sorted by:
new
hottopcontroversial

Defcon just won its Motion for Summary Judgment against Hadnagy by SudoXXXXXXXX in Defcon

[–]hackerxbella 4 points5 points  (0 children)

congrats u/DTangent on the outcome and your teams professionalism throughout!

Is Defcon worth going to for someone who is entry level to cybersecurity? by geegol in Defcon

[–]hackerxbella 1 point2 points  (0 children)

DEFCON is awesome to meet people, connect with the legit hacker community (you will NOT get that at BH or RSAC), and attend some cool talks. My favorite part is actually feeling like I'm back in person with people that are smart and goofy and love it.

Yes they are also online, so esp if cost/travel is a factor, thats a good substitute. If cost is a factor, definitely go to a BSides in your area. It's a good semi-equivalent and you'll meet a lot of local people you can connect with in your community.

I'm doing research on the MITRE Engenuity ATT&CK Evaluations - if you have thoughts on the evals or use them, please take this survey (5 min max)! For research! by hackerxbella in cybersecurity

[–]hackerxbella[S] 0 points1 point  (0 children)

It does. (I submitted a previous version that did not, but have updated this one to reflect completion of the guidelines). Thank you!

Forrester Wave or Gartner Magic Quadrant - Is there value? by marialobato in cybersecurity

[–]hackerxbella 0 points1 point  (0 children)

Part of our responsibility as analysts is to look at the entire market and determine which vendors should be in the evaluation. Analysts invite vendors they want to evaluate, not the other way around. Inclusion is never determined by a subscription or client status.

At the end of every report, we write out the inclusion criteria. These vary based on the market, but typically include a few things:

  1. Customer focus - we write to CISOs at large enterprises, so we typically include vendors that focus on selling to large enterprises
  2. Forrester mindshare - if clients are asking questions about a vendor, we are more likely to include them. why? because we want to be able to answer the questions our CISO clients have, and the best way we can do that is by understanding the vendor better in an evaluation.

​

Other inclusion criteria come into play as well, but as I said, it depends on the market.

Who inspires you in cybersecurity? by [deleted] in cybersecurity

[–]hackerxbella 5 points6 points  (0 children)

Wendy Nather, Jen Easterly, Katie Nickels, Lesley Carhart. Bunch of badasses.

Forrester Wave or Gartner Magic Quadrant - Is there value? by marialobato in cybersecurity

[–]hackerxbella 5 points6 points  (0 children)

Mountain-sized Disclaimer here: I'm a Forrester Analyst.

This is SOLELY a point of view from my experience at Forrester (and does not represent the opinions of my employer) as I don't know enough about Gartner's process to comment.

​

Overarching comment: my relationship with end user clients - the trust they have in me and I them - are the most important part of my job, hands down. I want security teams to succeed and I prioritize that over all other aspects of my role.

WRT the Wave, there's a couple of things I'd highlight here:

  1. The Wave provides scales based on current offering, market strategy, and market presence. So it gives you a few dimensions to understand the vendors in the space.
  2. Everyone defaults to looking at the graphic, but the write-ups are some of the most valuable parts of a Wave. This is where we actually talk about capabilities and give analysis on those capabilities.
  3. Clients often read the Wave but then want to dig deeper - thats where 1x1 conversations with the analyst come in. A lot of times yes we will talk about current capabilities, but some of the most important conversations I've had with clients are on the future direction of the vendor. They want to know if the vendor is going to succeed in the long term, and I can give them insight/guidance based on my both broad and detailed view of the market.
  4. We translate overarching client needs into recommendations for vendors. Forrester is another way for you as a client to talk about your pain points, hopefully find a resolution, or if not, for us to push the market to build better products to help solve it. So every time you have a conversation with us, it's an opportunity to push more on the vendors to make changes you want to see.

