interview process about what this person is coming in to Of course you want to share the 'best version', but make sure what you share is reality. 2. 🆔 Take the time to understand what the people you interview actually want Think beyond just skills & cultural fit, what do they care about, what will challenge them etc...) Welcome the 'right' people, encourage great people who might not be 'right' to explore other things 3. 🆔 Be aligned on expectations & think carefully about 'promises' you make 'We'll figure it out when they start' is probably not the best tactic - have some alignment BEFORE they start, only promise what you can actually deliver on, seek feedback/encourage feedback sharing... Happy IAM consultant hiring! ✌🏻😎 #iam #identityandaccessmanagement #recruitment #dontmakepromisesyoucantkeep

32

6 Comments

Imagine a SOC analyst with one tab open while running through an incident! Thomas Los gives a short demonstration of how StrikeReady delivers this to our customers. There are no required vendors as StrikeReady is vendor agnostic. The advantages of consolidation only start there, if this has your interest let's have a short conversation and decide if a demonstration makes sense.

3

Do security certifications impress you? ✅ SOC 2 Type 2 ✅ FedRAMP ✅ ISO 27001 It shows companies are putting in effort.  But here’s the truth:   Certifications don’t equal bulletproof security.   It shows *effort.* SOC 2 Type 1, for instance, means you've been audited.   But are you really doing *everything*?   Real security is in the ongoing journey.   The ongoing effort of building trust and policies to keep your shareholders safe. ---------- Hey, I'm Ross! 🎯I'm an IT person, I love helping other IT people. I also love helping people with cybersecurity and compliance. If you enjoy my content, you should know: 🔔 I help healthcare organizations with their IT.

31

12 Comments

I'm torn here... not sure govt can do a lot here, but applaud the effort. I like removing degree requirements for some positions for reasons already discussed at length, but not for all as it's still the most effective large scale soft-skill filter. Obviously this filter is less than ideal, but tell me a better one. I think training programs are a step in the right direction, but part of me thinks there is less available capability among the target set humans for these programs than we think. I think there needs to be a better filter here too for those to push through these programs. When I was in govt part of me naively thought this was something the market was well positioned to address with higher salaries, etc. Obviously not a silver bullet either. In many ways the gap is no difference than the one for other skilled trades. It seems the most effective solution there is apprenticeship programs, so maybe that's best here too. Thankfully that's number 2 on the list, but curious how to encourage that at scale across businesses with little incentives for them w/o grants/etc. Just my 2 cents to chew on. https://lnkd.in/ezjSR3cu

18

5 Comments

Learning how to properly image and build multiple machines at once is a key skill for anyone in IT.

2

"Flipping the map" on how attackers can use MSP/RMM capabilities is invaluable to understanding how organizations might limit the impact of a compromised RMM.

7

The harsh reality of what's happening in the cyber security jobs market right now... Despite mass layoffs hitting the headlines client organizations are hiring very aggressively and paying headhunting fees, not just mine there are other good specialist recruiters out there… So why are so many folks finding it hard to land a role & get off the jobs market? The truth is client organizations are looking for grade A top tier talent, the hard to reach, passive types that actually don't want to be found or approached. Literally the best! 95% of the employer market is after the top 5% of cyber security talent & it's one of the many reasons why job adverts are a complete joke (which I won't go into now). Basically the demand is extremely high within this subsection of the market and that's the hard truth not everyone is willing to talk about on a LinkedIn post... I'm seeing this more & more in my day job as a security recruiter. There's a huge misconception within the wider community that specialist recruiters are here to help absolutely everyone and generally get people a job, this is not the reality of what we do at all. We're paid to target and recruit a very specific ICP (Ideal candidate profile) that very few are able to access themselves. The sorts that can only be accessed by recruiters that have done a solid job in a niche for a long time, have incredibly strong networks & relationships in this space. There's no quick wins here, it's bloody hard graft... Advice for cyber security folks: Listen to the market & never play the victim. Fair or not, ultimately we are all slaves to this market and it's very unforgiving. Corrections don't care about our emotions so spend some time looking at where the high demand is. What are clients looking for? What does a grade A top tier cyber security professional look like? What's her communication style like? What does his personal brand look like? How does she interact with the community?… There's still opportunity out there, the rewards are still immense & hiring demand right now is stupidly high! All opinions, thoughts and comments here are very welcome. Let's debate, discuss, interact, and create a community on this platform so that everyone has the information they need to have an awesome cyber security career. After that it's up to everyone how they choose to utilize this info...

