u/bitslammer

This will be nothing more than a waste of local resources and an annoyance to the mayor and CPD. They have zero say or influence in the situation and as far as the Secret Service they aren't going to do a thing. If they deem something necessary they will do it and there's nobody who can influence them.

I get the sentiment, but I can't get past the feeling of not wanting to reward someone for scamming and encouraging them to keep doing it which will likely escalate.

If I see kids who are selling candy, carrying groceries, shoveling snow, raking leaves or whatever I'm happy to give them a few bucks.

Purview at the core but also leveraging things on the edge like Zscaler and Proofpoint for web and email.

+1 Get an example report as well as asking them about their methodology.

It never gets old, at least from the aspect that you never know what the bad guys are going to do next or what the new attack will be. I'm one of those obsessive types that has to reach a certain level of comfort with something before I can let it go. That just hasn't happened in cyber and never will. The icing on the cake though is that it's provided a very interesting and rewarding career.

I'm not sure I would do that. To me that's going to be perceived negatively.

From the perspective of the hiring side I would think they would only see you as a fit for one of those roles and either not qualified or even over qualified for the others.

Figure out which one you're best for or most want and go for that. If they think you're better suited for another role let them say so.

This assumes of course the security guy is out on 'vacation' and not on medical, parental or bereavement leave. If they are and the company is that crippled they need to hire a backup.

This is the way it's done where I work.

We're a global org on the larger side and there are only about 15 people on the VM (vulnerability management) team who run the VM infrastructure. There are over 180 people assigned in the various remediation groups who are responsible for patching their systems.

At least for standard VM stuff we use Tenable and other tools like Qualys would be the same. When configured and run correctly they should have a very low false positive rate.

I'd also caution that too many people put too much faith in "not exploitable." It may not be exploitable now, but that could change based on any number of variables and that "not exploitable" vulnerability that allows for privilege escalation just might be the thing that an attacker chains with another exploit to own a system.

I'm in a larger size org with a very low risk appetite and we have no issues about patching things even if they aren't immediately a critical exploitable risk.

If you're talking about doing a red team or pen test for someone then yes I'd fully expect those results to be vetted.

Very uneventful. By the time it came we had pretty much done all the testing one could do and have confirmed with every vendor that their stuff wasn't going to break.

In many cases yes, but it's not a 100% absolute and as has already been said there are a lot of businesses and people with good jobs that came as a direct result of someone investing in them when they couldn't go the traditional route of a bank.

You're 100% correct, but people can't see past the end of their own nose these days and if it doesn't directly help them they are against it.

Not every startup is a "tech bro" endeavor. There are people working on things like clean water, fighting climate change and medical startups that really want to do good.

Maybe not unusual, but more less common, I've seen plenty of oddball systems attached to manufacturing systems and to things like mass spectrometers that were running OS/2 even as late as 2001 on the attached "server" which was a glorified Pentium PC.

My first look for anything is Costco. I've been very surprised at some of the things they offer online and through partner sites. They offer great value and have a very gracious return policy.

The fact that you can buy a coffin from them says it all: https://www.costco.com/p/-/the-montana-steel-casket-by-titan-casket/4201052476?langId=-1

Having said that the basic zip hoodie is really all I will ever need in life outside of say skiing or other odd occasional cold weather event.

You can certainly learn the basics, but there's a huge difference in maintaining a home lab vs. being in a large enterprise sized org.

You will never have to deal with the scale of things and the absolutely wild things that tens of thousands of users bring to the mix nor will you get a taste of dealing with groups like HR, legal, compliance, Infosec etc.

Ditto. I have an "approved list" for all external email. If you're not on it your message goes straight to the junk folder.

This one really gave me the LOLs. I remember many times in the past getting the "it was nice to meet you" emails from an event I couldn't make due to being sick or had to travel.

Whatever you do don't be those people. I get it. I'm on the list you were given and am probably look like an ICP (Ideal Customer Profile) to you, but saying it was nice to meet, and some even adding "face to face" when we didn't makes you and your org look sloppy as hell. If you can't manage even the most basic detail such as this I have zero faith in you being able to actually provide accurate info on anything else.

And yes I'm looking at you guy from Akamai.

I'm in year 32 of my career which started in the DOS & Novell days. While I do still remember a lot of that fondly I haven't called on that knowledge in a long time.

What I do rely on is more the higher level conceptual knowledge. At one point I could have told you what all of the ICMP types and code field meant, now I just know that they exist and what function they serve. It's the same with many of the things you mention. I still do configure VLANs at home, but really don't think about them at the packet level. I know what I need to do what I want and that's enough.

I would agree that having a technical background is a huge advantage to you and the company you work for because it allows you to jump into those issues when needed.

I do still try and learn new areas, but not in the same way as I was when I was hands on. At this point I am more interested in what something does at a high level, why someone would choose to do that and how it functions to further security or what it brings to the table as a control.

Great comparison.

This is why you have a dev/test environment. You deploy there before production.

What is zTrip?

There may not be any real correlation. It could just be increased pricing on its own, fewer drivers, more demand...

I'm assuming by COI you mean "cost of inaction."

That really doesn't come into play when most of the project drivers are things like failed audits, mergers/acquisitions, new regulatory compliance, a breach or very close call, etc. That's the thing about cybersecurity. Teams have their plates filled with the 'must do now' projects and even the 'really really want to do' projects get pushed into the future. There's a steep cost of inaction for the projects that are already on the list.

In any org I've ever worked in or sold into there is a long list of things that would save time/money, increase efficiency, etc., that still don't make the cut of 'must do now.'

Worked in a few MEDDICC shops and I kind of agree that's overkill on the front end.

I'm in cyber and to me the only things that have ever mattered to me are if a prospect has an already approved and budgeted, or at least earmarked, effort that can be solved with what you sell. That's really it.

At least in large enterprise you're not going to convince them they have a problem they don't already see and they already have a long list of them, so it's going to be a painful uphill battle convincing them the problem you solve should be pushed to the top of the list. It's really all about keeping in contact and hitting the timing right.

it is a more luke warm call.

To me this too is a broken way of thinking, at least from the perspective of being the one called.

You're still an unknown number and an interruption. The only way that you would be differentiated from the dozens of other calls is if I actually answered and talked to you. I'm not doing that precisely because of all the targeted slop calls. There's zero desire on my part to waste time filtering.

The same goes for email. If you aren't in my approved list and you're external your message goes straight to junk mail. The volume for the past 15yrs has made it impossible to sort through. It would be like looking for a needle in the haystack when every day there's another person dumping hay on your head.

This is not something you have 100% control over. There's nothing you can do if I choose to use my personal device to engage in work communications.

You can only control what I do on corporate systems. Anything beyond that is an HR/legal/compliance issue that doesn't fall to IT or ITSec.