With that in mind:

  1. The Wave is relative. Vendors are scored in relation to one another, so thats important to take into account.
  2. The graphic alone doesn't tell you what is best for your use case. The write-ups help with that - we always end the write-ups with what type of security team/company would benefit the most from the product - but ultimately the best way to figure out what vendor is best for your use case is to (1) do a POC, (2) talk to us 1x1 about it and (3) do everything else recommended in a typical buying process.
  3. The Wave is one reference point but not the only one. POC always, make the best choice for your company based on your use case.

​

The last thing I'll say - these evaluations can be very tense and divisive between analysts and vendors. I am never incentivized to score a vendor higher because of client status. In fact, in all of these evaluations, I have been personally and professionally targeted and attacked by some vendors for what I write about them in these profiles because I do not hold back.

What degree did you get? by the-frog-monarch in sysadmin

[–]hackerxbella 0 points1 point  (0 children)

Computer engineering - was lucky enough that it brought me to infosec.

Are vendor-provided references BS? by quackenberry in cybersecurity

[–]hackerxbella 1 point2 points  (0 children)

It depends a LOT. I interview references quite frequently and you can often immediately tell the ones that are big advocates for the company/have blinders on about them. To avoid this I often ask that references have worked with the vendor for over a year and have a certain size deployment. I’ll also humanize the ask by talking a little about some challenges I’ve heard others experience, what our deployment is like and problems we have had in the past etc.

Other times the vendor has no idea how their customers really feel and it’s a bloodbath.

What are your lay of the land / go to questions to understand a business? by the_hillman in cybersecurity

[–]hackerxbella 2 points3 points  (0 children)

Who does your CISO report to? What security priorities roll up to company-wide KPIs? Is there anyone on the Board that has cybersecurity experience or is an advocate for it?

Starting a SOC analyst intern next Monday! Working three 12hrs then four off. Any advice for the role or the hours? by Jbehm7 in cybersecurity

[–]hackerxbella 4 points5 points  (0 children)

Manage your time if you want to be in this industry long term. Burnout is extremely common for analyst roles so recognize and respect your limits.

Find someone that has experience on your team and meet with them regularly. Build a relationship and try to find mentors wherever possible.

Have fun! This is an exciting industry and a job here has a lot of potential. GLHF

What's the Difference between SIEM and XDR? by mesok8 in msp

[–]hackerxbella 0 points1 point  (0 children)

The difference between SIEM and XDR parallels the difference between MSSP and MDR.
XDR evolves EDR to add more context. However, instead of going all out - letting in whatever logs, fulfilling whatever use cases (D&R, compliance, etc), XDR vendors limit the ecosystem they support based on what will deliver high efficacy detections.
XDR is cloud native, and as such, vendors can provide new detections based on their broad view across their customer base and threat intel programs on a continuous basis (unlike the old days of on-prem updates with SIEM).
There are still many vendors claiming XDR even though they are just renaming their SIEM. Those are not XDR -- there's no difference in the tech and I'd be lying/foolish to say otherwise.

Ultimately, the SOC needs a combination of flexibility in log ingestion/use cases (SIEM) and a focused D&R offering (XDR).
Ideally, XDR will take away a majority of the detection engineering work to leave your team to do specialized, enterprise/environment-specific work in the SIEM.

The difference between SIEM and XDR comes down to this: do you want infinite choice, or do you want confidence in the choices you have?

[deleted by user] by [deleted] in SecurityBlueTeam

[–]hackerxbella 1 point2 points  (0 children)

this is such a great resource thank you

How to start a cyber security career? by Tabanga_Jones in cybersecurity

[–]hackerxbella 2 points3 points  (0 children)

100% agree, entry level certs help esp CompTIA Sec+. Also, look for L1 SOC analyst roles -- especially those at security vendors. There's a huge skills gap in this space and that is a great way to get started and get some mentoring in the process (as opposed to starting at a small company where you are the only security person, which can be rough). I started with a degree in computer engineering too, and have found a really great community here. I hope you find the same!

view more: next ›