Has anyone done metrics on how much new RDP and vulnerable/old/misconfigured concentrators have appeared on Shodan in the past week?
The problem is most of us are trying to find where our own feet are, right now. There will likely be a lot of such questions to answer and a lot of tech debt over the coming weeks.
Tangentially, I wonder how many IR teams are equipped to deal with a major cybersecurity incident not in their office if travel / flights are hard shut down. Internal and retainer. Dealt with this during curfew after hurricanes.
I hope you're all thinking about remote forensic acquisition of images and logs. When you can.
And how to get those to your "Top Cybersecurity Consulting Firm" in case of a disaster, if they're not allowed to come to you.
And how to get those to your "Top Cybersecurity Consulting Firm" in case of a disaster, if they're not allowed to come to you.
Many years ago, I worked in a NOC during a major hurricane in Texas. The DSL connection to an oil refinery went down.
The owners called furious every 30 minutes for days. Every time, they escalated. Every time, I had to explain curfew, and that the CO was missing walls.
The owners called furious every 30 minutes for days. Every time, they escalated. Every time, I had to explain curfew, and that the CO was missing walls.
"But it doesn't look that bad from here!"
Get ready for a lot of "it doesn't look so bad from here".
Understand your people may be limited in physical access. For a while, and fluidly.
Get ready for a lot of "it doesn't look so bad from here".
Understand your people may be limited in physical access. For a while, and fluidly.
