If your organization cuts budget and resources and expects you to perform superhuman efforts to make ends meet. start planning an exit. Nobody deserves this treatment
September 6, 2025 at 4:29 PM
If your organization cuts budget and resources and expects you to perform superhuman efforts to make ends meet. start planning an exit. Nobody deserves this treatment
You may be told or say that you are the last line of defense between your organization and an attacker, but your health and mental health comes first. Advocate for yourself and don't be afraid to say no
September 6, 2025 at 4:28 PM
You may be told or say that you are the last line of defense between your organization and an attacker, but your health and mental health comes first. Advocate for yourself and don't be afraid to say no
Your options are to curl up in a ball and hide - or rise and meet the challenge. You are going to have failures and troubled times. Don't burn out. If you're on the blue team, your job is important
September 6, 2025 at 4:28 PM
Your options are to curl up in a ball and hide - or rise and meet the challenge. You are going to have failures and troubled times. Don't burn out. If you're on the blue team, your job is important
Many people you see in the field have been through tough times. This is not our first downturn in tech - many of the downturns in tech happened before cybersecurity was even its own discipline
September 6, 2025 at 4:28 PM
Many people you see in the field have been through tough times. This is not our first downturn in tech - many of the downturns in tech happened before cybersecurity was even its own discipline
Informal CTI sharing does rhyme a lot with unauthorized information disclosure, so be mindful of what you choose to share
September 6, 2025 at 4:28 PM
Informal CTI sharing does rhyme a lot with unauthorized information disclosure, so be mindful of what you choose to share
It costs zero dollars to spin up a [didn't catch the name of this] server, share it with 5 friends and then go. You can take your phishing indicators (ASM, types of pretext, malware samples) and push them there
September 6, 2025 at 4:28 PM
It costs zero dollars to spin up a [didn't catch the name of this] server, share it with 5 friends and then go. You can take your phishing indicators (ASM, types of pretext, malware samples) and push them there
These are informal relationships. There should be no expectation of an immediate response. You should reciprocate! You have access to data and even a "I'm not seeing anything" is useful. Informal CTI sharing groups are where I get my best threat intel
September 6, 2025 at 4:27 PM
These are informal relationships. There should be no expectation of an immediate response. You should reciprocate! You have access to data and even a "I'm not seeing anything" is useful. Informal CTI sharing groups are where I get my best threat intel
Build "phone a friend" relationships. Some of us may remember when Oracle Cloud may or may not have come under fire. Asking in informal sharing groups about what logs they were looking at helped to have a huge field of view despite only a few clients of my own
September 6, 2025 at 4:27 PM
Build "phone a friend" relationships. Some of us may remember when Oracle Cloud may or may not have come under fire. Asking in informal sharing groups about what logs they were looking at helped to have a huge field of view despite only a few clients of my own
Are your analysts looking up URLs and attachments on VirusTotal? Those are API calls. Are your analysts looking for any other emails from the same sender as your suspected phish? That's an API call
September 6, 2025 at 4:27 PM
Are your analysts looking up URLs and attachments on VirusTotal? Those are API calls. Are your analysts looking for any other emails from the same sender as your suspected phish? That's an API call
Every automation I've designed follows the 80-20 rule. I get 80 percent of the work done with only 20 percent of the effort. Tackle small components of the overall task. Where do you spend the majority of the time on your tickets?
September 6, 2025 at 4:27 PM
Every automation I've designed follows the 80-20 rule. I get 80 percent of the work done with only 20 percent of the effort. Tackle small components of the overall task. Where do you spend the majority of the time on your tickets?
