Josh Madakor

Warning ⚠️ Rant post about CompTIA: Why CompTIA… I took the CompTIA Cloud+ CV0-004 Beta exam in the last possible week in February. I have been taking CompTIA exams since 2015, and have taken their beta exams before. The usual CompTIA exam cycle is about every 3 years, and I expect Beta results to take 3-5 months until the release day of the new version, no problem. Now onto the rant. The new Cloud+ version isn’t being released until September 10, 2024… For early Beta test takers that is about 9-10 months, and in my case 7 months, to receive results. That is just absurd. Do better CompTIA. That is all.

23

2 Comments

I recently posted in anger about SPAM SMS text and robocalls and I'm sorry... ...sorry I didn't spend that 10 minutes perfecting my PowerShell Selenium SPAMReporter script. I now have the capability to bulk report millions of spam calls on behalf of victims to enablers like Bandwidth Inc. using their own forms. No API needed. Just PowerShell expertly guiding Selenium to automate the forms filling and submission process. The FCC database contains 1.57M rows of unwanted call reports. If telephony providers continue to shirk their responsibilities and put the onus on the victims to report these bad actors, then I can submit 1.57M reports to all 9000+ STIR/SHAKEN registered providers. #SPAM #Cybersecurity #Robocalls #Robotext #Robosms #SMSSpam #ElectionSpam

17

2 Comments

Hello GSA Contract Holder, This is to invite you to a free informational webinar designed specifically for GSA Schedule holders interested in the upcoming GSA SCRIPTS BPA opportunity. This is a $919M multiple-award BPA opportunity with 8 awardees, with small businesses set aside and full and open tracks. SINs are 518210C, 54151ECOM, 54151S, 541614SVC, 541990RISK, and 541611. Webinar Schedule Wednesday, August 21st, 2:00 PM EST Thursday, August 22nd, 2:00 PM EST Register here: https://lnkd.in/gxGXrxCF Why You Should Attend This is an exclusive 10-year opportunity set aside for GSA Schedule holders. The final RFP is anticipated to be released in October 2024, so now is the time to prepare! What You Will Learn in the Webinar Background to the GSA SCRIPTS Opportunity: Understanding the pain points and the necessity behind SCRIPTS BPA. The SCRIPTS BPA Opportunity Explained: A high-level overview of the GSA SCRIPTS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

1

This is to invite you to a free informational webinar designed specifically for GSA Schedule holders interested in the upcoming GSA SCRIPTS BPA opportunity. This is a $919M multiple-award IT opportunity with 8 awardees, with small business set aside and full and open tracks. The RFQ was issued on August 19th and you have approximately a month to prepare your proposal. Webinar Details Wednesday, August 21st, 2:00 PM EST Thursday, August 22nd, 2:00 PM EST Register here: https://lnkd.in/gxGXrxCF Why You Should Attend This is an exclusive 10-year opportunity set aside for GSA Schedule holders. Your proposals are due by September 16th, so now is the time to prepare! What You Will Learn in the Webinar Background to the GSA SCRIPTS Opportunity: Understanding the pain points and the necessity behind SCRIPTS BPA. The SCRIPTS BPA Opportunity Explained: A high-level overview of the GSA SCRIPTS opportunity. The Proposal Requirements: A detailed discussion on how to prepare a winning proposal. The Source Selection Process: Insights into how the government's source selection process works. Partnering: How partnering can enhance your chances of success. Strategy Recommendations: Tips and strategies to increase your win probability. Q&A Session: Get your questions answered by industry experts. Register now to secure your spot in the webinar and take the first step towards winning this lucrative contract. We look forward to seeing you there!

1

Easy Interview Here!

2

1 Comment

🤔 Are you with a grant funded, higher ed, or non-profit type org that part of the goal is to help educate children on #cyber and #STEM? Do you have coloring pages as part of a kit? 🖍️ -------------------------- I run Simply Cyber, a wonderful community of 10,000's of cyber practitioners, and many have kids that are adjacent or directly involved with community! 👨‍👩‍👧‍👦 We are running a coloring contest and wanted to collab... 🥳 -------------------------- I can just generate cyber themed coloring pages, but why not bring attention to your org and its mission also. 💙 🚨 If you do have cyber themed coloring pages and wanted to collab drop it in comments or DM (but seriously my DMs are always slammed so comment would be better). ⬇️ Link to the coloring pages, or tell me about your org (or link to org), and we can get this going. -------------------------- Plz repost ♻️ for reach so we can get fun activity for the kiddos as well as bring awareness to orgs out there helping kids be safe online! -------------------------- Inspired by the work I saw at Center for Infrastructure Assurance and Security

