A (64:36)
Nope, nope, nope, nope, nope, nope. We are at 9:05. Just a couple minutes off, off, off schedule here, but let's do this. All right. Hala, hala, hala, hala. Guys, I hope you had a great show. I appreciate it. No first timers today. If you were a first timer, but you just didn't say it in chat. Welcome to the party, pal. Welcome to the party, pal. I appreciate you allowing me to Red Hulk out on mfa. It is a. It is a button for me. It's. It's a button for me. It's a button for me. Okay? I just. It just pisses me off. There's no reason to have MFA on some of these Internet facing things. Listen, a switch in your environment. Yeah. You don't need mfa. Right. The network admins can log into the switch and it's not a big deal. I'm not. I'm not ridiculous here. I'm Jerry from Simply Cyber. Don't go anywhere because we are going to be pivoting to Jawjacking, a 30 minute AMA show where you ask questions, we give answers. Thanks for being here. Episode 1041 until next time, stay secure. Ever wonder what it takes to break into cyber security? Join us every weekday for Jawjacking, where industry experts answer your burning questions about the cyber security field. Live, unfiltered and totally free. Let's level up together. It's time for some jawjacking. All right, what's up, everybody? Welcome to the party. I am your host, Jerry Guy, straight kicking it. And I got Pele here answering your questions. Maybe you're new here. Maybe you're coming. Oh, stop it, Zach Hill. It is not your first time. Listen, maybe you're coming from the Daily Cyber Threat Brief hosted by that nerd, Dr. Gerald Ozier, PhD. Please more like MFA freak. Am I right, guys? This is all about good times. Let me put the chiron on so we can remind people who just show up and are like, what's this guy doing? If you got questions, throw them in chat. I will answer them to the best of my ability. This is also annoying me, so I'm gonna fix this really quickly. On stream. You get to see how the sausage is made really quickly and let's do this. Cool. All right, so what are we doing here? You got questions, I got answers. Shamiria, this is. This is six, seven. This is. I don't know what this is. This is like I do this dance. I don't know. I don't know. How would you recommend pivoting from server admin to security? Austin asks the question, let's bring it up on stream. Hold on one second, hold on. I'm flagging questions here. Pivoting from server admin to security. Simple As a server admin, start focusing on a couple things. Number one, how about configuration? Go get a CIS baseline for whatever the server operating system is that you're responsible for and begin to configure it in a more secure, hardened way. Spoiler alert. You can't just apply all the CIS baselines or else the machine's not going to be functional. Do that also. Make sure that you're patching your things and doing that appropriately. Then if you can expand your scope maybe to your entire server IT infrastructure, you can begin to have standards. You can begin to document these things. You can begin to identify, have yourself identified and seen by leadership and other people on your team as the si, as the security person. Just start doing it. Okay, so configuration, Proper configuration. Run vulnerability scans to find misconfigurations. Use Shodan Monitor to see your Internet facing assets and see if there's problems there. Document things and then just start taking credit for it. Simple as that. Dude, you're actually in the best position to make that pivot. All right. Roswell says my beard's turning gray. Should I diet? I don't think so. Gray beards is a sign of experience. I don't know. I. I wouldn't. I mean, I'm just not big on, I guess. Vanity Gunslinger Punslinger says, how would you implement mfa as a potential interview question? Well, I mean, the first thing you have to ask if that's the question is where are you talking about implementing it? And then if you're talking about implementing it more like the general workforce, user accounts. Well, then it depends obviously on what. Here's My thing with any interview question, what I like to do is. This question is a fine question. How would you implement mfa? What you need to do is start to define this question. Listen, whoever asked you this question just made it up, right? So they aren't thinking through this whole work scenario. So then you have to say, and again, that's what I like to do. Okay, yeah, I'd love to help you implement mfa, but I need to understand more. What, what, where are we implementing it? Where would you like to implement it? Oh, we want to just implement it on our workforce, right? Like our emails and access to cloud systems. Okay, okay. What kind of environment are we? Are we in Azure? Are we on prem only? Are we Azure Active Directory Hybrid? Like, I need to understand more because I could just give you an MFA solution, but it may not be the best solution. It may