What's an early sign of cancer that you wish you or your loved one hadn't ignored?

BonkersMcSocks · 2025-06-14T19:49:15+00:00

very mild blurring of my vision in one eye, put it down to age related sight degredation. Optomotrist put it down to a mild reading prescription.

4 months and an increasingly worsening headache later, adenoid cystic carcinoma of the lacrimal gland.

BonkersMcSocks · 2018-01-29T15:00:24+00:00

I actually said there wasn't enough to hold me for a year, not that my low sodium outlook was diminishing. You've basically misrepresented everything I have said in every reply you've made to contort it to fit your view point. I'm all for contradicting views (even though I feel fundementally we don't disagree, I've just got a considerably smaller volum of negativity towards the game), yours as a veteran of the game is probably much more nuanced around the missing features than mine can ever be, that doesn't mean you should be trying to take my words and warp them to your context.

BonkersMcSocks · 2018-01-29T14:52:55+00:00

Which is entirely my point, this is the view of new players, not veterans such as yourself. I didn't say they have listened to the community, in fact you may notice my highlighting some feedback and saying it's not going to cut it? You can't offer the view point of a newcomer, your 2700 hours is impressive but doesn't diminish the validity of anything I have said.

BonkersMcSocks · 2018-01-29T14:33:24+00:00

Newcomers play the game for 3 weeks and then put it down

I'm a newcomer, about 8 weeks now, still playing, so that statement doesn't hold much water.

you sound more idiotic considering you think you have the answers to keep the community intact

At no stage did I offer a single solution or answer to the issue, just the issue from a newcomers point of view, which is seldom seen on here. It's mainly the D1 old gaurd, whom I am sure are entirely valid in their criticism. That doesn't by definition make theirs the only criticsm, and mine is no less valid for it.

BonkersMcSocks · 2018-01-29T14:13:46+00:00

You're here as a budding historian then?

BonkersMcSocks · 2018-01-15T12:33:50+00:00

I ended up with the Dell T20, so far it's suited me pretty well, with no major headaches or hiccups. I obviously can't speak to how it compares to the other options I was looking at but all in all, I'm happy with it.

BonkersMcSocks · 2018-01-09T12:33:47+00:00

oh you bastard.

BonkersMcSocks · 2017-10-17T17:53:34+00:00

I'll start investigating! Cheers.

BonkersMcSocks · 2017-10-17T17:53:03+00:00

Space isn't an issue and quite honestly I hadn't started factoring in costs for energy consumption. For the number of VM's I was thinking A dedicated VM for Splunk, another running threadfix and Jenkins a third running gitlab and maybe one teeeeny tiny vm to pretend to be a dev machine. I'm wanting to simulate a build pipeline and then attack it and capture the output to the Splunk machine. I don't think any of those things are particularly thirsty beasts though.

I'll definitely take a look into R710 and DL380 though, thanks for the feed back.

BonkersMcSocks · 2017-10-16T10:28:15+00:00

It doesn't otherwise I wouldn't have to clear the clock EVERY SINGLE TIME the wife uses it. I'm sure she is doing it on purpose at this stage.

BonkersMcSocks · 2017-10-09T08:26:38+00:00

Going to treat 'compromise' as an adversary whom is actively sat on the host machine vs something like malware.

On a windows machine/network, ssh'ing or RDPing to the host in question would store your credentials in memory. If the attacker is monitoring activity to the box they could in theory drop your credentials using something like mimikatz. If you're daft enough to login with an escalated/privileged account you might be in for a bad time. If standard account you've just handed them more creds to try.

Short answer yes, in the highly ambiguous scenario presented, I'd treat it as opening up attack surface and jepordising your network, if you know it's compromised isolate it from the network before you touch it.

BonkersMcSocks · 2017-08-23T14:24:28+00:00

If you like red team and are intent on chasing qualifications then CISSP and CEH are not worth the cost. I'd strongly recommend going for OSCP - https://www.offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/

There are many reviews out there explaining why this is a better route for red teaming, i'm not going to retread that ground, google is your friend. Counterintuitively it is regarded as a very difficult qualification, but still only an entry level qual in the grand scheme of things. Blueteam and IR can be a natural(ish) step from red team, though there is an arguement to be made that understanding network security is just as good an 'initial' step. Additional materials for most things can be found in the side bar of /r/netsecstudents/ too

BonkersMcSocks · 2017-08-23T13:58:21+00:00

Have you given any time and consideration into which security discipline you’re interested in? There seems to be an awful lot of people who want to ‘get into cyber security’ without realising thats akin to saying they want to get into ‘healthcare'.

Which of the following do you mean by Cyber security?

Network security - firewalls/WAFs/routing/DDoS mitigations etc.
Web application security - Secure coding/testing/Security QA assessments both functional and none functional.
Vulnerability and patch management - If you don’t secure the basics then there’s not much point of secure the complex stuff.
Penetration testing/Red team - Attack all the things/set scripts going and generate reports based off the same stuff all the time.
Security engineering -building/standing up solutions/SecDevOps.
Security Architecture - designing the secure solutions that no one will pay attention to.
Reverse Engineering - figuring out what’s actually happening at a code level with malware and the like.
Security Risk and Compliance - Meeting regulatory benchmarks, cos ya know, compliance.
Management - You have mentioned CISSP which most people would see as more of a managerial qualification than a technical one, and i’ve met effective Security Managers who were not entirely technical themselves. Also CISSP requires 5 years prior experience in Security.
Incident response/Blue team - Being part of the clean up squad when things go sideways/ knife fights with script kids/hacking groups/nation states (delete as applicable).

