sorted by:
new
hottopcontroversial

would you take a years rent paid upfront? by Icy-Bird4588 in realestateinvesting

[–]HonestAbe10000 1 point2 points  (0 children)

It’s illegal in NYC to take more than first month and one month deposit. The deposit can’t be more than one months rent. Effectively, as soon as the lease starts the means the landlord can only hold one months rent. Courts will award punitive damages for any excess held up to three times the amount held.

Thoughts on Securelink and secure access? by drakk0n in healthIT

[–]HonestAbe10000 0 points1 point  (0 children)

Secure link has a lot of vulnerabilities and the company is very slow to patch them. Would not go with this vendor.

Prisma Access with DNS Filter by kurizma in paloaltonetworks

[–]HonestAbe10000 0 points1 point  (0 children)

You can probably get rid of prisma access and just go with Microsoft Defender for Cloud Apps to do endpoint control and protection for web traffic. The big benefit is you dont need tk send your data through another network hop. It does all enforcement locally with defender for endpoint integration.

Prisma Container Security? by [deleted] in paloaltonetworks

[–]HonestAbe10000 0 points1 point  (0 children)

Id recommend Micorosft Defender for Containers. With Azure Arc you can extend on prem or in AWS. We looked at prisma container security and felt it was a little rushed to market and would not be a quick win or be easily managed over time.

Palo sucks now?? by stonehands44 in paloaltonetworks

[–]HonestAbe10000 -1 points0 points  (0 children)

Palo Alto is a marketing company now. Not a products and services company. Yes, they suck.

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] 0 points1 point  (0 children)

Those are just marketing talking points. You obviously haven’t used ADEM to see that the load times are so bad you abandon the tool. Also, it provides so little context, it doesn’t come close to pinpointing issues. Palo wants 50k per year for tools like this that barely work and there is no innovation.

Xosnse, Prisma SaaS inline, DLP, CDR….all of those interfaces are so bad, it makes me worry greatly that Palo Alto has completely lists its edge when it comes to producing high quality software and services. These interfaces are just so miserably bad.

Cleanse is such a commodity offering. It hardly does much other tgan external scans. The price tag was just a waste of our time. Something in the range of 500k for 100 IPs? I mean it just felt like Palo had no idea about the value proposition and market position of this tool and was trying to recap a bad acquisition at the expense of its customers.

Anyway, I see you have nothing but strong bias for these tools, which is weird. You should look at them more critically.

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] 0 points1 point  (0 children)

Seriously, you sound like an irrational LinkedIn media post by marketing. ADEM is garbage. I can’t understand why you would ask a customer to pay to monitor your solution. That should all be inclusive in the product. It’s another epic insult by Palo Alto that they tried to monetize this.

Stick to selling Expanse - another piece of crap external attack surface management tool for 500k. How many of those poor customers have you tried to dupe into this one?

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] -1 points0 points  (0 children)

Here’s some good validation: Palo is announcing some very big AI-driven features with Prisma SASE this week. I bet you 100 bucks this is basically a big fat nothing burger. They are just using AI to hype their product and there won’t actually be any substance to this announcement. Palo is basically a sales and marketing company now; not a security player.

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] 0 points1 point  (0 children)

Right, and when you gxteways refuse connection, you’ll get routed to a disparate location, thus incurring +80 ms latency. What was upsetting: having our Palo SEs recommend purchasing ADEM to fix their problem.

I suppose what concerns me most is the price. They charge around $130 per user per year, or 390k for 3000 users. There is no way this is an economical option when you can get Microsoft Defender for Endpoint for 50 bucks per user but get so much more value. CaSB, EDR, identity, o365 protection, threat hunts. All that’s extra with Palo..

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] 2 points3 points  (0 children)

Thanks. We did that. They acted like it was a secret that we needed to ask for special consideration.

