Y'all remember my Golden Ticket charity fundraiser from last year where you could win free access to ALL my training? Well, good news. It's coming back in December!
I'm planning it now and want to make it even bigger. So...
Last year we raised 46K for charity, which I matched for a total impact of 92K.
This year, I'm looking for individuals or companies to partner with me by matching a portion of the money raised or kicking in funds at specific community donation goals.
One way to help is to offer to match up to $amount of donations.
Another is to offer $amount that you will contribute once the community reaches $goal.
My team will handle the logistics of it all so that it's headache-free. We'll also share with folks that you're helping out.
If you or your business is interested in partnering with the Goldent Ticket charity fundraiser, DM or email me at chris [at] ruraltechfund dot org.
Here's last years Golden Ticket thread with the details of what we did and the results:
There are a lot of ways that folks distinguish between blue team roles. My focus is on investigative work and cognitive skills, so I divide those roles into the mental model shown in this diagram. 1/
The primary characteristic that distinguish these investigative roles is their common place in the incident identification and response process. You might be familiar with that process acronym of PICERL, but it appears in many forms: csrc.nist.gov/publications/d…. 2/
In the diagram, the functional portion of the PICERL process is at the top. Each role is listed below that with where it typically fits in relative to those phases. Preparation and Lessons Learned phases are excluded since those are pre and post-investigation steps. 3/
At it early this morning. It’s going to be a great day. #BBQ
Today, the only thing going on is this beautiful prime brisket. It has my full attention. Just over 12 pounds before trimming, probably closer to 10 now.
I’m often a salt and pepper only guy for brisket, but I’ve been digging the Meat Church rubs lately so I’m trying their Holy Cow on this one. Trimmed and rubbed down last night. On the counter now while the pit warms up.
Since I spend so much time talking to and researching SOCs and SOC analysts, I often get asked, "What the biggest difference is between high and low growth SOCs?"
The answer? Expectations.
1/
First, what do I mean by growth? I'm talking about places where analysts can grow their abilities. These are the places that take complete novices and help them achieve competence or take experienced analysts and help them specialize. Growing human ability.
2/
The organizations that support growth well are those where leadership has high (but realistic) expectations for analysts. These most often center around expecting the analyst to be able to make reliable, evidence-driven decisions confidently.
3/
Like lots of folks, I'm pretty miffed by the lack of robust virtualization support on Apple M1 hardware. I hope that gets fixed soon. But, it also got me to thinking about decision making at big vendors like Apple and others.
1/
For example, the security community (myself included) is often critical of Microsoft for some of their decision-making when it comes to usability/flexibility vs. security. Two things immediately come to mind...
2/
1. Macros. The idea that they exist, are default usable, and the UI pushes users more toward enabling them than disabling them.
2. Default logging configs. Fairly minimal with lots of sec relevant stuff left out (integrate sysmon already!).
3/
A lot of tips about good writing are rooted in the psychology of your reader. For example, if you want your reader to understand a risk (a probability), is it better to express that as a relative frequency (1 in 20) or a percentage (5%)?
1/
Typically, people understand risk better as a frequency. For example, consider the likelihood of a kid dropping out of high school. You could say that 5% of kids drop out, or that 1 in 20 does. Why is the latter more effective?
2/
First, it's something you can more easily visualize. There's some evidence you might be converting the percentage into the frequency representation in your head anyway. Weber et al (2018) talked about this here: frontiersin.org/articles/10.33…
3/
Abstractions are something analysts have to deal with in lots of forms. Abstraction is the process of taking away characteristics of something to represent it more simply. So, what does that looks like? 1/
Well, speaking broadly, let's say that I tell you I had scrambled eggs with parsley and tarragon for breakfast. You can probably picture that very clearly in your mind and it will be fairly accurate to reality. However... 2/
What if I just tell you I just had eggs? Or that I just had breakfast? Your perception of reality may differ greatly from what I actually ate. The abstraction increases opportunity for error.