176

66 Comments

Is anyone else in an infosec leadership position just NOT ready to stop being technical? I've read so many posts about the 'natural progression' from engineer/analyst to leader and I'm a little nauseated by the comments. "You don't need to do that anymore": False. Your team knows when you don't know what you're talking about. Yes, as a leader you should delegate and rely on the expertise of your team, BUT, you really need to know at a base level what your team members are doing so you can effectively prioritize efforts and communicate it up the chain. "You don't have time to dig in": This should be false as well. If you don't have time to devote to keeping skills sharp, I would argue that you're either at the wrong place or you need better time management skills. I guarantee you could trade-in your doom scrolling time and have plenty of time to upskill. "Why would you want to? You made it!": Nauseating. I'm in this line of work because I have an unhealthy obsession with understanding how things work and want to break them / make them better. If you chose security just because it pays well / it's a hot industry, and you don't actually enjoy the work or understand the technical side.. you might be what's wrong with security leadership. This concludes my quarterly rant about my beloved industry.

82

35 Comments

The modern SOC analyst has at least a dozen tabs open at any given time and may as well get whiplash pivoting between them trying to work an incident.. it's brutal, and it does not have to be this way. Do your investigation in one place, no matter the technology stack and write zero code. Others have an allegiance to the technology they sell, which makes their platform, but our allegiance lies with you, the defender and our goal is to empower you. Let's grab some time and let me show you how StrikeReady can make your life easier and the investigations you do much more efficient. I'll be at Blackhat as well to meet up so let's get together and chat. #StrikeReady #SOC #SecurityOperations #Blackhat #BHUSA

51

2 Comments

There's a site that can tell you if your SSN was leaked from the personal security company Pentester. You must input your first name, last name, year of birth, and what states you've lived in. If your SSN was leaked, the site will present you with a chart showing your address in the record and the last two numbers of your SSN. If you don't find your records associated with your current state or name, try searching for previous states and/or other last names. I tested this tool and found legitimate records listed. https://lnkd.in/gsMkUMXR

1

When evaluating MSPs, I wouldn't recommend getting IT for "affordable" or "cheap". Doing what we do correctly, is not cheap. It's not cheap to buy proper cybersecurity tools. It's not cheap to hire dedicated skilled engineers.    You want to ensure your company has: - Properly secured (and monitored) network, endpoints, and data - Backups! - Multi factor authentication - Cybersecurity education awareness and training - A team you can rely on if something isn't working right, or worse, it all goes wrong. When it comes to protecting your business, you get what you pay for. Cutting corners in cybersecurity can cost you everything.

34

5 Comments

🚨CISA released an alert warning that bad actors continue to exploit OT and industrial systems using unsophisticated means. It’s an important message for anyone in ICS security since much of the exploitation they’re seeing is preventable with relatively simple fixes. Though ICS, of course, has a slew of unique challenges that can be a barrier to implementation. The alert notes that “Exposed and vulnerable OT/ICS systems may allow cyber threat actors to use default credentials, conduct brute force attacks, or use other unsophisticated methods to access these devices and cause harm.” They urged operators to implement the recommendations in the CISA resource Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity. Here are a few key recommendations from the CISA resource: ⚠️“Disconnect all HMIs, such as the touchscreens used to monitor or make changes to the system, or programmable logic controllers (PLCs), from the public-facing internet. If remote access is necessary, implement a firewall and/or virtual private network (VPN) with a strong password and multifactor authentication to control device access.” ⚠️“Implement multifactor authentication for all access to the OT network.” For additional information, see CISA’s More than a Password resource. ⚠️“Immediately change all default and weak passwords on HMIs and use a strong, unique password. Ensure the factory default password is not in use. Open the remote settings panel to confirm the old password is no longer shown.” ⚠️“Keep VNC updated with the latest version available and ensure all systems and software are up to date with patches and necessary security updates.” ⚠️“Establish an allowlist that permits only authorized device IP addresses. The allowlist can be refined to specific times of the day to further obstruct malicious threat actor activity; organizations are encouraged to establish alerting for monitoring access attempts.” ⚠️“Log remote logins to HMIs, taking note of any failed attempts and unusual times.” See the alert on CISA’s Cybersecurity Alerts and Advisories page (separate from their News page): Threat Actors Continue to Exploit OT/ICS through Unsophisticated Means SEP 25, 2024 - Alert

