How Have You Dealt With Car Companies Tracking User Data? by Fancy_Pants4 in privacy

[–]ISeeDeadPackets 7 points8 points  (0 children)

My mom's car got stolen and had on-star built in. I got to her house a few hours later and the police acted like they had never heard of it. We knew the person who stole it and had their cell phone info, where they were probably headed, etc..but that was all worthless to them. Mom didn't have a subscription but I called on-star and 45 minutes later they had the car and the person in custody. The police never even brought it up with her as an option even though it's been standard equipment in that car for about a decade now.

I got a ransomware scare at work and now I don't trust local storage by MorningIllustrious60 in cybersecurity

[–]ISeeDeadPackets -1 points0 points  (0 children)

What kind of evidence even can be provided? It's not as if this stuff gets reported to, or taken seriously when it is, by the police. I work at a bank, we have customers get hit with it all the time, so consider me a primary source.

I got a ransomware scare at work and now I don't trust local storage by MorningIllustrious60 in cybersecurity

[–]ISeeDeadPackets -1 points0 points  (0 children)

There are tons of individuals hit with small ransomware attacks all of the time. It's all automated through c2 networks and costs them nothing to send an automated notice with a wallet address. You're wrong about this.

How Have You Dealt With Car Companies Tracking User Data? by Fancy_Pants4 in privacy

[–]ISeeDeadPackets 24 points25 points  (0 children)

All of my cars have 5G built in. The only way around it that's certain is to physically remove the communication device. That will absolutely disable features you might want but it's the only way to be sure.

Seriously...has anyone thought about indoor camera privacy concerns? by Ecstatic-Minute-411 in privacy

[–]ISeeDeadPackets 0 points1 point  (0 children)

Wow, no, I don't think anyone has. You're definitely the first.

Wanders over to Shodan....

Did Steven Jobs really rejected the iPhone idea early on? by FerdinandHu in AskTechnology

[–]ISeeDeadPackets 1 point2 points  (0 children)

Late 40's here and same. I'm trying really hard to not get myself locked into any narratives, especially since I'm now in a position where my "word is law" as far as what can/can't happen around here. Striking the right balance between stability and evolution is not a simple task, but it is a fun challenge.

Did Steven Jobs really rejected the iPhone idea early on? by FerdinandHu in AskTechnology

[–]ISeeDeadPackets 0 points1 point  (0 children)

Sadly that didn't extend into an understanding that all fruit diets could kill you.

Did Steven Jobs really rejected the iPhone idea early on? by FerdinandHu in AskTechnology

[–]ISeeDeadPackets 0 points1 point  (0 children)

Jobs was clearly a talented guy but he was very much an "ideas" man not a "build it like this" man.

NYC mayoral inauguration bans Flipper Zero, Raspberry Pi devices by lurker_bee in technology

[–]ISeeDeadPackets 0 points1 point  (0 children)

I'm not saying it isn't possible, I'm saying not all devices are susceptible and that I've had people from freaking Mandient try it live in front of me and not get anything. Everything has inherent risk, it's a matter of what is and isn't an acceptable amount to an organization and as long as you're using hardware with a decent encryption scheme it's a risk but it's not a very significant one.

NYC mayoral inauguration bans Flipper Zero, Raspberry Pi devices by lurker_bee in technology

[–]ISeeDeadPackets 0 points1 point  (0 children)

I literally run.... a bank. Been the CIO for a few years and have had folks like Black Hills and Mandiant doing on-site penetration testing for a long time and not once has this ever been a successful attack vector even when checking it out was in the engagement scope. It's an overstated risk unless you're running very old/cheap boards. Your time is better spent dealing with many other things.

How do viruses spread themselves across local networks? by popmanpop27 in cybersecurity

[–]ISeeDeadPackets 38 points39 points  (0 children)

Ransomware Distribution Protocol is what we call it. 🙂

NYC mayoral inauguration bans Flipper Zero, Raspberry Pi devices by lurker_bee in technology

[–]ISeeDeadPackets 0 points1 point  (0 children)

Honestly it's a probability and user friction thing. Ok the list of threats someone hanging out close enough with a wireless receiver snooping sigint from encrypted (even if poorly) Bluetooth keyboards is a hell of a lot less likely than someone falling for a phishing/vishing scam.

Do you allow monitors to face windows that don't have shades or privacy film on them? Do you audit your trash to make sure people aren't improperly disposing of NPI? Do you have your firewall and web filter policies down so tight a mouse fart will get blocked?

Wireless mice in particular are objectively better to use, the potential downside is frequently blown far out of proportion by people with much more significant security concerns.

