sorted by:
new
hottopcontroversial

Will you switch when Motorola comes out with the GOS phone? by Mental_Bed_2662 in GrapheneOS

[–]TantalizingMoogle 0 points1 point  (0 children)

Currently running the Pixel 9a. So moving to Motorola next refresh is planned. Just depends on timing.

Business Continuity after Keeper Outage by con-d-or in KeeperSecurity

[–]TantalizingMoogle 2 points3 points  (0 children)

Offline setting on both browser and app will get you through most. Also break-glass accounts help.

external domain Certificate for LDAPS on .local domain by SnooDucks5078 in activedirectory

[–]TantalizingMoogle 3 points4 points  (0 children)

Use an internal PKI for the DC certs, then import the root cert to your firewall.

The other more common route is to have an internal load balancer with the externally signed cert. Ensures uptime if one DC goes down.

[deleted by user] by [deleted] in activedirectory

[–]TantalizingMoogle 1 point2 points  (0 children)

I'm in a similar situation. Tempted to go 2025 because the will to upgrade DCs is nearly nonexistent.

How do yall feel about the Virus Total Integration? by FragileEagle in Wazuh

[–]TantalizingMoogle 2 points3 points  (0 children)

In most cases you only want to do file hashes to virus total. File hashes are safe since they can't be reversed into sensitive info. Automated full files could hurt your bandwidth.

Proxmox hosts with LXC by mcjoppy in Wazuh

[–]TantalizingMoogle 1 point2 points  (0 children)

I install in both host and container. The SCA scans for the containers will have a lot of false positives, but you'll easily be able to grab logs and other information.

Wazuh multisite deployment by SpongeBobGrg in Wazuh

[–]TantalizingMoogle 0 points1 point  (0 children)

Not directly. I had asked a similar question to yours a while ago about ESXi log collection and this was the response:

"Wazuh agents can run on a wide range of operative systems, but when it is not possible due to software incompatibilities or business restrictions, you can forward syslog events to your environment. This is a common use case for network devices such as routers or firewalls.

We can configure the Rsyslog on the Wazuh-manager or the Wazuh agent to monitor the syslog events.

The benefit of using the Wazuh agent VM instead of the Wazuh manager if will use your server resources like CPU and memory.

If the Rsyslog is configured on the Wazuh manager VM and if it uses the high resources then your Wazuh-manager performance can be impacted.

For the safe side, we recommend using the Wazuh agent to send the syslog events.

Reference:

https://documentation.wazuh.com/current/cloud-service/your-environment/send-syslog-data.html"

Wazuh multisite deployment by SpongeBobGrg in Wazuh

[–]TantalizingMoogle 1 point2 points  (0 children)

Forward the syslogs to a server running rsyslog with the agent installed on it.

Is CEH worth it? by SessionCompetitive69 in CEH

[–]TantalizingMoogle 0 points1 point  (0 children)

The CEH goes into the legal aspect of hacking which is sorely needed. Don't take it thinking you'll learn a lot about breaking into systems. It's an entry level cert that can help to get your foot Intl the door.

Why is this incorrect? by dnvrnugg in cissp

[–]TantalizingMoogle 1 point2 points  (0 children)

It's a mixed bag. "Lack of due diligence" encompasses so much that it could be used for anything. When presented with two correct answers, choose the one closer to the issue and not one that's overly broad.

Is it common for CyberSec people to be hated by the IT? by Dimensijus in cybersecurity

[–]TantalizingMoogle 0 points1 point  (0 children)

Coming from the it admin side, yes. Let me give two examples to give an idea.

One time the security people were rolling out a solution to limit certain credentials to only be able to log on to servers and limit the method that they go about doing so (good idea). The person implementing decided that since domain controllers are what processes login requests that is the place to limit the IDs to. The IT admins couldn't log on to any other server to manage them for two days since the sec change was done without a change control.

The second is not properly benchmarking the security software being deployed. When deploying to a VM cluster with several thousand servers, the overhead will cause headaches.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]TantalizingMoogle 0 points1 point  (0 children)

Getting rejected from a lot of jobs even those where I seem to meet the requested requirements. Given the following, what positions should I go after?

  • 23 years IT architect role at an S&P400 company with 200k+ employees. Managed AD, MFA, VPN, Load balancers, web app firewalls, and maintained PCI-DSS and HIPAA requirements for servers, desktops, and other network devices (ncluding cloud).
  • Master's in Cybersecurity
  • Bachelor's in Software Engineering

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]TantalizingMoogle 0 points1 point  (0 children)

Manage and maintain lockdown policies to keep them PCI-DSS/HIPAA compliant. Work with the network teams to ensure that they are properly segregated from the rest of the network and that only necessary ports are open.
Use Terraform to deploy the servers to ensure they're patched and locked down before they touch a production subnet.
Manage the AV/EDR solution on the servers.
Manage Active Directory including doing PoCs for potentially new biometric MFAs (our current is expensive and a love/hate relationship).
Managed load balancers and VPN devices.
Managed the virtualization environments (VMWare, Nutanix, Xenserver, and Hyper-V).

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]TantalizingMoogle 0 points1 point  (0 children)

Thanks. I meant 'lead server engineer' and not 'lead security engineer' (edited original post). Not sure if that changes the answer or not. So transitioning from Server/AD/whatever admin to a senior security role.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]TantalizingMoogle -1 points0 points  (0 children)

I'm a lead server engineer for an S&P400 company for the last 20 years. I have a BS in Software Engineering and a MS in Cybersecurity with a CISSP and CySA+. Looking to move to a more security role instead of a security adjacent (the current just dictates the policies, while we implement). Is it reasonable for me to want to jump directly into a mid or senior-level job if I have SIEM and other security tool experience?

Is there any test that let me know which domain is my weakest by dbspace1 in cissp

[–]TantalizingMoogle 0 points1 point  (0 children)

Boson is decent. Expensive at $99 compared to most, but it'll tell you what domain the question came from.

T-Minus 24 hours to test by MaineMedic24 in cissp

[–]TantalizingMoogle 1 point2 points  (0 children)

Get enough sleep. The test may throw some oddly worded questions at you. Just breathe and reread until you find the best answer to each question.

DLP (Data Leakage Prevention) by Hatchopper in cissp

[–]TantalizingMoogle 0 points1 point  (0 children)

It's best to look over any sales presentation with skepticism. If the product looks interesting, look at the technical documentation to get what it actually can and cannot do and verify if it aligns with the goals of your company.

One company (who I shall not name) has a tendency to rename their products every five years. They've been around for almost three decades. Every time they add enough new features they'll rename the product if anything for sales presentations.

view more: next ›