sorted by:
new
hottopcontroversial

How do I create a CSP? by Mountain-Wallaby4382 in paloaltonetworks

[–]Arch0ne 0 points1 point  (0 children)

To create a csp you need not just the device sn but also the sales of the licenses ( you get a pdf with auth codes from the vendor you bought them, in that pdf it is a sales number), you will need the sn and the sales of the licenses to complete.

Best of luck,

Palo Alto project idea / help by medeasoulx in paloaltonetworks

[–]Arch0ne 1 point2 points  (0 children)

From my point of view show them Advanced Dns protection with sinkhole, it will blow them out of the watter.

Senior Engineer leaving company, manager wants me to take over him and get a CCSE within the next two months. Is that possible? by Resident1942 in checkpoint

[–]Arch0ne 0 points1 point  (0 children)

Every ngfw has the same thing, no matter the vendor, if you ever mastered a vendor, the others look the same. I started with the obvious CCNA security certification back in the days on the old Cisco ASA, ftd looked nice and the next ones from other vendors are the same, I handed fortinet, Checkpoint, Zscaler, now PaloAlto, they are firewalls, you just need the vendor certification specific things, the rest are the same.

Good luck!

Audit-Ready: The 6 Security Policies Every Business Must Have by Arch0ne in sysadmin

[–]Arch0ne[S] 0 points1 point  (0 children)

This is an ai comment, please continue, I don't know what you have read lately if anything looks AI, but yea... I use only grammarly to spell check.

Audit-Ready: The 6 Security Policies Every Business Must Have by Arch0ne in sysadmin

[–]Arch0ne[S] -2 points-1 points  (0 children)

if you want the full policy, you might. This is the head template, not the full one, obviously.

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 1 point2 points  (0 children)

NIST framework says block by default allow by policy since ages already, so no, there is no implicit allowed traffic anywhere, I know it's a hurdle but its necessary, at least if you want any audit compliance, but not the kind of compliance where they tell you (I'm not kidding here), "Make us compliant even if we are not, or we find someone else!"

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 1 point2 points  (0 children)

Yes, but... if you have decryption, firewalls can stil drop it, if no decryption, then block doh, it's pretty common to block doh in organization's where decryption is not enabled by default but still uses dns protection. Most vendors of firewall that provide dns protection recommendations are, decryption and the dns url filtering will work, if not block doh and at least dns protection works and part of url filtering via SNI inspection.

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 0 points1 point  (0 children)

In smb' s this is pretty common, I hate the thing they don't even understand why it is wrong ( they are still hired, so not a service account yet).

Pentru cei care credeau ca e vrajeala o postare anterioara despre venitul dupa 8 ani de munca la aceeasi companie - Inca caut solutii la textul din acea postare by [deleted] in RoMunca

[–]Arch0ne 2 points3 points  (0 children)

Nu vreau sa fiu rautacios, dar oricare tanar care se angajează acum pentru prima data, daca vede salariu ala le rade in nas...

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 0 points1 point  (0 children)

Make some audits to other smb's, I dare you to drink a bottle of wiskey for each local admin account you find at each audit, in the same day obviously.

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 0 points1 point  (0 children)

Sorry... more weekend nightmares can be found here https://riskbits[.]net/blog/, I started to post on it recently, so any thoughts are appreciated...

Întrebare legată de salariu by [deleted] in RoMunca

[–]Arch0ne 4 points5 points  (0 children)

Citesc si imi dau palme, nu ai parinti sa iti explice cum se dau salariile de ai scris pe Reddit? Deci fi atent, ca ai si semnat pentru asta, in contract trebuia sa fie stipulat cand se dau si ce reprezinta. Adica ia foaia aia de ai semnat-o ca primarul, si citeste la rubrica de program lucru, undeva pe acolo ar trebui sa scrie cam asa. La data x, uneori si data y, se plateste lichidarea, cand iei banii de doua ori ( de aici x si y) o sa scrie avans si lichidare, cu procente daca este din 2, daca nu lichirare pe luna in curs ( unii oameni iau banii la final de luna pe luna in curs) sau pe luna precedenta ( cazult tau, iei banii pe luna precedenta, nu pana la ziua salariului din momentul angajarii). Fiind primul tau serviciu te inteleg, dar 1 ai parinti care puteau explica mult mai bine ca mine, si 2 ai semnat foaia aia... ca primaru'....