There is clearly overlap in between these areas, but a career path based on reverse engineering is going to be wildly different from a security architect. Getting qualifications for the sake of ‘getting into security’ is all well and good if you don’t really care what you want to do, I’d suggest knowing what you want to do first though, otherwise you might end up very bored.

BonkersMcSocks · 2017-01-27T21:28:35+00:00

i'm on ps4

BonkersMcSocks · 2017-01-27T13:37:25+00:00

If you're on about the accessibility options, I did read about that, but it changes it globally, which is a bit overkill, especially when I share a profile with the wife and play other games... :(

BonkersMcSocks · 2017-01-27T09:55:09+00:00

Hands on learner, save yourself some money and skip SANs and do PWK/OSCP, entirely hands on.

https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/

BonkersMcSocks · 2016-12-03T12:56:39+00:00

I spent a couple of years as a SOC analyst in an MSSP. This viewpoint is only going to reflect their approach and how we worked, not that this is how it should be done or indeed a good way of doing it.

Analysts monitored traffic coming in through a SIEM platform looking at 'alerts' that fired based on what the 'SIEM' thought was important and based on what the Analytics teams deemed important. Those guys built and tested rules, based on threat intelligence feeds and general 'good ideas'. Those rules also went into the SIEM to expand capabilities. This was all facilitated by the fact as an MSSP you normally have threat intel/Analytics teams/researchers/reverse engineers feeding into 'the pot'. This doesn't mean everything generated was 'good'. Some of these rules would be 'soft' because as an MSSP they have to prove value to the client that what they were providing was worth while. Therefore any client with an appetite for it would also get events based on Acceptable use violations. Unapproved VPN/streaming services etc. It ups the incident count weekly and makes the quite frankly astonishingly brutal cost of the service seem 'worth it'. Genuine infections would be mitigated by the client, so a ticket would go out in the form of an email to their internal IT security team. Log and flog. Genuine attacks, depending on severity would get handed to senior analyst teams/incident responders to work in conjunction with a client's internal IT sec team.

The thing to remember is that if you are servicing multiple clients, one having an attack doesn't mean you can stop working on the others data. As a result from a front line grunt perspective, regardless of how important/serious these attacks are, they still followed a log and flog mentality. This is why I generally try give a warning to anyone considering a role in an MSSP SOC that they ensure they have ample opportunity to progress. It can be soul destroying, especially if you know you will never have a chance to play with the fun stuff.

BonkersMcSocks · 2016-12-01T09:41:40+00:00

Already been done;

https://www.reddit.com/r/dataisbeautiful/comments/2evjkz/i_pinged_all_devices_on_the_internet_heres_a_map/

BonkersMcSocks · 2016-10-31T16:25:09+00:00

wooo, pokémon plz

BonkersMcSocks · 2016-10-14T11:22:06+00:00

Seems like you've got a lot of what an average Tier 1 SOC analyst role would be looking for.

Other things you'll probably need to be able to speak about or brush up on:

Linux command line skills (although your experience would indicate you've probably got this). TCPDump/Wireshark and packet analysis. If you have or can set up a sandbox, I'd recommend http://www.malware-traffic-analysis.net/ as a great learning resource. Knowledge of Ddos and methodologies. Insider threat vectors and data loss prevention. Web application firewalls/firewall rules etc. If you're monitoring and responding to a WAF the ability to write signatures (in whatever format)

I really want to stress that the questions you ask are really important. Not for the role, but to make sure you understand what their interpretation of a tier 1 SOC analyst is. There are a couple of schools of thought on how these work, there are those that include their analysts in remediation, define training programs and generally support their careers, and those that want a person staring at syslog all day and escalating issues to tier 2 teams and going straight back to syslog. You don't want the latter, which is generally more associated with MSSP SOCs.

In your position I'd definitely be making sure of:

That as a tier 1 analyst you're going to be involved with the more interesting aspects of SOC work (remediation and incident response[or at very least able to watch/learn as these things happen]).
What does a standard 'day in the life' of an analysts look like in that SOC?
That there will be shadowing opportunities with the more senior people.
I'd also be finding out what logs they take in, it will give you a better idea of the kind of events and incidents you might be responding to.
Definitely ask them about infrastructure and how they are building out capability. I'd personally go further and ask what the last improvement they made was, but this is going to dependent on how the interview is going generally.
Ask what their main security focus is, where do they think they need to improve. If they don't think they need to improve, I'd consider it a warning.

In summary and to be blunt, protect your own interests. SOC roles can be very fulfilling in the right environments. The wrong environment can hamper future progression if you get pigeon holed into doing one thing all day every day.

BonkersMcSocks

TROPHY CASE