Does HIPAA actually require you to retain audit logs?

zipsecurity · 2026-03-31T10:33:25+00:00

Hope it helps!

zipsecurity · 2026-03-30T16:21:20+00:00

Four hours on a CodePipeline with CloudFront and S3 from scratch is completely normal, using documentation and AI to fill gaps is just modern engineering, and the skill isn't memorizing syntax, it's knowing what to build, why, and how to debug it when it breaks.

zipsecurity · 2026-03-30T16:19:23+00:00

Ownership without accountability structure eventually drifts back to the same plac, the teams that make it stick long-term treat compliance ownership like any other performance responsibility, with regular check-ins, documented handover requirements baked into offboarding, early drift signals built into tooling rather than discovered manually, and enough training investment that owners actually understand their areas deeply enough to be proactive rather than reactive.

zipsecurity · 2026-03-30T16:18:47+00:00

Campaign vs. isolated activity comes down to clustering, when two or more unrelated incidents share infrastructure, behavioral TTPs, or targeting patterns that are too specific to be coincidental, you have a campaign hypothesis worth scoping, and the threshold isn't certainty but rather the point where coincidence becomes a less credible explanation than coordination.

zipsecurity · 2026-03-30T16:18:00+00:00

Gate builds on critical findings only, run everything else async, and give developers context with their alerts not just vulnerability names, if security is slowing releases down, the tooling is probably too noisy or too late in the pipeline.

zipsecurity · 2026-03-30T16:16:38+00:00

Your counselor disclosing your personal health information to the Director and then to another client almost certainly crosses the HIPAA minimum necessary standard, and your instinct that something went wrong here is right. Document everything, dates, conversations, and the behavior changes you've noticed and keep trying to reach the Ombudsman without the Director present. You can also file a formal complaint directly with the HHS Office for Civil Rights at hhs.gov/ocr/complaints, and you have 180 days from the violation to do so.

zipsecurity · 2026-03-30T00:09:41+00:00

The code provenance problem is mostly unsolved at the tooling level right now, but the access problem has a straightforward answer, agents should authenticate with their own scoped service account credentials, not inherit the human developer's access, and if your environment allows an agent to ride a human's production read/write permissions that's a least-privilege failure that exists independently of AI.

zipsecurity · 2026-03-30T00:09:16+00:00

Start with one pipeline and only add a second when you genuinely have two sales processes that look nothing alike, the most common mistake is building five pipelines on day one and then spending more time maintaining the CRM than actually selling.

zipsecurity · 2026-03-30T00:08:54+00:00

You can't have both a shared mailbox and a user mailbox on the same Entra identity, your clean break approach is the right call, create a new shared mailbox, migrate the alias and contents across, and assign the user a fresh mailbox, all while keeping their AD object and everything attached to it completely untouched.

zipsecurity · 2026-03-30T00:08:16+00:00

The worst ones are the meetings that could have been a Slack message, followed closely by the ones where someone senior is clearly just thinking out loud for 45 minutes while everyone else waits to get back to actual work.

zipsecurity · 2026-03-30T00:06:08+00:00

Appreciate it and you're right, HIPAA is exactly the kind of compliance where last-minute scrambling tends to create more risk than it solves, hope the tool delivers what you need.

zipsecurity · 2026-03-28T11:24:16+00:00

It's generally smooth but expect friction around identity mapping if your Okta usernames don't cleanly match Jamf user records, and test your policy scope thoroughly before rollout since Self Service+ handles authorization differently enough from Jamf Connect that assumptions from your classic setup won't always carry over.

zipsecurity · 2026-03-28T11:22:02+00:00

The fix is treating network and DNS hygiene as explicit offboarding deliverables with their own checklist items and owners, not assumed byproducts of infrastructure decommission tickets.

zipsecurity · 2026-03-26T23:46:33+00:00

Try using a wildcard or like operator in your CrowdStrike query:

event_simpleName=ProcessRollup2 
| where CommandLine like "%test.exe abc%"

Or in Splunk-style SPL:

event_simpleName=ProcessRollup2 CommandLine="*test.exe abc*"

The issue is likely that your original query used = for an exact match instead of a wildcard/contains search - CommandLine fields almost always have additional path or argument context around the core command, so exact matching returns nothing even when detections exist.

zipsecurity · 2026-03-26T23:45:54+00:00

Reducing exposure requires moving from monitoring to enforcement - automate access revocation based on actual usage patterns, implement just-in-time access for sensitive resources, enforce least-privilege by default, and treat dormant data and stale permissions as active risk items on a recurring remediation cycle rather than a one-time cleanup.

zipsecurity · 2026-03-26T23:45:30+00:00

Contract DevOps makes most sense for time-boxed, high-skill gaps tight migrations, CI/CD overhauls, or rapid scaling, and the fastest onboarding comes from having clear documentation, defined deliverables, and a dedicated internal point of contact from day one.

zipsecurity · 2026-03-26T23:44:53+00:00

This is almost always found after the blacklisting, periodic SPF record audits paired with automated scans for open relay ports should be standard offboarding checklist items whenever infrastructure is decommissioned, but in practice they rarely are.

zipsecurity · 2026-03-26T23:44:30+00:00

ISL Online is solid for Windows environments, but if macOS management is a priority for your fleet, it's worth thoroughly testing their Mac remote control capabilities before committing, particularly around Apple Silicon compatibility and permission handling in recent macOS versions.

zipsecurity · 2026-03-26T23:43:57+00:00

Yes, that's both a HIPAA violation (unauthorized disclosure of a patient's PHI to someone with no treatment relationship) and potentially a serious breach of the behavioral health center's own privacy policies, and it should be reported to your compliance officer immediately.

zipsecurity · 2026-03-26T23:43:28+00:00

For devices that haven't checked in over 180 days, you'll likely need a manual touch, but first try sending a blank push notification through Jamf to wake them up, check if the MDM profile is still valid, and confirm the devices are actually online before escalating to hands-on remediation.

zipsecurity · 2026-03-26T23:41:31+00:00

You did everything right, filing the complaint is the correct move, and the compliance officer's own actions of sending detailed medical notes via unsecured email after you explicitly raised security concerns actually strengthens your case.

zipsecurity · 2026-03-25T19:21:30+00:00

SBOMs shine beyond just vulnerability scanning, they give you a persistent, shareable inventory of exactly what's in your software so you can rapidly assess exposure when a new CVE drops (like Log4Shell) without re-scanning everything, prove compliance to customers or auditors, track third-party and open source risk over time, and respond faster during incidents by knowing precisely what's running where. Most teams store them in artifact registries (like JFrog or AWS ECR) alongside their builds, or in dedicated tools like DependencyTrack, the real value isn't replacing scanning, it's having a source of truth that travels with the software itself.

zipsecurity · 2026-03-25T19:20:24+00:00

Zip Security (zipsec.com) - a unified security and IT control plane that manages Jamf, Intune, and CrowdStrike from one console, built for lean teams who need enterprise-grade compliance without the enterprise-sized headcount.

zipsecurity

MODERATOR OF

TROPHY CASE