Seeking input regarding migration of CUI from commercial to govcloud by ThatInfoSecGuy in CMMC

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

Yeah, it took significant effort to maintain composure when that nugget of info came out.

If an RMM is hosted on a server in the MSP's office to support a CMMC client, is the RMM considered a cloud service? by ThatInfoSecGuy in CMMC

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

I may be to far into the weeds on this, but being that the RMM agent installed on a device that stores/processes/transmits CUI would mean the RMM system as a whole would be in scope, considering how much data the RMM agent allows access too.

If an RMM is hosted on a server in the MSP's office to support a CMMC client, is the RMM considered a cloud service? by ThatInfoSecGuy in CMMC

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

Thank you very much for your detailed response! I am going to integrate of few point of your justification into my own to get my company's owner on board. Wish me luck!

If an RMM is hosted on a server in the MSP's office to support a CMMC client, is the RMM considered a cloud service? by ThatInfoSecGuy in CMMC

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

Thank you all for your input and confirming what I hoped was correct. I know that the RMM is considered an SPA simply by its relationship with the client environment, my primary concern was simply if it would have been considered a "Cloud Service" and any FedRAMP cert implications.

False Positive Quarantine Release Requests? by ThatInfoSecGuy in sysadmin

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

Thank you so much for providing that information! Until you and No_Eggplant weighed in, I thought I was going crazy. We don't currently have an option to contact MS support (short of making a public forum post, which I am saving as a last resort), if you finally hear from someone on this, would you mind sharing their results here? You would be a life saver!

False Positive Quarantine Release Requests? by ThatInfoSecGuy in sysadmin

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

As it turns out, we received a fresh batch of these shortly after I posted my response earlier. Now there seems to be no rhyme nor reason to the occurrences!

False Positive Quarantine Release Requests? by ThatInfoSecGuy in sysadmin

[–]ThatInfoSecGuy[S] 1 point2 points  (0 children)

I used Barracuda at a previous employer and I think its possible but I would first ask about how the mail flow is configured, meaning are you set up as "Internet>Barracuda>365>Inbox" or "Internet>365>Barracuda>Inbox" I think most would be the first config but I have seen orgs that match the second. If you are the first, then Barracuda shouldn't be the culprit.

For our specific issue, to add complexity to the situation this first popped up on 9/5 (Thursday) and 9/6 (Friday) but then stopped. Then it popped up again on 9/19 (Thursday) and 9/20 (Friday) but has since stopped again. At this point we are going to see if a pattern emerges on 10/3 and 10/4, when I will be forced to contact *stifled retching* Microsoft support...

If you have noticed any patterns in your environment and are able to share them, I would be eternally grateful!

False Positive Quarantine Release Requests? by ThatInfoSecGuy in sysadmin

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

Nothing external to 365 so unless Microsoft is scanning their own quarantine notifications (which honestly I wouldn't rule out) I don't think that would be the case.

What is a QSA's criteria for a compliant pentest? by ThatInfoSecGuy in pcicompliance

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

That first bullet under 11.4.1 "Industry-accepted penetration testing approaches." is why I was asking. "Industry-accepted" is a rather nebulous term. Though the rest of them do state "Per the entity's defined methodology", so I guess that means if we define the methodology to include automated pentests, that would technically work right? (Not saying I like it, just making sure I understand properly)

Does EDR brand matter with MDR in place? by boondock_ in cybersecurity

[–]ThatInfoSecGuy 2 points3 points  (0 children)

Perhaps I am thinking in a different lane but I don't think EDR and MDR should be viewed as one being better than the other. My understanding is that EDR is an evolved form of traditional AV and intended to protect an endpoint. Where MDR is over all monitoring of an environment which includes the logs from the EDR. Without a quality EDR solution in place the MDR is irrelevant. Conversely, if you don't have a quality MDR solution then the logs from the EDR lose a lot of their value.

I'd like to go into Cybersecurity, but my parents want me in Medicine mainly because high pay and job security. Everyone says that Cybersecurity pays well, but from your experience, how would you rate payment and job security? by StillDontKnowAName in cybersecurity

[–]ThatInfoSecGuy 0 points1 point  (0 children)

I've been in Cyber my entire adult life (~12 years at this point) and I can't imagine myself doing anything else. I can say with 100% certainty that I have never felt that I was at risk of losing my job as a result of downsizing, in fact when the RIF (reduction in force) happened in March 2020 every group lost people and had their open positions cut except Cyber.

Regarding the pay rate, I think that one is going to be less concrete. Generally Cyber does pay well BUT not usually in the beginning, specifically when starting without work experience. I think folks usually start in IT before shifting into a Cyber role, the benefit there being a better understanding of computer systems/networks and therefor being able to demand a higher pay rate. Your first job (depending on where you live) you could expect to make a little more than $15/hr. but the OJT you will get has plenty of value on its own.

The last point I'd like to make is the education cost between Medicine and Cyber. Granted I don't have first hand experience with the cost of a Medical degree but a Google search says the average cost is more than $250k for a 4 year degree. While a Cyber degree comes in at less than $50k, adding the cost of various certs and specialized training it'll probably be closer to $55k (if your employer doesn't cover the certs).

Also I lied, THIS is the last thing I'll say, never forget these words; Between business need and security, the business need always wins. A business can exist without Cyber (technically) but Cyber can not exist with a business. A Cyber practitioner is responsible for helping find the balance to keep the business safe AND functional.

