3 ms·

> Nope. Why do you need to read an email well if you are a coding ninja Q: What happens if the coding ninja misreads an email and codes up the wrong thing? >

> Nope. Why do you need to read an email well if you are a coding ninja Q: What happens if the coding ninja misreads an email and codes up the wrong thing? > and why do you need to program for incident response or forensics (scripting powershell/python helps a lot though). Scripting is* programming. > A lot of people think in terms of finishing projects or meeting metrics which they would not be if they were thinking like attackers Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker.

_8j50 5y ago
> Q: What happens if the coding ninja misreads an email and codes up the wrong thing Who codes based on email requests? Either way, yeah being able to read and understand technical requirements is required. But you can't compare that to say people replying back and forth to get you access to a system, to get them to remediate a vuln,etc... much less technical material that can't be skimmed and isn't organized. > Scripting is* programming. Of course it is. I didn't say otherwise. Scripting helps but is not a requirement. Even if it was, you don't need to know how to code properly, just enough to wrangle data a bit. Excel is much more useful than python. > Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker. I mean things like KPI and SLA. how is that thinking like an attacker? You are not thinking about anything attackers are interested in. A good example would me gaming the system by "remediating" incidents within X period of time. If your objective is that metric then inevitably you will sacrifice dedicating adequate time consuming analysis and remediation tasks to meet that metric. Just block the domain and reinstall windows. If anything was there it is wiped. Except if you looked deeper they rotate domains and the malware spreads to USB (infects again when they plug it in after your remediation).
- webmaven 5y ago
  > Who codes based on email requests? Trust me, it's a thing in many orgs. In fact, centering developer discussion on an asynchronous email mailing list (or more functionally but rarely, an internal NNTP server) used to be a preferred practice. > how is that thinking like an attacker? You are not thinking about anything attackers are interested in. I think you're using a rather narrow definition of 'attacker'. It isn't too rare to encounter adversarial attitudes within and between groups in an org. Sabotage per-se is less common, but does exist. At a most basic level, your KPIs look better if someone else's are worse.

_8j50 5y ago

> Q: What happens if the coding ninja misreads an email and codes up the wrong thing Who codes based on email requests? Either way, yeah being able to read and understand technical requirements is required. But you can't compare that to say people replying back and forth to get you access to a system, to get them to remediate a vuln,etc... much less technical material that can't be skimmed and isn't organized. > Scripting is* programming. Of course it is. I didn't say otherwise. Scripting helps but is not a requirement. Even if it was, you don't need to know how to code properly, just enough to wrangle data a bit. Excel is much more useful than python. > Arguably, if you at least recognize that your behavior is metric driven (ie. "How can I game the system?"), you are thinking like an attacker. I mean things like KPI and SLA. how is that thinking like an attacker? You are not thinking about anything attackers are interested in. A good example would me gaming the system by "remediating" incidents within X period of time. If your objective is that metric then inevitably you will sacrifice dedicating adequate time consuming analysis and remediation tasks to meet that metric. Just block the domain and reinstall windows. If anything was there it is wiped. Except if you looked deeper they rotate domains and the malware spreads to USB (infects again when they plug it in after your remediation).

webmaven 5y ago
> Who codes based on email requests? Trust me, it's a thing in many orgs. In fact, centering developer discussion on an asynchronous email mailing list (or more functionally but rarely, an internal NNTP server) used to be a preferred practice. > how is that thinking like an attacker? You are not thinking about anything attackers are interested in. I think you're using a rather narrow definition of 'attacker'. It isn't too rare to encounter adversarial attitudes within and between groups in an org. Sabotage per-se is less common, but does exist. At a most basic level, your KPIs look better if someone else's are worse.