75

24 Comments

Yet again, I run into the utter dumpster fire that is Python, its packaging, and modules. I'm preparing for a class next week. Either I need to create a VENV so I can install all of the modules, or I can install half of the modules because they've been packaged by Ubuntu. How is this even considered a functioning language? It's like it was designed to be the epitome of "works on my machine"! Even the `pip install -r requirements.txt` mechanism is so broken that an entire OTHER APPLICATION has been created to solve its design shortcomings, Poetry!

2

4 Comments

Can we PUH-LEASE end this practice of referring to Windows Event Log event records solely by event ID??? Folks, event IDs are not unique. The event ID 4624 means something entirely different if the source is "Microsoft-Windows-Security-Auditing", than if it is "EventSystem". The same is true for event ID 4625.

81

8 Comments

This is not the only part that's funny about online recruitment The other day, I filled an application form for freelance academic writers Came across the advert on an online job board (won't mention names to avoid litigation) The application process was so stressful I even had to write two academic essays of 300 words each before I was allowed to submit the form When I finally completed the form and submitted, I got an instant automated notification on my email, acknowledging the receipt of my application. They said they will review it within 3 business days and then get back to me with their decision. Since that was on a Sunday, I assumed the result will come out by Wednesday or Thursday. But before I could drop my phone or even open another message, another email came in from the firm. This time, it was an "unfortunately, you do not have the type of skills we seek" 😂😂😂 Now, the funny thing here is, there is no part of the application form that asked for related skills. I assumed the essays I wrote will capture them. So how they check my skills so fast? And on a weekend? If you ask me, I'll say they used that call for application to collect essays for clients without paying their writers. Or, they are training AI with them. Another thing here is that they may be using them to draw traffic to their website and possibly advertise their services without paying for them. Whichever one it is, I believe the firm is a hoax.

1

He's right; take note. If you're trying to break in to cyber security, read this. Cyber security, generally, is an *advanced* IT role. Meaning: you have to do the basic and intermediate IT roles first. This used to be the "normal opinion", but some people these days think you can just break in to cyber security without doing basic and intermediate IT jobs first. Sure you can, but that's not the ideal path and it certainly ain't the quick and easy path.

2

Thank you Jacob Hill for the awesome GRC videos on YouTube. You should link up with 👉🏼 Gerald Auger, Ph.D. that would be epic. Have a great Monday everyone!! Also, if you’re looking to expand your knowledge base around GRC, frameworks, standards etc. check out GRC Academy

22

1 Comment

**Windows/Sysinternals People** Got a question for you. Apologies if this is a daft set of questions, blame my mac/linux background. Are you aware that you can run Sysinternals without having to download the tools? Just run the tool in Windows Explorer as live.sysinternals.com/<toolname> or \\live.sysinternals.com\tools\<toolname> Now, I get that part of the equation is not giving people local admin - but how is this not a red flag from a security perspective. Some of the better live off the land techniques utilise Sysinternals, but now it just works without downloading it? Does that bypass Application Control / Allow-Listing (even though many of them will likely allow it because it's signed by Microsoft)? NotPetya packaged in a version of PsExec for spreading, is it possible that the next auto-spreading malware could just use the live tools rather than bundling it? Any smart windows people feel like weighing in on this?

12

15 Comments

Do security certifications impress you? ✅ SOC 2 Type 2 ✅ FedRAMP ✅ ISO 27001 It shows companies are putting in effort.  But here’s the truth:   Certifications don’t equal bulletproof security.   It shows *effort.* SOC 2 Type 1, for instance, means you've been audited.   But are you really doing *everything*?   Real security is in the ongoing journey.   The ongoing effort of building trust and policies to keep your shareholders safe. ---------- Hey, I'm Ross! 🎯I'm an IT person, I love helping other IT people. I also love helping people with cybersecurity and compliance. If you enjoy my content, you should know: 🔔 I help healthcare organizations with their IT.