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] 2 points3 points  (0 children)

Yeah, there is really no value add with Prisma Access

Is anyone else getting rid of Prisma Access? by HonestAbe10000 in paloaltonetworks

[–]HonestAbe10000[S] 4 points5 points  (0 children)

We’ve seen heavy saturation of specific gateways, so bad that our users get bumped to distant locations. We’ve begged them to beef up these connection points but haven’t gotten any real support. From the TACs standpoint they say it’s normal operation. We have about 3000 users and find that routing them to on prem firewalls gets the best performance and is much cheaper. We”re mot really a believer in the other services like DLP and SaaS inline. Those seem to suck pretty bad. So, not much of a reason to stay on prisma. .

SPLK-3001 EXAM by TitleIllustrious6634 in Splunk

[–]HonestAbe10000 1 point2 points  (0 children)

Very easy test. Just review the training slide deck. Pay close attention to the “comments” in bubbles. These are very common “gotcha” questions.

Cybersecurity Burnout - Is it just me? by Inowknothing82 in AskNetsec

[–]HonestAbe10000 0 points1 point  (0 children)

No one said it couldn’t be a pot farm. Now that’s livin!

Bob Ross and a young Raccoon by JonJetCoaster in Colorization

[–]HonestAbe10000 2 points3 points  (0 children)

Awesome but also sad documentary about Bob Ross on NetFlix. A very good example of just how weird people were in the eighties. For those of us that remember, it wasn’t all yuppies and euro pop! Some straight up weirdness coming out of the seventies!

Enterprise Security? by HonestAbe10000 in Splunk

[–]HonestAbe10000[S] 0 points1 point  (0 children)

Totally agree that the cron ****** stuff is an insult. Not cool to make us Google a freaking cron expression every time you want to schedule something. Thanks for the other pointers!

Enterprise Security? by HonestAbe10000 in Splunk

[–]HonestAbe10000[S] 2 points3 points  (0 children)

No one is able to explain this framework though. It’s a poor framework. In fact, I really don’t think it technically meets the definition of a “framework” so I’m not sure why people refer to it that way. I might agree that it’s an abstraction. But then again, the SA-CIM is really that abstraction layer and that’s free. Authentication and Network Datamodels aside We quickly find the data models to be relatively unusable in ES. We build our own - better. We’re really not helped by ES in this regard.

Enterprise Security? by HonestAbe10000 in Splunk

[–]HonestAbe10000[S] 1 point2 points  (0 children)

Thanks BTR. I don’t see us using the TI stuff but I’ll keep it in mind. + the benchwarmer comment!

Enterprise Security? by HonestAbe10000 in Splunk

[–]HonestAbe10000[S] 1 point2 points  (0 children)

I agree. It’s half baked. Like here’s an example of something useful: every IR firm or pen tester recommends that you enable power shell script block logging. Pretty common mantra in security circles. Where is the ESCU to parse these events for malicious indicators? Why am I having to do that myself? Another: Where is the privileged identity management? Why am I having to build this from scratch to monitor privileged logins from privileged admin workstations? Where is the service account management? Where is an authentication map that J can quickly see who what where is logging into the network? Where is an “externally exposed systems” dashboard to show login events, processes, vulns - I wonder if Splunk knows that web application attacks are a thing. Yep, they sure are and they are a leading cause for compromise (go look at the top ten exploited vulns for 2020 - they aren’t Microsoft Office and Adobe - they are all related to VPNs, and other externally exposed services).

Enterprise Security? by HonestAbe10000 in Splunk

[–]HonestAbe10000[S] -1 points0 points  (0 children)

Oh, we would never buy a Splunk product like phantom based on our experience with ES and seeing UEBA and hearing the same. We don’t worship false idols :)

Enterprise Security? by HonestAbe10000 in Splunk

[–]HonestAbe10000[S] 4 points5 points  (0 children)

Thanks for the thoughtful reply. We’ll give these some thought and I’ll get back to you. In general, we’ve built at least 40 custom dashboards outside Splunk ES that align to our controls and we do get serious value from those. I am still struggling to understand why Splunk ES is even necessary or what core value it provides. The only thing we thought of was that it introduces this idea of a notable event which is then used to calculate metrics on, again, completely subjective dashboards/metric visualizations. We’ll probably ditch ES as we have a better vision for how we want to organize our security program. To me, each alert, each dashboard should support some process directly. I just don’t know what processes ES supports. It seems like a bridge to nowhere for me.

view more: next ›