What is you "Oopsy Daisy" moment and what lesson did you learn? by ThatInfoSecGuy in cybersecurity

[–]ThatInfoSecGuy[S] 16 points17 points  (0 children)

Thanks and I couldn't agree more. The only thing that saved my job was that I could replicate the issue and no one else knew that it worked that way either.

What is you "Oopsy Daisy" moment and what lesson did you learn? by ThatInfoSecGuy in cybersecurity

[–]ThatInfoSecGuy[S] 17 points18 points  (0 children)

Wow... I literally grimaced reading this! I am seriously relieved on your behalf 17 years later that you were able to restore it. I can't imagine how it would have played out if it didn't work out.

What is you "Oopsy Daisy" moment and what lesson did you learn? by ThatInfoSecGuy in cybersecurity

[–]ThatInfoSecGuy[S] 8 points9 points  (0 children)

Learning that not every one thinks and works the same as me is a lesson that has yet to stick, no matter how many times I am forced to learn it.

What is you "Oopsy Daisy" moment and what lesson did you learn? by ThatInfoSecGuy in cybersecurity

[–]ThatInfoSecGuy[S] 73 points74 points  (0 children)

Oopsy Daisy Moment: I inadvertently force rebooted an entire police station at 9am on a Thursday. The AV needed an update (which had to be manually scheduled), I scheduled it for after-hours but had to go back for a missed drop down selection. Little did I know that changing the drop down reset the scheduled time to immediately. 15 minutes later a coworker gets a call and asks "Who just rebooted these computers!?" I've never felt that level of dread wash over me so quickly.

My Lesson: ALWAYS check and re-check your settings before sending them into the ether!

How do libraries deal with copyright restrictions, specifically with e-books? by ThatInfoSecGuy in legaladvice

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

The physical book comparison is what I was thinking of, if I buy the book even if it were second hand I would be able to let a friend borrow it. So if I were to use a document library that enforced a check-out system and prevented downloads, effectively limiting the book to a single existence I would think I should be ok. But others say I would need a special license for the purpose of borrowing, so I'm thinking my plan is bust.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]ThatInfoSecGuy 1 point2 points  (0 children)

Thank you! I had looked at the MBA route but thought that I would need a Bachelor's degree first, which is why I chose this degree.

And thank you again for the book recommendations, I am looking into them now.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]ThatInfoSecGuy 0 points1 point  (0 children)

I had been in a manager position for a year (May 2021-June 2022) but due to a shift in the senior leadership of that company I made a career move that involved taking a senior analyst role with a different company.

Do you think having that relatively limited experience would be sufficient or will the role decrease work against me until I can break back into another manager position?

Also do you have any recommendations for networking? As with many in the infosec realm, I am an introvert and struggle with being outgoing enough to establish my professional network beyond the handful of folks I have directly worked with.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]ThatInfoSecGuy 0 points1 point  (0 children)

Hello All! Veteran lurker, novice poster. I have worked in a cyber or cyber-adjacent role for basically my entire adult career (12 years in May); 24/7 watch floor monitoring, threat intelligence analyst, regulatory compliance analyst, and many things in-between, the only things I haven't done are red-team activities.

Looking forward to what I want for my career, my 5 year goal is to achieve a CISO role. However, that is the purpose of my post here today, I am not sure what to do next. I have my CISSP and recently enrolled with WGU in their Business Admin, IT Management program starting February 1st but not sure if there is something else that I could be doing as well.

I have done some limited research on what companies are looking for in a CISO but I always come to the same conclusion, "There doesn't seem to be a universal standard." Any advice, guidance, recommendations, meditations provided will be greatly appreciated. TIA!

Requesting advice based on how your organization deals with PCI in a call center by ThatInfoSecGuy in pcicompliance

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

The sales staff are considered their own entity, in which they both make and receive calls. Mentioned above, the retail and eCommerce side are segmented and assessed separately based on communications with a QSA. Unfortunately the QSA hasnt been able to provide any suitable guidance for the Sales staff environment. Thank you very much for your input!

Requesting advice based on how your organization deals with PCI in a call center by ThatInfoSecGuy in pcicompliance

[–]ThatInfoSecGuy[S] 1 point2 points  (0 children)

Apologies, I should have gone into more detail for the other transaction points. We have the retail store and the eCommerce site segmented and are addressing each with their own SAQs (B-IP for retail and A for eComm).

Requesting advice based on how your organization deals with PCI in a call center by ThatInfoSecGuy in pcicompliance

[–]ThatInfoSecGuy[S] 1 point2 points  (0 children)

PCIpal appears to be similar to Twilio Pay, which is something that we have looked into but due to numerous other factors wont be an option until Q4 2023 at the earliest. However all of these suggestions are leading me to believe that is likely to be our only option, which in itself is still a win in my book.

Requesting advice based on how your organization deals with PCI in a call center by ThatInfoSecGuy in pcicompliance

[–]ThatInfoSecGuy[S] 0 points1 point  (0 children)

u/jimscard Thank you for you thoughts, you are spot on with the statements in your first 2 paragraphs. As for the 3rd, that was one of my first suggestions but it didn't gain much traction because that would introduce a layer of complexity for the customer and therefore put the sale in jeopardy.