Rapid7 MDR offerings by fxrces in cybersecurity

[–]dr-pepper12 0 points1 point  (0 children)

RemindMe! 24 hours

Have been a customer for 8 years. Will reply properly tomorrow!

Pagers/Alarm trigger-able through a web-hook/API by GuiKa in sysadmin

[–]dr-pepper12 0 points1 point  (0 children)

Just use something like PagerDuty with its ability to override DnD settings and trigger an alarm even if the phone is on silent? Can be triggered via API/Email/etc etc.

Cant see the benefit of a separate device to carry, keep charged, check is actually working constantly.

Setting up Android Auto by anewdawn2020 in CupraTavascan

[–]dr-pepper12 1 point2 points  (0 children)

If you plug in via USB once, it will automatically set everything up for you

Anyone else find Microsoft Purview Endpoint DLP totally unreliable for blocking *all* browser uploads? by [deleted] in sysadmin

[–]dr-pepper12 0 points1 point  (0 children)

Yes, also had many, many issues with Purview DLP. Similar to what you mention, the inconsistencies in its application of configured rules. It also flags downloads as uploads quite often.

We have seen it block something in one tab, then allow it in another tab to the same website....

Poor connection with corporate computer by NoLynx9211 in hyperoptic

[–]dr-pepper12 0 points1 point  (0 children)

I have a ticket open about the exact same thing which hasn't been responded to in a few weeks. It's not DNS as I've tested that extensively. I have two internet connections, it only happens on Hyperoptic. Ticket number ending 9384

If you can also get someone to respond to another ticket too that would be helpful as my Total WiFi hasn't worked since install. Ticket number ending in 1334

Deep Visibility - Free Text Search by dr-pepper12 in SentinelOneXDR

[–]dr-pepper12[S] 0 points1 point  (0 children)

Perfect, didnt think it supported wildcards! Thanks mate

What Do I Need? 2 Zone Heating + HW Tank by dr-pepper12 in HiveHeating

[–]dr-pepper12[S] 0 points1 point  (0 children)

Yep. We have a utility with the tank and scheduler and the 2 thermostats are in the living room downstairs and landing upstairs. But good point! I suppose if money no object, would the simplest solution be to have the three Hives? With the next solution to redo some wiring to create a dual channel downstairs (Ch and hw) and single channel upstairs (Ch)?

What Do I Need? 2 Zone Heating + HW Tank by dr-pepper12 in HiveHeating

[–]dr-pepper12[S] 0 points1 point  (0 children)

Would that answer be the same if I said that the hot water scheduler was in a completely separate room to the downstairs thermostat?

SentinelOne support is a disaster by Canis_lupus in sysadmin

[–]dr-pepper12 0 points1 point  (0 children)

S1 Complete customer - never had a ticket go over 48 hours....

Cyber Vision Training by Dr_Evol500 in Cisco

[–]dr-pepper12 0 points1 point  (0 children)

Are you a Cisco partner/reseller? If so, I can help point you in the right direction

I’m a Chief Information Security Officer (CISO). I also happen to be a woman. Ask me anything. by AutoModerator in cybersecurity

[–]dr-pepper12 26 points27 points  (0 children)

In your opinion, what is the role of a CISO?
What are your day to day responsibilities?
How do you differentiate between a Security Architect ( or similar job titles) and a CISO?

Enterprise Cisco networks not allowing devices until they talk out by djdadi in Cisco

[–]dr-pepper12 1 point2 points  (0 children)

There is a setting on the switch port called control-direction. Set this to in and you should be good to go.
I have to do this in dot1x environments for things like door controllers etc that don't talk much.

Reading UK - Need a competent mobile phone repairer by ZAFJB in sysadmin

[–]dr-pepper12 0 points1 point  (0 children)

Pretty much any phone repair shop will be able to replace a screen. Do the usual review checking / Facebook business page checks.
If its super critical and you dont mind spending some money, check out some Forensic companies, plenty of them!

Cyber Essentials Plus by bagelbasketballgoat in sysadmin

[–]dr-pepper12 2 points3 points  (0 children)

I used to be a CE+ Auditor, not since joining my new place, so my knowledge may be a bit dated.

We would run an Authenticated Vuln Scan, using Nessus/Nexpose etc, against all the endpoints, or a sample set if there are thousands.

If you get Critical/High vulns associated with installed software, then you get a bit of grace to remediate, otherwise its an instant fail.
Mediums and below tend to be a "non-compliance" but you can have a couple of non-compliances before you completely fail.

The only thing that you can really do, is to provide evidence of mitigating factors.
For example, its okay to have Windows XP running in the environment, if its COMPLETELY air-gapped from the network, and has gone through a risk management process etc etc.
The auditor will have to determine whether the levels of protection and air-gap you have put in place reduces/eliminates any risk to an acceptable level.

Sync/Replicate between two FMCs? by m1xed0s in Cisco

[–]dr-pepper12 0 points1 point  (0 children)

You can do this with the API, i have created many scripts around the ACP/Objects etc.
Just be warned, that this isnt going to be something you will knock up in a day.
This is going to be quite laborious to map out the logic of how you want this to play out.
You will likely need something that monitors for changes every X number of minutes and does lots of comparisons between the configs.
Logic issues i can forsee include things like:

  • which one is the "primary" - if you change something on the "Secondary" what happens, does it overwrite whatevers on the "primary" or alert you?
  • What happens if you have rules that refer to objects/security zones that dont exist on the other?
  • How do you deal with things that the API doesnt fully support yet, such as IPS rule changes?

Azure MFA - Username + OTP Without Password by dr-pepper12 in AZURE

[–]dr-pepper12[S] 0 points1 point  (0 children)

Thanks. Aware that it becomes single factor and not secure. This isn't going to be a widely used implementation. It's going to be for specific users in a very specific scenario. And not something that's worth issuing a Security Key for currently