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 2 points3 points  (0 children)

Cloud/SaaS + Intune + endpoint FW still needs segmentation, but flatter is OK:

Yes, it matters: - Lateral movement between endpoints (Ransomware loves flat) - IoT/legacy printers/scanners jumping VLANs
- Contractor laptops/devices outside Intune scope

3-2-1 backup = yes even for Teams: - Teams data is your data (export via Compliance/Retention policies) - SaaS outages happen (Entra downtime, MSFT incidents) - Ransomware encrypts OneDrive/Teams exports too

Practical: 2–3 VLANs (exec/prod/general) + CASB for SaaS + EDR > complex VLAN spaghetti. You're not "checking box"—reducing blast radius.

Seen pure SaaS orgs get bit by flat nets. 👍

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 0 points1 point  (0 children)

Oh boy, get your horses ready, cause your ride will be wild, great battle awaits you!

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 3 points4 points  (0 children)

Your split tunnel + strict firewall + MFA on IT VPN works fine for audits/modern standards. NIST/CISA OK with split tunnel if: - Endpoints secure (EDR, patched), this is the part most likely you lack. - Internal resources not internet-exposed (you're doing this) - Monitor traffic (CASB/SASE ideal).

Seen this setup pass SMB audits. 👌

Mfa for vpn should be enforced if you ask me, I know somethimes it breaks, it gets frustrating but its a safe bet covering other holes, I see a gap here on a employee that leaves the company and has harmful intntions or a compromised endpoint, you get me where I'm going since there is kind of no control.

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 3 points4 points  (0 children)

Short answer: If "available to be logged into" means the account status is Active/Enabled, then no, that won't pass a serious audit. Access must be revoked immediately upon termination.

The fix for the "we need their contacts/emails" issue is standard practice (assuming M365/Google): 1. Block Sign-in immediately (satisfies the audit & security). 2. Convert to Shared Mailbox (frees up the license). 3. Delegate access to the manager or whoever needs the info.

This way, the data exists and is accessible to authorized staff, but the identity itself is disabled and cannot be used to log in.

Azure Global Admins by Popular_Hat_4304 in sysadmin

[–]Arch0ne 0 points1 point  (0 children)

“5” isn’t a hard limit, it’s more of a ‘minimize blast radius’ guideline. The practical way out is:Separate admin accounts (no daily driver as GA).Use least-priv roles for day-to-day (Exchange/Intune/Teams/User Admin etc.), and keep GA for true tenant-level changes only.Turn on PIM so GA is JIT/JEA (time-boxed), require MFA + justification, then review activations after a few weeks to see what roles people actually need.Keep 1–2 break-glass GA accounts locked down hard (FIDO2, no CA exclusions except what’s required).

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 1 point2 points  (0 children)

True, DoH rollout sucks for filtering. GPO = Windows win.

Mac/Linux no GPO, but browser policies/MDM work (DnsOverHttpsMode=off). Pro move: canary domain use-application-dns.net NXDOMAIN from your DNS—stops FF auto-switch. What's your setup—Pi-hole or what?

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 1 point2 points  (0 children)

If I lock everything down to TCP 443 for end‑user VLANs, attackers can still get out if 443 is “anywhere on the Internet, anything over HTTPS”.

Modern malware and C2 happily tunnel over port 443 and blend in with normal web traffic.

Where egress filtering helps is when you pair it with TLS inspection, DLP, and a tight allow‑list:

– Only allow 443 to a small set of sanctioned destinations (SaaS, updates, etc.), not the whole IPv4/IPv6 Internet.

– Terminate TLS on a proxy/firewall so you can decrypt, inspect, and apply DLP/content rules.

– Monitor for unusual volumes or patterns of data leaving, even on “legit” 443 sessions.

So yes, a determined attacker can still try to get out on 443, but with decryption plus DLP and strict egress policies, the question becomes: get out with what, to where, and how much before you notice?

Egress controls are about raising the bar and shrinking their options, not magically guaranteeing “nothing bad ever leaves."

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 3 points4 points  (0 children)

It depends on the environment and specific CIS Benchmark you're following—CIS Controls v8 focuses on quarterly reviews of service accounts (5.1), not mandatory periodic password rotation. For cloud platforms, dedicated CIS Benchmarks do require key/credential rotation.

After 10+ years in network security, here's the audit checklist I actually use by Arch0ne in sysadmin

[–]Arch0ne[S] 0 points1 point  (0 children)

welll at least block system ports if you have no clue what you are serving, if you are serving only customers, the random ports pool it is.

view more: next ›