be cost prohibitive. It may conflict with controls that we've already implemented in the environment. So let me understand and appreciate that. But if I'm just going to answer it generically, let's assume that you have an Azure environment. What I would definitely do is take advantage of the Multi Factor Authentication solution that comes native to Entra ID or Azure Active Directory and roll that out using the Microsoft Authenticator app. This is going to make sure that your workforce, or basically your budget doesn't have to pay for additional tokens, hardware tokens or whatever in order to roll this out. Now, another thing, with any type of question, normally your answer is going to address 80% of the problem. You make sure that you call out that 20% fringe stuff, right? Like, because it's going to show your level of knowledge and depth. Right? So how would you implement mfa? All right, we're going to do Microsoft Authenticator all over the place. Your email, we're going to do single sign on federated authentication to cloud systems, etc. But I want to call out really quick. We will have to earmark and make sure that we have budget for hardware tokens because there will be some population of the workforce that refuses to install the Microsoft Authenticator app on their devices. Is that, is that going to be a problem here? Are we going to make a policy that says you install the MFA Authenticator app on your own phone or you're fired? Are we going to issue phones to individuals? Are we going to buy hardware tokens to address that population that refuses to install an app on their own personal device? Let me get a better understanding. And by that point they're like, all right, bro, you get it. Let's go to the next question. Okay, so hopefully that helps you also. Since you asked the question, I feel like this is a good time to point it out. Talking about interviews, this video is like low key blowing up for me, which I'm super pumped about. The remaining, you know. All right, so right here, this is. This is Shamira Gonzalez. This is the individual that, the community member, the practitioner who's getting that senior technical program director interview in a few minutes. Here, this video right here, you could see I'm interviewing. Excuse. I. I'm interviewing her, basically. Can I get a share link, please? Jesus. I'm interviewing her in this video. Here, check this out. GRC interview. Here's my thing, guys. Here's my thing. Foreign. Nobody ever gets feedback on a job interview. Did you ace it? Did you sync it? Did you crush it? Did you fail? You like, hey, can I get some feedback? And it's just crickets or you just get ghosted. That is bull crap. And that's a problem that I wanted to fix. So this video series, I've made several videos. They're going to be released weekly. Okay, this video series, I ask one question, this question right here. Your organization's identified 50 high risk findings from a recent assessment. You have budget to fix 15. What's your approach to doing this? Now Shamiri is looking to break in. Jesse Johnson has been doing it for two, three years. We got his answer. And then Erica McDuffie gives her answer and she's like a senior, like 10, 12 years. Each of their responses are great. And you could see here, I pause during their responses and I give just in time, real time constructive feedback on their responses. I've gotten a lot of great feedback from people about this video and how helpful it is in destroying job interviews. So if you got your resume tight and you're getting interviews, but you're not getting job offers, this video is designed to help you. All right, let's keep cooking here. Hold on. All right, I'm looking at questions. Good to see you, ab. All right, you got to put a Q in front of it if you want me to answer it. With all recent tech layoffs, what's a good strategy for re entering the cyber industry with all the competition? Hey, if it was me, if it was my son coming home from College, I think GRC work around CMMC in the United States and basically 800171 readiness assessments is going to be huge. The government defense industrial base is requiring businesses to be CMMC quasi 800171 compliant, which means they're going to have to do readiness assessments and get stood up. That means GRC professionals are going to have to help them. That's going to be a huge cottage industry. So that's what I would tell them. Again, I know acronyms flew through that answer. C. Charlie, Michael, Michael, Charlie. Go look it up. NIST 800171 go look it up. I'm telling you I've already seen a bunch of work coming out for career questions shares a response to the question about server admin to Cyber Zach says if you're an admin position, start pivoting small tasks to lean into security. Okay, cool. That actually sounds similar to what I said, which is great. What do you think is possible control to put in place? Please put a Q in front of your question. So