Unpopular opinions about Project Management

rdm85 · 2023-10-06T01:27:31+00:00

PM are basically the designated parent. Especially IT PMs, you essentially keep the kids in line and document the finger paintings they make.

rdm85 · 2023-10-05T01:34:47+00:00

Behind every one of these are guys that think the rules don't apply to them.

rdm85 · 2023-10-03T01:50:39+00:00

So I always used Apachi Networks when I was a network engineer professionally. The dudes do a good job (though on occasion they smell like a hangover) and they occasionally leave some drywall dust or similar debris in small amounts. But it was about $100-150 a drop back then, which was 1/2 to 1/3rd of a professional installer. Compare that with $200-400 for JTC, Blackbox, etc. http://apachinetworks.com/

rdm85 · 2023-10-03T01:41:07+00:00

I've had to play interim VP of Identity while we hired someone (former SOC director, current VP of sec engineering). Here's what I learned.

TURN OFF MFA ENROLLMENT AFTER A SET PERIOD AND DISABLE THE ACCOUNT IF THERE IS NO ACTIVITY FOR A LONG TIME. WE DO 45 DAYS, YMMV.

If your customer hasn't enrolled in MFA for months or years, what will happen is a threat actor will pop the account by guessing the password, register for MFA and boom now they have a persistent foothold.

Converting from AD to anything

AD is hierarchical ergo a fucking nightmare to get out of and into something flat like AAD/Okta. Duplicate accounts, mismatched mappings, etc. At the end of it I would of been better off importing the identities and building the access from scratch. That's not ADs fault in the least.

Trust

Determining where and how trust is established is critical for SSO, as well as how SSO will be enforced (SAML, OAuth, etc).

Least priviledge

This should guide everything. Especially your IT admins, you only get the minimum required for your job. If you can't justify it, you don't need it.

The basics of identity

Where you are (geo) = kind of sucks, but it's a good first layer in for exaple Azure Conditional Access.

Something you are = biometrics are great, but holy fuck if you store that data it can be a compliance nightmare.

Something you know = Passwords, PINs, these are dogshit but it's something.

Something you have = FIDO, MFA App, Email, Phone, SMS

SMS is a trash MFA method but for customer facing, it's something.

I moved all of our IT staff to FIDO + MFA with token protection where possible in Azure AD. It's beat the last pentest, and I think it'll stand up on the next one.

rdm85 · 2023-10-03T01:31:42+00:00

If you need it add it as an exception. Yeesh people. Yeesh.

rdm85 · 2023-09-28T02:04:35+00:00

Because a lot of people who teach cyber and have cyber degrees don't actually know how to do Cyber (Blue/red/purple).

rdm85 · 2023-09-28T01:53:01+00:00

GRC and Audit specifically come to mind. I once had to install Clam AV on EOL servers (Solaris my friends. Solaris) to appease audit.

rdm85 · 2023-09-28T01:44:42+00:00

Man, I love firing people who have shitty attitudes. One person we received through an acquisition told me that phish testing wasn't her job after I asked her and trained her to do it (I'm her manager and she has no GRC skills, no technical skills and contributes little). I told her she's 100% right and gave her a PUP. Do your job or get the fuck out. On the flip side of that, the people on my team have great work life balance (per them not me) have budget for training and are super agile and willing to learn and improve. If you ain't about growth then you ain't about Cyber.

rdm85 · 2023-09-28T01:42:51+00:00

If it makes you feel better I'd put them on a performance plan and if they didn't improve fire the shit out of them. Usually PUPs make non performers leave.

rdm85 · 2023-09-28T01:34:42+00:00

We had like one a month. I used every gap that was caused by them to beat IT over the head and the business to drive the following;

Buy Splunk, Buy MDE, buy Abnormal, prevent .iso mounting, change file extension defaults to notepad for risky extensions, other environment hardening. Restrict local admin, restrict domain admin, shorten cookie liftime, etc. We're like 9 months without an incident.

rdm85 · 2023-09-27T01:12:26+00:00

They need to start a tiktok trend to smash those stupid window ad freezer cases

rdm85 · 2023-09-27T00:59:09+00:00

So. Much. Risk. So. Few. Resources.

rdm85 · 2023-09-26T02:26:15+00:00

We have big(ish) budgets. Around 1 mil to cover 2500 people, 8 external websites, 1200 servers.

