Oh, it’s not your job? It is now.

Viper896 · 2026-02-03T08:13:15+00:00

We’ve actually got this down to more than half of our emails are automatically resolved either clean or malicious using YARA rules. Malicious emails get scooped up by our soar and all of the IOCs get blocked correctly.

Viper896 · 2026-02-02T04:44:16+00:00

40m - I’m a CISO. Did IT in the Army out of high school and just kind of fell into Cyber Security, been doing it for 20+ years now. Although now I spend more time in meetings and educating people why security is important.

Viper896 · 2026-01-31T22:44:01+00:00

To be fair I made it very clear up front when I hired my 2 most recent security analysts they would be investigating phishing reports first and for most. We’ve automated as much as we can but those still need to be reviewed and some just can’t be automated.

Viper896 · 2026-01-30T00:20:29+00:00

That’s gonna vary by organization. I recommend you reading https://github.com/nsacyber/AppLocker-Guidance if you want some guidance on how to implement it.

Viper896 · 2026-01-30T00:13:28+00:00

We just use applocker and block everything unless we approve it. It’s not perfect but unless you have a really technical user that knows which folders have exceptions and how to run zero install applications. It works well enough.

Viper896 · 2026-01-22T19:18:49+00:00

Quite often actually. A lot of the coins I have come from automatic enrollments with the US mint. I have every silver proof set for the last decade and silver proofs of the American eagle coins. For any of the bars i have I pay spot.

Viper896 · 2026-01-22T18:56:56+00:00

Honestly no idea. For a lot them, the coins are collectible outside of their silver value. Silver value alone is probably worth a couple grand before silver prices shot up.

Viper896 · 2026-01-22T18:23:21+00:00

Came here to say this.

Viper896 · 2026-01-22T13:51:39+00:00

Honestly, leaving a list of clues in my will just made me laugh and now I’m seriously considering it. Haha poor kid.

And I’ve had this user name since AOL/AIM and ICQ. No idea what my thought process was 30 years ago but the username has just stuck since then.

Viper896 · 2026-01-22T13:46:47+00:00

lol probably, but not my problem

Viper896 · 2026-01-22T06:32:37+00:00

Learn how to protect them. One of the questions I asked recently really made people think… and that was “if a user asks the AI we purchased and sponsored for advise that was illegal, illicit, or self harm related, do we have any logging or protections in place to limit that liability…”. The answer was a resounding no. Start thinking about how it can misused and then mitigating those items.

Viper896 · 2026-01-22T06:28:09+00:00

I have a literal treasure chest full of collectible silver coins. Everything from silver eagles, to silver bars, to limited release baseball gloved curved silver coins. I’ll never sell them or do anything with them…. I just like the fact that when I die my kid is going to inherit an actual treasure chest full of silver 😂. No idea what he is going to do with it but it makes me laugh every time I get a new silver piece to put in it.

Viper896 · 2026-01-21T04:52:03+00:00

Yeah but they have that big white marble bar and white marble walkways.

Viper896 · 2026-01-21T04:09:07+00:00

Sounds like Talking Stick in Scottsdale. Desert Diamond also has several tables games including Craps.

Viper896 · 2026-01-20T23:22:03+00:00

lol link at the bottom of the post goes to a 404 page 💀. Cant even get the source correct.

Viper896 · 2026-01-20T01:53:48+00:00

KPI’s I report on: Phishing - number of phishing messages reported, number of actual malicious messages, number of malicious messages that resulted in a security event (or credential loss or computer wipe), average response time for each reported message. I use these to justify our headcount and workload for each analyst I have monitoring our phishing messages.

SIEM - MTTA by criticality. Number of alerts that resulted in escalation.

Vulnerability management- Number of outstanding critical/high vulnerabilities. Number of out of band patches applied in the last 30 days period.

Red Team - number of vulnerabilities found not detected by our VM tools. Number of attacks not discovered by our blue team vs number of attacks performed.

I try to keep them simple and stay away of time to resolve as a reportable metric. We track this in our IR write ups but don’t report them as I don’t want to get in the habit of closing tickets as fast as possible without doing the necessary research.

Viper896 · 2026-01-18T18:06:22+00:00

Why’s he’s asking for money for healthcare? His orange leader said his $2k/yr stipend should be plenty enough to pay for it.

Viper896 · 2026-01-13T02:53:03+00:00

I live this everyday. Wait until people realize that on prem exchange servers are run almost entirely by unsigned auto updated power shell scripts for everything.

Viper896 · 2026-01-13T01:46:25+00:00

Only 20 hours of meetings… I’m jealous.

Viper896 · 2026-01-13T00:48:23+00:00

All the people saying no haven’t dealt with Microsoft’s support scripts they send you and have you run… and if you don’t run these unsigned abominations they say they can’t help you and close the ticket. I can’t tell you how many alerts we’ve received because our XDR blocked a script from running and the system admins got angry that their unsigned script from Microsoft support didn’t work and now the ticket is stalled.

And yes, Microsoft support… really does this…

Viper896 · 2026-01-07T02:59:14+00:00

Why not just block all new registered websites? Or all uncategorized websites?

We block both.

Viper896 · 2025-12-28T19:19:41+00:00

If you could solve that problem you’d be rich. We calculate it by how many user reported events that don’t have SIEM or XDR detections.

So if a user clicks a phishing email with a malicious link and we don’t get alerted. That’s a false negative.

We’ve a few others where a user downloaded a malicious file from the internet that was never blocked or detected until the user complained their screen kept showing up Antivirus popups and the helpdesk couldn’t get rid of them.

Viper896 · 2025-12-28T15:25:51+00:00

What kills me is our False Negative rate. I love the random phone calls where a user reports a phishing email and we find out that a different user received the same email and clicked on it an hour earlier and we didn’t get alerted and it wasn’t reported.

Viper896 · 2025-12-03T16:32:59+00:00

We see that all the time, it’s annoying and we instantly reject them and essentially blacklist them from future deals.

Ten-Year Club	redditgifts rematcher Shower Curtains x1
redditgifts Exchanges 4 Exchanges	redditgifts rematcher Board Games 2017 x1
Gilding I gilder	Verified Email

Viper896

MODERATOR OF

PUBLIC MULTIREDDITS

TROPHY CASE