IR at LinkedIn | focused on the intersection of data science, engineering, and cybersecurity | Scooping up APT and bopping them on the head | opinions my own
Joined October 2018
- Tweets2.5K
- Following262
- Followers1.7K
- Likes4K
Build a career where you always bring something valuable to the table - that can be depth, breadth, or even just unbridled tenacity and grit. If you do this, you'll find there's a seat for you more places than not.
When you have a file lock on the investigation timeline so some goober associate doesn't try to merge in their horrendously formatted system timeline into the main one while you're compiling new IOCs to track
(it me, I was the goober)
As Brian notes, blameless does not mean without accountability. You have to be able to say "X failed because Y team made Z choice". Blameless means you don't call out individual persons and try to ruin their lives over what is typically an honest mistake.
People often misunderstand opportunistic targeting (baiting) employed by threat actors. You know those signs you see stapled to a pole saying you can make XXk a month only if you call this number? Yeah, they don't need to fool you - just the person desperate enough to call them.
The best metrics strategy for security operations is to find a core set of signals (3-5) that are not all aligned with each other. How fast you close a case vs. how many cases have to be reopened. How many new detections you wrote vs. your overall SNR.
First World TTRPG Problems: A cool new dark, gritty setting comes out but all your "edgy" friends are now buttoned up IT professionals and only play 5E
All the fresh college grads joining world-class IR consulting firms:
Question for the infosec twitter brain trust - what is the best "cup check" audit you can do in a single day that when remediated will block the greatest amount of potential threats? I'm talking quickest of wins, lowest of fruit here.
If a detection fires in a forest and there's no SOC analyst around to triage the alert, does it make a sound?
This Post is from an account that no longer exists. Learn more
I fully see the ransomware ecosystem embracing the insider economy as labor relations in developed countries fray and maligned actors create marketplaces for disgruntled employees to monetize their anger. Unfortunately traditional security measures have little to offer here.
Since we're pouring one out for OSCP, one of the least broadcast benefits of the exam is how similar it was to actual pentesting work. There's nothing quite like wasting 12 hours of time chasing a nonexploitable syntax bug only to find something real an hour before test end.
They tell you about the love and pride and all the warm fuzzy stuff, but they don't tell you about how cool it is to do nerd stuff with your kids. Already anxiously awaiting Sonic 3 premiere with my kiddo.
I guess the new "OTF" unnecessarily controversial stance is that platform owners and operators have a moral obligation to reduce the harm their platform does to innocent people.
Charlie knows what he's talking about in a way few people in this industry can - modern platforms have an obligation to their users to remove malicious actors who abuse the product to hurt others.
A former manager of mine once created an evil robot replica of me, exact in every way, in order to frame me for gross misconduct. After the plot was discovered due to the clone's inability to divide by zero, I had a climactic battle with the manager atop a skyscraper.