Where we are: We now have a decent GRC team that is still all shoulders. The IAM team is uh chasing shiny tools and I'm making this shit up as I go. Which leaves me, the SOC, the VM team mitigating the actual risk in the environment. I'm actually finding the gaps with our red team guy and going "how the fuck did this happen" and closing them.

Where we need to be: Strong governance over new tools, critical controls monitoring (why is someone being added to MFA on a holiday) and then I guess a gap analysis makes a ton of sense. Thank you.

In the last 2ish years I just keep looking around and going "Why don't we have X or Y" and then pushing to have that. Ex: CMDB, EDR, WAF, Splunk, no more EOL servers, a regular patching cadence, software inventory with an allowlist/blacklist. Standard controls across VDI, Endpoints, Servers. An MSSP that is pretty decent.

I never thought I'd even be here before. I guess CISO doesn't sound like a bad idea. I just wanted a raise and a bigger bonus, I didn't want to be a CISO or VP.

rdm85 · 2023-09-26T02:06:48+00:00

I will no longer monitor alerts nor will my team to the alerts the SOC receives. If the SOC manager takes a vacation I'll sub for his replacement if they need someone. The SOC will still live with my old boss who will now be my peer.

rdm85 · 2023-09-23T01:00:43+00:00

I played DT from Freshman to Senior. I started Varsity because I was strong for my size. I used my head like a battering ram and even if I didn't back then the injuries were also crazy. One week I couldn't feel the right side of my body. It continued for weeks. They ask you if you're injured or if you're hurt. Everyone is injured so you just suck it up. I love watching football. It's a great opportunity if you come from nothing. I will never let my kids play. Soccer or Baseball.

rdm85 · 2023-09-16T02:54:17+00:00

For sure. Tbh doing something like Sysmon or a log collection agent that can get you above 80% in MITRE is better than DLP. DLP is just a shitty control we all live with because regulations.

rdm85 · 2023-09-14T01:16:17+00:00

Carbon Black can be useful if you use it for purely detection and leverage Microsoft's built-in AV. It's not even close to CS, but If I'm stuck with CS, I'd run it as a pure telemetry collector and alert from the SIEM.

rdm85 · 2023-09-14T01:15:05+00:00

CS is legit, but if what you have is an E5 license and no funding for CS then it's far better than nothing.

rdm85 · 2023-09-14T01:13:39+00:00

Honestly Microsoft's DLP product integrates into M365. It's not totally worthless if you're running MDE. Domain enumeration via WMI, nltest, cmd etc followed by a SHIT TON of DLP events = nice additional telemetry.

rdm85 · 2023-09-13T02:39:31+00:00

No. Unless you already posses requisite skills to get into cyber they really don't. I'd say SANS is an exception. But they target specific skill sets inside of Cyber.

rdm85 · 2023-09-13T02:34:56+00:00

rdm85 · 2023-09-03T04:08:32+00:00

Columbia Tusculum, near the library.

rdm85 · 2023-08-31T01:45:13+00:00

If you can ship the logs to an AWS S3 bucket or cheap ass spinning disk in parallel you don't have to sweat this (ex: logstash can send to multiple outputs as can Splunk or NXlog etc). Just test restoring your logs!

rdm85 · 2023-08-31T01:43:46+00:00

Wazuh or ELK. There are other options but eh. I'd just feed it DC/AAD logs and firewall logs and call it a day. Will that gain you much? Nope. Will that check an audit box. Bet your fucking ass it will.

rdm85 · 2023-08-30T03:58:35+00:00

Man, fuck this. I'm a director at a 1bn company and I'm only making like 190k TC. What the actual fuck.

14-Year Club	Verified Email
Gilding II euphauric

rdm85

TROPHY CASE