31

12 Comments

Copied: Are you a hiring manager in infosec? Can you spare 5 minutes to share your thoughts on the current state of cybersecurity talent with Minorities in Cybersecurity? Minorities in Cybersecurity operates workforce development programs to train, place, and mentor professionals from underrepresented groups throughout their career -- we don't Ding Dong Ditch (shout out to my fellow 90s kids!). To help ensure we're preparing new talent with the skills and experience you need for your teams, please fill out the survey below. ✍️ Survey: https://lnkd.in/gAaUsbzS

3

1 Comment

I’m seeing more “I’m Hiring” posts in cybersecurity over the last 30 days than I’ve seen in the last two years. (Anecdotal data, sure, but I’m pretty perceptive.) Here’s what I’m noticing: - SaaS companies that froze in place are thawing and hiring again. - Consulting and services firms—especially in DFIR and Business Continuity—are seemingly crushing it. - AI companies are maturing, creating net-new security roles as they scale. - And FAANG? They’re hiring more. Let’s be honest—50% of a company’s business strategy is often just “follow FAANG. 😂 What does this mean? Stay open, but stay sharp Keep an ear out for new opportunities, but be mindful. Think about how companies have navigated the last two years and factor that into your decision-making process. Hiring is about to get tougher (again). If you’re a company, what worked for your hiring strategy in 2023 or early 2024 may not cut it in 2025. Movement is at the IC and mid-management level—for now. Most of this hiring boom is happening below the leadership level. That said, I expect (and hope) leadership hiring will pick up more fluidly in 2025. Watch out for AI-generated resumes. This is the first hiring upswing since tools like ChatGPT became mainstream. Your “perfect” candidate might require deeper vetting beyond “Wow, they did the exact same thing at a competitor” on paper. I’m glad the market is warming up. It’s been a tough couple of years, seeing so many great people struggle to find work or feel stuck in roles they’re miserable in. Of course, I have a vested interest in a more active hiring market. But beyond that, I truly want everyone in this ecosystem to find what they want and deserve. Here’s to (hopefully) better days on the horizon.

171

10 Comments

320 is an important number. Why? Say your team spends just 5 minutes and 20 seconds every day going through the Level 2 CMMC Assessment Guide. You will read the whole thing 3 times in 3 months. I’ve written about this before: https://lnkd.in/dhyffJcX. And while you’re reading, take a couple of days and apply your knowledge to a tabletop exercise. Go through every single artifact or piece of evidence. Review how your team will answer questions assessors may have. That way, everybody on the team is ready. Remember, as assessors, we are looking for real muscle memory. It’s not enough to check the box or have a policy sitting in a filing cabinet somewhere. You need to demonstrate that you have been fulfilling all 320 CMMC requirements, as an integrated part of your operations. As always, we here at MNS Group are happy to answer any questions. So get reading! #DoD #CMMC #contractors #cybersecurity #assessment

50

Hm. Microsoft seems to have come up with a new "security convenience" which I didn't want, and more importantly is far weaker security. Specifically when I log in it wants to send a "code" to my email account. Since September I have been getting these "codes" from people trying to log in from Turkey, China, Iran, the gang of usual idiots. Fine. However this account has (a) A strong password, (b) TOTP based MFA and (c) nothing of value. Normally it wouldn't be a problem as MS would TOTP anyone who managed to somehow guess the password.... But now apparently I can just type my email address and a "code" is sent to my personal email. Enter code, totally logged in. Bypasses password AND TOTP *and* makes it easy for random flunkies to drive me nuts with fake requests. Thanks Microsoft for continuing to waste my time and insisting on using an easily findable email address as my "username". Not sure when they started this, but it looks like it goes back to September. Edit: Hilarious update: You CANNOT REMOVE the email validation method as an appropriate auth. This basically turns Microsoft's accounts into a super weak system with a hole by default. *sigh*

14

1 Comment

🎉 Just wrapped up a security presentation for an incredible group of recent grads. They came in with knowledge far beyond what I expected—already fluent in foundational security concepts, equipped with hands-on experience using Kali OS, and familiar with network sniffing! 🌐🔍 It's inspiring to see how much security education has evolved in recent years. This new generation of professionals is entering the field with a solid foundation, ready to dive deeper into advanced topics. For anyone working with early-career talent: never underestimate their level of expertise! I’ll definitely be adding more real-world scenarios, advanced topics, and practical case studies to keep them challenged and engaged. 💡 #Cybersecurity #FutureOfTech #EarlyCareerTalent #InformationSecurity #KaliLinux #NetworkSecurity #CyberEd

20

1 Comment