One of my tangents today during my workshop referred to the fact that PowerShell v2 was still enabled in Windows systems and can be used to bypass eventlogging by threat actors. Disable it.
#DFIR
#CyberSecurity
#CyberTip
I am quite often asked if there are sites, training, and/or books that I would recommend to get into DFIR and of course, continue to learn. So I have created a sub-page Resources with my recommendations. I will continue to update this page over time.
I went and got myself a new car this weekend.
I am going through a separation (which is taking a lot longer than I really want), but in it, he is taking the Tesla so I went and got myself a new toy.
Conference etiquette. Well, maybe just social etiquette.
I heard about and saw a couple of things I want to just point out that I really don't think are acceptable ways to interact with speakers at a conference.
1/4
🧵👇
1. Asking someone their citizenship status.
So, I used to think that
#ThreatIntel
was the pointy tip of a mature SOC capability. Now I'm starting to believe it really should be at the bottom end. Threat intelligence and
#ThreatModelling
. Figuring out what you are protecting (
#AssetManagement
), where they are located and
Doing some
@PentesterLab
: "One quick way to find passwords is to search for the following mistake: people typing their password in their shell instead of the password prompt. By doing that, their password will be available in the history files."
Attackers also make this mistake
Our barrier to entry in this industry is already too high.
Stop being dick heads, stop asking women personal details that have NOTHING to do with their talk (and i suggest you go and apologies) and even then if they say its OK, its still not OK to do it.
4/4
Presented to 462 people today, all virtual so I was presenting to myself essentially. But I think it might be the largest audience I've presented to, does it count??
Yesterday (Friday) i updated my LinkedIn and made it official. I have started my own company and will be looking to delivery IR and forensics services to Australian businesses :) It was a surprisingly easy decision
#cacciacyber
#cacciacybersecurity
#huntorbehunted
Words cannot express my feelings tonight, 2 days of con and talks and support and lovely people. Im smiling and happy and so fullfilled. What an amazing community we have and i appreciate every day the part i get to play. Happy isolation to everyone, cherish this time together
Thankyou to everyone in the class today, such a wonderful group and was a pleasure. Thanks
@BSidesMelbourne
for a great venue and my wonderful co hosts!
It was linkedin official yesterday and now its twitter official. Im pretty excited by this role, it means that i can review, implement and ensure that we are doing everything we can to be the best company, not only at what we do, but how we do it.
#Trust
#ActiveDefence
We value trust so highly, we've appointed a Chief Trust Officer.
Congratulations to Shanna Daly (
@fancy_4n6
). We look forward to seeing you grow this role. A Chief Trust Officer makes sure a business makes ethical decisions, acts with integrity & protects customer information.
2. Asking someone their "real name".
3. Approaching a speaker with hostility after they have done their talk.
- You may not agree with what they say and that's ok.
- You may not like their topic.
- You may not be interested in what they have to say.
That's all perfectly OK
2/4
I think one of the most wonderful people in infosec (in the world actually) is
@pink_tangent
and she recently put some suggestions to a conference organiser to instead stop asking other women to ask women to submit and maybe look internally. I will elaborate more:
1/9
But unless you have something constructive to say, then please keep it to yourself. Aggressively targetting speakers about their topic you don't agree with or don't like continues to create a barrier for people to want to get up and share their thoughts and research.
3/4
Today is my first day with
@cosiveco
for a bit of a change of direction for a while.
Was as great few years with
@ParaFlare_Cyber
and the reins of the DFIR team have been given over to
@4n6Bexaminer
to continue to grow and evolve the team and consulting practice.
Today has felt a little bit shit, i posted earlier today and deleted it. I am a little affected today by the data leaks happening here in Australia (not personally but emotionally).
Working on a ransomware case at the moment, super interesting and good to be able to get back into forensics and i did write my first little docker script to run log2timeilne, output to json, convert it to json log analytics likes and then i wrote a python script to load to azure
And quite honestly, if you as a conference organiser don't think its your responsibility, then don't count on me (or a lot of people) to attend or support.
If I want a sausage fest I'll go to the Munich Brauhaus.
9/9
Two exciting projects kicking off with my lawyer this week, one is a trademark application to ensure that fierce unicorn is mine, and two, which is far more exciting, a shareholder and partnership agreement as i will have someone joining me shortly!!!!
#cacciacyber
#GameOn
The man who gave me my first chance and job in infosec died today :( he was a lovely person and saw something in me to take a chance. Ill be forever grateful. RIP Simon 💔
🚨"it’s important to know that it was and never should be about ratio nor balance, but the need to dig deep and understand what is causing under represented communities not to submit"
Literally no one wants to be a token speaker chosen to meet a quota.
2/9
My career advisors office at High School. pretty sure "Digital forensics and incident response professional" was not on the list of occupations they advised for me.