TPS Reports

The enemy gate is down...in Security there is only one source of gravity. The health of the organization. In corporations that's revenue or improvements to process. That's the inherent complexity with working in security...you're actually working to enable the business.

Cash rules everything around me CREAM, get the money Dollar dollar bill, y'all Cash rules everything around me CREAM, get the money Dollar dollar bill, y'all

-Informational Posts: https://www.darkreading.com/dr-tech/what-to-do-while-waiting-for-the-log4ju-updates https://www.securityweek.com/companies-respond-log4shell-vulnerability-attacks-rise https://www.itworldcanada.com/article/it-could-take-years-for-applications-using-vulnerable-version-of-java-log4j-library-to-be-patched-says-expert/468238 https://www.helpnetsecurity.com/2021/12/13/log4shell-update-cve-2021-44228/ https://research.nccgroup.com/2021/12/12/log4j-jndi-be-gone-a-simple-mitigation-for-cve-2021-44228/ https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-continued.html -Blue team resources https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 https://github.com/cisagov/log4j-affected-db https://www.greynoise.io/blog/apache-log4j-vulnerability-CVE-2021-44228 -IP Tracking projects https://gist.github.com/gnremy/c546c7911d5f876f263309d7161a7217 https://www.greynoise.io/viz/query/?gnql=tag...

if you're securing your organization what should be "down." Gravity is an undeniable force that contantly acts on objects. We can all agree on what "down" is on the planet earth... what is that concept for infosec?

I was thinking about the best metaphor to speak about security and then it hit me...disregard the "security as it relates to a house" model and adopt the "security as it relates to the East India Trading Company. In the model our #hackers will be replaced with #pirates.I like this model because it allows us to distill business activitities and concerns to concepts that are more easily understood by non technical people but also gives us a great methaphor for the internet via the Ocean and the concept of ships sailing to distant shores. I think it's fitting to talk about complex orgnaization when talking about security. The individual components may vary but at the end of the day we are usually talking about something a little more dynamic than a house. You could also use the metaphor of security as it applies to a livign organism but I think that might become too abstract. So the security of an port in the Caribbean is easy to undertand. Islands can be...

Prose are code that runs on wetware. 

I've always know that music influenced my productivity levels but the quarantine has given me time to dig into what each genre of music puts me in the mood for.  Separated from all other variables I can now say that punk music makes me want to write. It's a very odd realization for a 30 year old but hey there it is. 

Someone on twitter brought up resources for developing soft skills and my mind immediately just to these 3 books.   How to Win Friends and Influence People  If I understood you, Would I have This Look on My Face?  The Art of Conversation  I hope that in the future I'll have more books to recommend in this topic as I'm a big believer in communication skills to complement technical skills.

Bash Resources:  https://github.com/onceupon/Bash-Oneliner

Lets call this a If we use the building metaphor for infosec to talk about the industry   Vulnerabilities  vs weaknesses vs compliance findings  ( need more clear definitions)  Consultations are going to an architect to see if an idea is solid or can be implemented better. Threat modeling is walking and walking through a complete blue print discussing both security best practices, weaknesses in the design, and zoning/safety laws(compliance). White box security testing  is walkthrough and inspection with some gentle use to make sure you were built up to code and no defects popped up because substandard materials got into the build.( Shit happens) Black box security testing or black box penetration testing is asking a security company to assess you like an attacker would.  Vulnerability management would then be regular inspections for mold or wear and tear damage.  Incident response is an emergency repair team that can be called on for many reasons....

I'm more of an auditory learner. At one point I did use to sit down for hours and read but that is no longer the case. Now when I want information I  want it structured as efficiently as possible and in a format that I can pipe to my headphones. I've found some good resources that allow me to convert books to audio and awesome podcasts. Infosec books and coding book are tricky because you need to see the diagrams and output snippets but I tend to lean heavily on youtube for that. I also love the kindle apps reading feature that lets it read books you've bought. That way you get the book and the narration with one purchase. Some audio resources and online youtube classes to supplement your learning include: Podcasts:  https://risky.biz/netcasts/risky-business/ Online classes:  Sam Bowne's  class CNIT 129S: Securing Web Applications https://www.youtube.com/watch?v=s8lS2V5thhY&list=PL7gCgFw1RV1M6vJFX1RPDhgPZbg9qU3ub

I got the idea to see if i could run two roms next to each other so I could reference english and take screenshots. However Animal Crossing Wild World doesnt have furigana so its not ideal for noobies.

A more senior member of my team gently chided me today. I expressed doubts that someone would do the right thing if there was no ticket / incentive to correct what could be considered a weakness in the design. I was worried that they would go on to use the same design with the same weakness in the future. "You must expect the person we're talking about to do the right thing T. If your attitude doesn't reflect that you may even encourage them to do the wrong thing. " I wonder if our attitude leads to insecurity? Certainly I'm stubborn enough to do something stupid out of spite. -T

Quarantine gave me time to play animal crossing and i realized it could be good japanese practice... So im going to start cataloguing things and vocab. Dont know about the lay out this will take but I usually enjoy making things up as I go along. So far Ive realized even my ability to read Hiragana and Katakana has degraded significantly but its coming back quick.  Tools I'll be using jisho.org for a lot of the quick and dirty translation work. Maybe Ill add a section on using it to search words. Started using the Jsho app on my phone and its pretty good too. Duolingo Common words たぬきマイル たぬき = Raccoon マイル = Miles  Blathers 寄贈 (きぞう) する= donate  かせき = Fossil  かんてい = judgement / expert opinion Supplies 木材(もくざい) = Timber 柔らかい木材(やわ らかいもくざい) = soft timber  鉱石(こうせき) = ore; mineral; crystal

Test Post