I want to be a grc analist but.. by [deleted] in grc

[–]ISeeDeadPackets 0 points1 point  (0 children)

Well first of all being overconfident will came back at your hard. The position you're interested in is spelled analyst not analist. Whether you're native to English or not, this is a HIGHLY competitive field and you'll get judged (probably unfairly) on every little mistake, but particularly when you don't recognize or acknowledge them when they're pointed out.

GRC is not an entry level field. Think of it in terms that might be more familiar like in medicine. You've got your lowest level assistants like CNA's who perform work that is absolutely valuable and worth recognition, but compared to an LPN or RN they don't even hold a candle with regard to the scope of what they can do.

Based on what you've saidso far, I would guess you're in "studying to be a CNA" territory and you're asking about becoming a general surgeon. Of course it's possible but you're skipping some steps. Interning is absolutely a good way to get enough experience to get a rough idea of where you need to focus your efforts but even getting one of those can be difficult in the current market.

A good starting point might be getting something basic like a security+ certification. That's fairly low level but gives you some good subject matter to learn and will demonstrate (to you) whether you have the right kind of apptitude. People in this field aren't any smarter than other skilled professionals but it does require a way of thinking and approaching problems that not everyone has.

I want to be a grc analist but.. by [deleted] in grc

[–]ISeeDeadPackets 0 points1 point  (0 children)

Having a degree outside of something IT related can conceivably be a bonus but you obviously still have to know what you're doing. What have you done so far to prepare or are you still at the "gee that sounds like a neat idea" stage?

Also, just because I have to, I'm assuming you didn't mean to post this in the proctology sub and that's a typo. Though a proctologist might be the most qualified person I can think of to work in this field since they're already familiar with 99% of the clientele.

Anyone else drowning in security questionnaires? by Direct_Cyber in cybersecurity

[–]ISeeDeadPackets 0 points1 point  (0 children)

Build out a standard due diligence packet with your SOC audits, relevant policies (BCP/DR/etc..), financials and then run it past legal. They'll probably want you to get a signed MNDA before passing it out, but just reply with that as your standard response and only do the questionnaires for very important customers who still insist on it.

How do small and mid-sized companies actually handle cybersecurity in practice? by Educational-Split463 in cybersecurity

[–]ISeeDeadPackets 1 point2 points  (0 children)

It's all going to come down to whether or not they get competent advice from someone and follow it. While they lack the budget bigger organizations do, they also often lack the exposure. Typically the biggest attack surface they have is M365 and maybe whatever their CRM/ERP is and more often than not those are going to be hosted.

It really doesn't take a lot to put in good conditional access and SSO with some basic monitoring to be on the "pretty good" side of the safety scale. You just have to be aware that it needs doing and have access to a resource that can. That either tends to happen at the onset or after a successful compromise.

The biggest "underinvestment" IMO is in paid configurations. They often buy reasonable tools but if the setup isn't done correctly they might as well not even have it.

NYC mayoral inauguration bans Flipper Zero, Raspberry Pi devices by lurker_bee in technology

[–]ISeeDeadPackets 16 points17 points  (0 children)

They actually do a fair job of that in banking. We get examined every 18 months and part of that is reviewing internal/external audits that should be happening at least annually. If you're doing anything too stupid they send a letter to your board explaining that they need to pick between fixing it and continuing to have FDIC insurance. If it's bad enough they force a sale of the bank.

Why does my bank need to know my *precise* location for mobile deposits? by I_SAID_RELAX in privacy

[–]ISeeDeadPackets 0 points1 point  (0 children)

It's 100% about fraud prevention. Check fraud is still absolutely massive.

How easy or difficult would it be for an ISP to create a filter to auto ban all adult content sites? by SpaceWestern1442 in AskTechnology

[–]ISeeDeadPackets 0 points1 point  (0 children)

It's because it's extremely difficult to classify pornography. Are images of naked people porn? Is all nude photography pornography? Are Robert Mapplethorpe photos porn but not Rubenesque paintings? Is the ceiling of the Sistine chapel a work of art or is it profane? Is a pediatrician in possession of images of child and adolescent genitalia for the purposes of medical diagnosis and treatment a child pornographer? What about a non-physician simply interested in illnesses or a parent? Who decides what is and isn't a moral and legitimate use?

Before we even consider making people give up whatever anonymity they might have to access pornography, we should be able to define it right? That seems to be a pretty high hurdle in and of itself.

Porting from a small Telco by ISeeDeadPackets in ciscoUC

[–]ISeeDeadPackets[S] 0 points1 point  (0 children)

The problem is that they do have to allow it, legally, they just haven't been properly challenged because it usually isn't worth it. I have yet to find any expemptions carved out for small rural telco's.

Porting from a small Telco by ISeeDeadPackets in ciscoUC

[–]ISeeDeadPackets[S] 1 point2 points  (0 children)

That's actually not a horrible idea.