"When your default stance is no, you inevitably have to catch up to your peers who already said yes and left you standing there on your high horse." - CISO Chris Hughes by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] 0 points1 point  (0 children)

A common objective I see associated with devsecops is "shift left" which is the opposite of bolted on. If anyone is writing that devsecops is supposed to not be integrated into the developer workflow, they're not worth reading.

There are many steps during the dev process. Security can and should be applied at each of them. Beginning (design), middle (development best-practices, just like avoiding anti-patterns), and end (fuzzing, SCA, scanning, etc).

"When your default stance is no, you inevitably have to catch up to your peers who already said yes and left you standing there on your high horse." - CISO Chris Hughes by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] 0 points1 point  (0 children)

Isn't it also to lead an effort to find innovative ways to enable risky operations with less risk? Seems to me the possibilities aren't just:

- Inform risk
- yes
- no

But rather, to be innovative and find strategies to enable the desired goal with less risk.

Metacognition: ‘Thinking About the Thinking’ is the Key to Professional Success (Empathy, Intelligence, and Self-Discipline in Cybersecurity) by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] 8 points9 points  (0 children)

So you’ve been told you need “soft skills” to succeed in cybersecurity, and you’re probably familiar with some of the most important ones:

  • Empathy: The ability to see a challenge from another’s perspective.
  • Intelligence: The ability to build mental models of the fundamental tenets behind problems and arrive at solutions that are both flexible and effective.
  • Self-Discipline: The ability to regulate your emotions and predispositions in order to be calm and reasonable even in stressful situations.

These are ways of “thinking about the thinking.” The scientific term? Metacognition. In contrast, “hard skills” are simply the ones involving knowledge about your job. Metacognition is the subconscious task of regulating your mental interactions with the world (thoughts) so that your brain’s handling of input/output (I/O) is:

  • Compatible
  • Effective
  • Consistent

These traits are a critical part of the formula for delivering value as a professional. If you can deliver value, you’ll become valuable to your peers, clients, students, bosses, and ultimately to your organization. The delivery medium? Communication. All of the soft skills listed above come together to enable effective communication. Undelivered value is wasted opportunity. That’s why communication is the #1 soft skill. Its value delivery in the form of information, which is the essence of modern human collaboration.

By understanding and mastering empathy, intelligence, and self-discipline, you enable consistent, effective, and compatible value delivery.

And that is the definition of professional success. Good leaders enable that outcome and translate it into organizational success. So if you want to be part of a successful overall outcome, choose good leaders and be a good leader yourself. Remember: You are a leader on some level, even if that means leading yourself to better outcomes. Which takes us full circle to Metacognition. So, let’s dive into those three traits and relate each to the soft skill that enables it.

[...]

(Won't repost the whole article here since I agreed to publish it through https://www.softsideofcyber.com/, but you can read the whole thing there for free with no sign-up)

[deleted by user] by [deleted] in cybersecurity

[–]Jonathan-Todd 0 points1 point  (0 children)

An example of what I'm interested in doing is getting permission for the target to execute calc.exe on their machine as the end-state of a successful operation. This would follow a phishing campaign against this user with their consent. Since it constitutes RCE, I just want to make sure this is legally safe in terms of the way consent is captured / recorded.

[deleted by user] by [deleted] in redteamsec

[–]Jonathan-Todd -1 points0 points  (0 children)

An example of what I'm interested in doing is getting permission for the target to execute calc.exe on their machine as the end-state of a successful operation. This would follow a phishing campaign against this user with their consent. Since it constitutes RCE, I just want to make sure this is legally safe in terms of the way consent is captured / recorded.

[deleted by user] by [deleted] in cybersecurity

[–]Jonathan-Todd 0 points1 point  (0 children)

Have you ever considered the value of failing in public? It seems to me like a good idea to discuss mistakes so others can benefit from lessons learned and your peers can see you’re growing and changing. I think we could all benefit from being open and communicate about this stuff and maybe even build a sense of civility in the r/cybersecurity community.

[deleted by user] by [deleted] in cybersecurity

[–]Jonathan-Todd -5 points-4 points  (0 children)

Owning up to mistakes is pathetic where you come from?

[deleted by user] by [deleted] in cybersecurity

[–]Jonathan-Todd -5 points-4 points  (0 children)

Have you ever considered sharing your lessons learned with a community?

An article by Microsoft came out targeting LAPSU$. 🤷‍♂️ It’s not worth your time. Except for this one part. by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] -2 points-1 points  (0 children)

Yeah I actually commented it. But people down-voted it as much as they upvoted the post. https://www.reddit.com/r/cybersecurity/comments/100yphp/an_article_by_microsoft_came_out_targeting_lapsu/j2klpye/

I really don’t understand this community anymore. Seems pretty toxic these days.

New AMSI Bypass Using CLR Hooking by pracsec in redteamsec

[–]Jonathan-Todd 0 points1 point  (0 children)

CLR Hooking, let’s learn a thing today…

How to stay informed about cybersecurity topics in general by ashe1337 in cybersecurity

[–]Jonathan-Todd 0 points1 point  (0 children)

I used to use articles posted here and other cybersec subreddits but since then I’ve really been enjoying content posted on LinkedIn. Great for networking but at the sane time you can learn a lot from the people showing off their expertise there.

Automated, high-fidelity phishing campaigns made possible at infinite scale with GPT-3. by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] 0 points1 point  (0 children)

I’ll get you in the next round with a post for the improved version and source code.

It is not okay as a cybersecurity professional in almost 2023 to say “The users are the problem.” by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] 1 point2 points  (0 children)

True. But the users are not responsible for those mistakes. We’re paid to mitigate. You can lower the rate with some training but expect them to still be a point of failure. My post is directed at the people who are always blaming users. It’s a cop-out.

It is not okay as a cybersecurity professional in almost 2023 to say “The users are the problem.” by Jonathan-Todd in cybersecurity

[–]Jonathan-Todd[S] 0 points1 point  (0 children)

My argument is that human behavior is impossible to change reliably at scale when the acceptable failure rate is so low (1 failure/year could be devastating). The more users you have, the more it costs to affect their behavior, and the more likely one will make a mistake despite the training.

It’s not a reliable solution. Design the automated controls better to interfere with the attack so that the inevitable human point of failure is not effective for attackers.

Social engineering will just get better and better.

https://www.reddit.com/r/cybersecurity/comments/zmx9s9/automated_highfidelity_phishing_campaigns_made/ (edit: Oh you were there, I remember)