OMG OMG tweeps this is lulzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
TRAAAAAAAAAAAAAACCCCCCCCCCCKSSSSSSSSSSSSSSS (WTF this is pitches not tracks!)
a track should be a theme e.g.:
Tack 1 - Cyber Leadership
Track 2 - In the Cyber Trenches (Cyber Defence)
Track 3 - PURSUE (taking down teh ciber crims!)
not whatever the fuck this list is #LULZ#SCAMMY
This is a JOKE confernce isn't it... LOL
Look at this!
who wants to have an ad-hoc hacker conference? ;)
HOW DARE THEY USE WEAK CIPHERS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
• • •
Missing some Tweet in this thread? You can try to
force a refresh
ok let's #ransomware some servers! (in a lab of mine not for real coz it's NASTY!)
VMs go BRRRRR
But wait... we are gonna look at how we can PROTECT, RESPOND and RECOVER! I'm going to deploy @Veeam to help me (coz I like the product, it rocks!)
to start with I'm going to just do some PREP. We are going to need to think about Initial Access then Escalation to Domain Admin and then RAMPAGE!
I'm gonna thread some stuff whilst I build.. I'm going to start with using @VMware workstation PRO. I might do some stuff with the RACK mounted servers but let's see.
The idea management need to not really understand computer science and security in depth is probably partly why our world has such a shit cyber security posture! If you think management decisions should be made as n uninformed zombie please think again… same as… twitter.com/i/web/status/1…
I’m assuming the people that think this:
A) have not led and managed teams (fixed or project based) and
B) have a CISSP and not much else
😂😂😂😂😂
Part of the reason it’s such a mess is because people leading didn’t know what they were doing. If you have ever worked with people that don’t know what they are doing and they are in charge it’s a fucking nightmare!
ok my day plan has changed! time to make a tea and then I think I'm going to do some work on SECURITY ORGANISATIONAL DESIGN for orgs that have:
> HERITAGE (people used to call this LEGACY)
and
> PRODUCT!
now remember the first rules of org design are there are NO RULES of org DESIGN! but there are good vs bad ideas! there are also a million different different ways orgs organize their businesses so this is not ever going to fit an org (if it does it's luck!) but it's some food… twitter.com/i/web/status/1…
now i'm sketching on the fly here...
We need to think about
CHANGE THE BUSINESS
RUN THE BUSINESS
and then we have
the PROJECT vs PRODUCT scenario...
some notes on thoughts about the STATE OF CYBER in 2023
I might write a rpeort based on attack surface mapping data and incidents to back this up so it’s more than just: oh that guy Dan doesn’t know what he’s on about
But you don’t have to be Einstein to know what I’m saying isn’t bollocks.
the CISSP does not teach people to manage or lead, it's a fucking memory test....
i'm not sure how the "infosec" world doesn't understand this, but then I look at what has been created with weak ass digital security everywhere and compliance obsessed orgs who have shit postures and it all kind of makes sense...
a big failure from my pov
I don't really care about the CISSP, it's the outcomes that I see i care about, it's the focus of my rage because I think it's part of the problem.