waihtis

60 ms·

781.
by waihtis 6y ago
If we're looking at how to do detection right in IT systems, the physical world example you give doesn't really apply all that well. First the environment is different and second threat detection in IT infra is a multi-stage proce
782.
by waihtis 6y ago
Youre suggesting detection is only possible much after the fact, when it is possible to also do before an adversary has been able to achieve anything significant on the target. But credit where credit is due, detection is not the answer but
783.
by waihtis 6y ago
How to defend against these: 1) detection 2) detection 3) detection 4) sprinklers 5) detection 6) detection unfortunately, most orgs outsource their internal detection or have no capability at all.
784.
by waihtis 6y ago
Hilarious. While I was observing this I also noticed > Weather.com - an IBM business felt like it explained this design pattern perfectly
785.
by waihtis 6y ago
Mobile issues when you don't want the reddit app: 1) no "this subreddit is only available via the app" walls 2) subreddit search functionality that doesn't require jumping through hoops to execute 3) no comment reading l
786.
by waihtis 6y ago
What do the bad actors technically do? Map your api endpoints and spam them with traffic? Something else also?
787.
by waihtis 6y ago
I’m a 100% with you, but this is unfortunately not how people in many companies operate. The fact that organizations like Gartner and any one of the Big 4 exist proves that people are very much in the habit of transferring their decision-ma
788.
by waihtis 6y ago
It is near impossible for Facebook to successfully brand themselves as pro-privacy at this point. When their privacy breaches have been in the mainstream news for years now, the true Facebook business model is just too deeply embedded into
789.
by waihtis 6y ago
It's a very powerful concept, since it teaches you to become very comfortable with starting things. I often employ it in work too, picking one of the most minor thing I have on the to-do while having morning coffee and three hours late
790.
by waihtis 6y ago
I had great success picking up a consistent meditation habit with the greasing the groove-approach[1].. in essence, every time I would feel a bit foggy in the head, I would take a 3-15 minute meditation session. It usually results to 3-5 se
791.
by waihtis 6y ago
I don't know how many people are partaking in this ballot, but even with a small number of people it's much less economically feasible to individually travel to and pressure people at their homes versus having a set number of plac
792.
by waihtis 6y ago
This doesn't make sense. If anything, it would seem likely mail-in voting has less chance of applying pressure into the individual voter. You can cast your vote without having to physically face another human. On another note, what a l
793.
by waihtis 6y ago
How do you know the parent and you have equal views on what makes a ”good life”?
794.
by waihtis 6y ago
Dont say it like it’s a bad thing. We have limited time here, why not make the most out of it?
795.
by waihtis 6y ago
The core question which should always be asked: when defining or setting a goal, what kind of incentives are you simultaneously creating?
796.
by waihtis 6y ago
I think people on both sides of the border need to acknowledge the limited value of news; not only will it give you a severely distorted lens of reality, but more importantly it is borderline ignoramus behaviour to base your reality of some
797.
by waihtis 6y ago
You're not being cynical, this is exactly what one should expect in HN - combing through the deeper facts and not just the superficial information.
798.
by waihtis 6y ago
About 10 years ago OSCP was considered difficult, or at least definitely not part of the beginner roadmap. Apparently this has changed?
799.
by waihtis 6y ago
Just a select few usually, from within the security team. of course this applies for boilerplate big company deployment. I could see use cases where you would involve others like IT or dev in the deception process..
800.
by waihtis 6y ago
Would you be open to a friendly chat on how we could possibly improve on this? As a small company, it's fair to say the big financials have evaded us so far - however, it doesn't mean it would be highly useful to understand how th
801.
by waihtis 6y ago
I get a feeling this could be the next Solarwinds..
802.
by waihtis 6y ago
We haven't so far.. Mitre SHIELD (shield.mitre.org) lays out the different types of capabilities there are in this domain but doesn't have a lot of practical how-to advice which is what I think you're more after. If you think
803.
by waihtis 6y ago
Seems there's a bit of love going around for deception lately, always good to see some implementation stories going mainstream.
804.
by waihtis 6y ago
Actually in this scenario an alliance server may be a poor asset to replicate specifically because of what you stated - if the attacker is watching the traffic it's easy to spot. The more powerful place would be to be interferring with
805.
by waihtis 6y ago
To be frank I haven't heard of such scenarios from any direct sources. If you're thinking ransomware here then it's usually fairly automated and takes a shotgun approach for propagation, and trying to extend your breach to al
806.
by waihtis 6y ago
Canaries has been pretty much replaced by decoys as the "official" term, as denoted by the MITRE SHIELD framework: https://shield.mitre.org/matrix/
807.
by waihtis 6y ago
> I'm wondering, given how threat actors normally behave when intruding into networks, do you also have honey user credentials in the network? Yes, for some types of honeypots credentials can be useful. Although it bears to keep in
808.
by waihtis 6y ago
Both are viable. It depends a bit on industry; pharma companies, say, are quite concerned about internal threats whereas financial and retail are more likely targets of external actors. You do need to consider the type of honeypot used - as
809.
by waihtis 6y ago
I run a honeypot software company, with our customers being mid-large enterprises. While the case presented here is certainly interesting, it's actually fairly uncommon for companies to run internet-facing honeypots, mostly due to it b
810.
by waihtis 6y ago
That’s where you get into interesting territory. It’s not a wild suggestion, is it?

More ›