Fail fast in the process. If you try something and it doesn't work, take detailed notes on what you did and why it didn't work. Block out an estimate of time, bail out if you exceed double that estimate
September 6, 2025 at 4:26 PM
Fail fast in the process. If you try something and it doesn't work, take detailed notes on what you did and why it didn't work. Block out an estimate of time, bail out if you exceed double that estimate
I focus on small, easy to develop automations. I automate tiny pieces of the workflow that buy me back time, I don't try to build a fully automated system. Think of it as semi-automated
September 6, 2025 at 4:26 PM
I focus on small, easy to develop automations. I automate tiny pieces of the workflow that buy me back time, I don't try to build a fully automated system. Think of it as semi-automated
There's grunt work you don't want to do but that's valuable for gaining an understanding of how everything fits together in security, ex. validating firewall rules
September 6, 2025 at 4:26 PM
There's grunt work you don't want to do but that's valuable for gaining an understanding of how everything fits together in security, ex. validating firewall rules
Instead of FTEs, consider hiring interns. Pay them, obviously. You may not be able to convert them to FTEs due to your budget pressures, but you are doing interns a favor by giving them valuable experience
September 6, 2025 at 4:26 PM
Instead of FTEs, consider hiring interns. Pay them, obviously. You may not be able to convert them to FTEs due to your budget pressures, but you are doing interns a favor by giving them valuable experience
Say something along the lines of "I have this budget, I want to see if I can partner with you on this part of my security strategy." It really is a partnership, a two way street of feedback and continuous development
September 6, 2025 at 4:26 PM
Say something along the lines of "I have this budget, I want to see if I can partner with you on this part of my security strategy." It really is a partnership, a two way street of feedback and continuous development
New products may be hungry for your logo power! You may be able to replace one of your existing vendors for a tiny fraction of the cost you're currently paying
September 6, 2025 at 4:25 PM
New products may be hungry for your logo power! You may be able to replace one of your existing vendors for a tiny fraction of the cost you're currently paying
Azure ARM templates already have security baked in, if you want. Pay as you go services are great for budget consolidation/cuts. Using platform-native tools for security deployments may be able to move the cost into ops budgets
September 6, 2025 at 4:25 PM
Azure ARM templates already have security baked in, if you want. Pay as you go services are great for budget consolidation/cuts. Using platform-native tools for security deployments may be able to move the cost into ops budgets
You can reuse certain tools in unconventional ways in order to get better coverage. Sysmon can do file integrity monitoring for specific files and you can track whether these changes are valid changes in your environment
September 6, 2025 at 4:25 PM
You can reuse certain tools in unconventional ways in order to get better coverage. Sysmon can do file integrity monitoring for specific files and you can track whether these changes are valid changes in your environment
How many people know that you can capture copies of deleted files using SysMon? Like binary copies? This is an amazing capability for the low low price of free. Commercial EDR will give you a hash, but Sysmon will give you the file itself
September 6, 2025 at 4:25 PM
How many people know that you can capture copies of deleted files using SysMon? Like binary copies? This is an amazing capability for the low low price of free. Commercial EDR will give you a hash, but Sysmon will give you the file itself
Sysmon is the Clippy of Windows Event Logs. If your EDR budget is cut, try out Sysmon in order to get decent telemetry. Olaf Hartong has Sysmon configurations available on their GitHub
September 6, 2025 at 4:25 PM
Sysmon is the Clippy of Windows Event Logs. If your EDR budget is cut, try out Sysmon in order to get decent telemetry. Olaf Hartong has Sysmon configurations available on their GitHub
Wazuh gathers the data for you, but it does not do any blocking and it does not have the built in rules you'd get with a commercial EDR. You can deploy it immediately for the low low price of "free" in terms of licensing
September 6, 2025 at 4:24 PM
Wazuh gathers the data for you, but it does not do any blocking and it does not have the built in rules you'd get with a commercial EDR. You can deploy it immediately for the low low price of "free" in terms of licensing
If you get threat Intel about an IP address and want to look back a few months to find it, it's trivial to do in Security Onion. It has a built in ELK stack to ingest log sources from just about anywhere. Wazuh has an endpoint agent for mini-EDR (not comparable to commercial)
September 6, 2025 at 4:24 PM
If you get threat Intel about an IP address and want to look back a few months to find it, it's trivial to do in Security Onion. It has a built in ELK stack to ingest log sources from just about anywhere. Wazuh has an endpoint agent for mini-EDR (not comparable to commercial)
You start getting visibility and telemetry with Security Onion. It isn't going to block anything. I'm okay with that! I can have a multiple month running log of traffic with SO. You can skip config and just let it run and it will help you in an investigation
September 6, 2025 at 4:24 PM
You start getting visibility and telemetry with Security Onion. It isn't going to block anything. I'm okay with that! I can have a multiple month running log of traffic with SO. You can skip config and just let it run and it will help you in an investigation
I'm a big fan of Security Onion. Your firewall logs are not sufficient for incident investigations, and it turns out SO is free! You don't need fancy hardware or appliances in order to feed SO, it works fine on legacy hardware
September 6, 2025 at 4:24 PM
I'm a big fan of Security Onion. Your firewall logs are not sufficient for incident investigations, and it turns out SO is free! You don't need fancy hardware or appliances in order to feed SO, it works fine on legacy hardware
You are way better off picking the things you /can/ do well and affirming that you /cannot/ do certain things, ex. some kind of perfect "data loss prevention" program or technology
September 6, 2025 at 4:23 PM
You are way better off picking the things you /can/ do well and affirming that you /cannot/ do certain things, ex. some kind of perfect "data loss prevention" program or technology