17

14million. That’s the estimate by Qualys of the number of servers potentially vulnerable to CVE 2024-6387 aka regreSSHion that are “exposed to the internet”. That seems like a lot of machines to me. I’m not a security specialist and while we do a little work for some of our smaller clients that involves internet facing services the bulk of what we do is on private corporate networks. I’m not the best person to comment on this, I accept that. But still. I’m still a little surprised at the number of machines that would have a valid use case for having an SSH daemon process exposed to the internet. Or have I just misunderstood the statement by Qualys? Whenever we design systems, HPC or not, cloud or on-prem, large scale enterprise or early stage startup, access to everything is designed to be at the lowest possible level. Servers do not have SSH daemon port exposed to any public networks.  That sort of access is always via another level of indirection. A bastion host, a jumpbox, via a corporate secure link. Oh and you write a test case for every bug you fix so they’re not regressed right? (Yea I know race conditions are kind of a pain/impossible to do… )

6

Hence why I make it a point to carry a battery brick with me wherever I go. I'm not *against* using these types of outlets, but they seem more of a last resort rather than an interface to avoid entirely. Of course, you could be proactive and charge your battery brick here and THEN your phone...with the brick.

2

1 Comment

Great supply chain attack example & its wild. I'm seeing some of these alerts that led me down the rabbit hole. policytype="policy" srcport=51642 dstport=443 attack="malicious-url" direction="outgoing" user="JohnDoe" authserver="fsso collector" msg="URL blocked by malicious-url-list" profile="IPS" crscore=30 craction=8192 crlevel="high" hostname="cdn.polyfill.io" url="/" https://lnkd.in/gxTp3JhX

1

"It is no surprise that we have over 500,000 cybersecurity job vacancies and a severe shortage of skilled practitioners to fill those vacancies. https://lnkd.in/eErBwPfb" The cybersecurity experts ratio between rivals and us is 50:1 (FBI). A reasonable solution is to use a revolutionary cybersecurity defense system to catch up on this gap. It is similar to using AI and robots to automate industrial production that substitutes for skilled technicians shortage in the future. A good choice for this solution is to build the Computing Architectural Secure System (CASS), a system-wise cybersecurity design, multiple-factor defense, and quantum and AI hacking-resistant as a fundamental infrastructure for a cybersecurity defense system. US10972256 gives a detailed description, and www.Archss.com gives its history.

2

How to lessen the impact of complying with DFARS CUI requirements (DFARS 252.204.7012) or the CMMC program assessment you may be required to meet. Yes, the costs will be high esp. for an SMB. The answer is a business answer and not a cybersecurity answer at all. When I study P&L statements and balance sheets with my financial review team (these days that means by myself :p), I see large expenses that are spread out across months and quarters. This is how to avoid that large lump payment that hurts. The same for the DFARS and CMMC preparations. Spread out your workload across 12-18 months. Pay for services as you need them in small affordable amounts. For example, make a $30k CMMC preparation a $1600/Month expense over 18 months. There is another secret benefit to this approach - most compliance experts will tell you that it takes that long anyway if you are to truly implement a proper and passable cybersecurity program. So many of the answers to managing a cybersecurity program can be found in the daily business practices you already are doing. I have been studying how to lessen the burden on SMB's to achieve compliance and have some controversial ideas that I have been slowly unwinding here. They include: 1. [Executive Leadership] CEO emotional intelligence (EQ) - no this is not an attack but a concept for executive leadership if you have read anything about it [Subtopic Executive Coaching] 2. [Team Building] Team Transparency and commitment. 3. [Project Management] Use of tools like OKR's to keep the 18-month program on track and accountable to each other (another sign of EQ). Trust is good but verification is better. 4. [IT Planning and Management] Putting together the right mix of tools (yes you might choose to buy some software for parts of this) that will help you cover a majority of the security controls and requirements without overlap. 5. [Board Room Discussion] Consideration of your IT architecture and migrations to platforms that will ease the compliance burden. 6. [HR} Find a compliance SME that your team can work with over the 18 months and beyond. Get the right consultant on the bus and get the wrong consultant off the bus. Food for thought. #CW #ceomindset #CMMC #cybersecurity #DFARS

2

1 Comment

It feels like there's a massive data breach being leaked or sold every day now. I don't recall a time like this before. What's going on? I remember when there were months between major database leaks (like during the Ashley Madison era). It seems that although cybersecurity is on everyone's mind and ransomware poses a real threat to businesses, hackers are still able to exploit companies in ridiculous ease. Most of these attacks are due to preventable reasons like poor credential management, lack of MFA, and tokens or secrets left in public or private repositories. How is it that in an industry worth trillions, which understands these problems and sees new startups created every day to tackle these issues, we still see breaches happening daily? *While I agree with Swift about the costliness of holistic cyber-defenses, it is worth emphasizing that most breaches are so easily preventable with proper cyber hygiene (e.g don't let your employees download infostealers on their work computer or save corporate credentials on their home computer). Edit: removed IntelBroker’s recent db examples because idk if they were verified or not.

62

21 Comments