I set up Netbox recently at work to try and improve the abysmal documentation situation. I use an Ansible playbook to provision and set up the server, then copy a docker compose file and start the containers. So far I’m loving Netbox, I just wish my predecessors had documented things from the start.

Namecheap + the dynamic DNS client in pfSense. No issues sinve I set it up years ago.

Before that it was a cron job that updated through the google domains api.

Stay suspicious. As a security guy, i’d way rather respond to 1,000 false positive reports than have an employee that doesn’t think about it and just clicks.

It is a great step but it’s rare to have enough buy in from upper managent to enforce any real consequences for repeat offenders. I’ve seen good initial results from this kind of phishing testing, but the repeat offenders never seem to change their habits and your click rate quickly plateaus.

Thanks! This is actually exactly what I have been basing my efforts on so far, it’s just sobering to look at how far away we are from completing implementation group 1.

I just started my first official cybersecurity position at a medium size company in an industry that is currently being heavily targeted with ransomware.

I’m starting pretty much from scratch as they have not had a dedicated security role in over a year and my predecessor didn’t make much progress. So far i’ve been focused on inventory lists, policies, and procedures for hardware, software, and data. I think we’re doing okay with minimizing stuff thats internet facing and patching is in a good place (well, at least with the devices and os’s that are still supported).

Any suggestions on where to go from there or what to prioritize?

I’m studying for CCSP right now. It’s fairly general and tries to be vendor neutral but Architecture is one of the knowledge domains on the exam. Might be worth it if you meet the work requirements or experience waiver requirements.

A lot of people also seem to conflate it with the CISSP when it comes up in conversation I’ve noticed.

As someone in the thick of it, it has been a nervewracking quarter for mortgage company IT and Infosec teams. There have been several very high profile breaches the last few months.

Oh MediaTracker looks nice, thanks!

Is this loss?

Do note though that for privacy purposes, a .us domain is not the best idea. You must be a U.S. citizen or business and registrars may try to verify your identity.

Really depends on your scale and needs, but when we were in the process of transitioning from Ivanti to Intune we had a gap between them. I set up a FOG project server and a couple remote nodes and that worked really well as an interim solution. I actually started using it at home even though I don’t really need imaging too often.

Can I ask why chocolatey and not just installed via policy/company portal? I’m not our Intune guy so I don’t know much about the limitations.

This is an interesting observation, not really something I have considered. The key difference here is that you are the one in control of those customizations. Whether the customizations are useful or harmful is entirely up to the user, Kagi just gives you the option.

For me at least, the majority of my searches I just want the correct answer to a question or a link to a specific resource I’m looking for. I don’t really use it as a content discovery engine. Being able to prioritize sites that I have found through experience to have reliable results and exclude sites that are uninformative or irritating is valuable.

It’ll stay low impact until suddenly one day having a reliable post-quantum encryption scheme becomes rather important…

Kagi! Worth every penny of the subscription. The emphasis on privacy is a big deal for me but the killer feature is the ability to customize results. I have sites I personally like/trust towards the top and have an ever growing blacklist of sites that don’t get shown at all. No more pinterest, spruce, or other seo spam sites!

Neat! Ever tried tryhackme? I’m curious how the modules on htb compare.

If you’re looking at paying for certs I personally would stick with ones from common organizations, like CompTIA, (ISC)^2, SANS, Cisco, etc. I think a lot of the value in the cert (at least for career purposes) comes from the name recognition and trust placed in the organization certifying you. A recruiter looks at a Sec+ credential and knows exactly what that entails, whereas a certification from a lesser known organization or community college doesn’t do much to tell them what you know or have studied.

I bought an OnlyKey a few months ago and love it.

Hey, I have a career question this week! I’ve been a sysadmin for the last 1.5 years (It’s a small shop so everything security related is currently my responsibility). I’ll soon be graduating with a BS in Cybersecurity & Information Assurance. I’m SSCP, CySA+, and PenTest+ certified. I want to end up in a penetration testing role. Once I graduate, should I start looking for pen testing gigs immediately or do you think I ought to get some experience directly in the security industry first? Would getting OSCP help my chances of moving directly to pen testing?