I know I just saw this one. What do you think's possible control to put in place regarding insider threat? We have RBAC and least PRIV in use looking towards things that may be put in place around behavior. Behavior changes. Okay so so okay so if you can, I mean conditional access, I guess you say rbac which is role based access control. You can go further granular with conditional access just because I work in engineering and I have access to the blueprints. Maybe I shouldn't be accessing those blueprints between the hours of midnight and 6am Maybe I shouldn't be accessing those blueprints from Cambodia. That's a little bit less of an insider threat. There are tools in place natural Dave, that can show you large data moves, right? So like if John in engineering typically does typically like moves this amount amount of data like you know, whatever 10 gigs a day, right? He's moving blueprints back and forth and then you detect that his user account is moving a hundred gigs. That could be an X fill, right? Also you want to if you can see where if they're moving things from like to to sites that don't normally make sense like Dropbox Box, Google Drive, stuff like that. Things that are outside your normal operations. You would have to use detection engineering in order to implement this, right? So get with a detection engineer you'd have to have a SIM because you're basically going to have to start looking at network telemetry and logs to be able to detect the anomalous behavior. Okay, hopefully that helps. And this is a great question. If anyone's got another answer to this, drop it in chat. Let's go. Onyeka says what's your recommendation for switching from software testing to cyber I mean, this is kind of similar to the server admin as you're doing software testing. You know, don't just text test for. Here's what I would do. I wouldn't just test for functionality. I would start testing for like OWASP top 10 or using you know, Burp Suite or whatever to check for like normal software flaws. Look at your dev, you know, if it's less of a SaaS app and more of a FAT app, go look at your DevOps pipeline, look at the controls around those and then start documenting them. Start, basically start helping. By the way, I just got to let everybody know, when you do something like this, whether it's a software engineer or a server admin you're doing, you will be doing extra work. Okay? So don't think that like you're going to just like continue to do what you do and not take on. You're doing extra work, but you're investing in yourself. Okay? So what I would do is start looking at the security elements of your job DevOps pipeline, having good environments, right? Like dev test prod, making sure that you have good practices around those. Security testing for input validation, user authentication, cross site scripting, looking at code repositories and the access to that. Is everyone that has access to GitHub supposed to have it? Do you have MFA? Right? There's a whole bunch of different things you can look at from a software, an application security perspective from the code base, right? Think about the whole stack, right? The like the OSI stack, you could be looking at the code base and looking at the functionality of the application itself and security there you could be looking at the network layer. Does it make sense from a network perspective? Can people touch it when they're not supposed to? The code base. The actual FAT app is an Internet facing. Is the server underneath running services? It shouldn't be. That could lead to attack and compromise. Do you have a good deployment of app server in the DMZ and then database server in the back end, right? Are you doing load balancing to prevent denial of service or you know, overburdening the server itself? Then look at the physical layer who can physically go touch the physical servers. Is it cloud based? Is it on prem? Does your data center have good controls? And all you got to do is frame it within the context of protecting the software of the system and you can go buck wild in any direction you want. All right, I'm gonna do a Ric Flair for that one. All right, continuing. If you have a question, put a Q in chat. I Hope guys, I hope for sure you're getting value from this stream. I literally do this deliberately to deliver value to you. I cannot help people one on one. It's just I don't have time for sucks to say that, but it's the reality. So what I like to do is this. I call it mentoring at scale. The Realist 2001 says in a cyber PM role, which is a program manager, project manager with a SOC background, which is security operations center, which is like a defender for five years, looking to pivot into threat hunting to be more hands on. Any suggestions if I should go this path and if which steps, course certs etc? So as far as I know, I mean if you have a SOC background, you are in a good position to be able to go into threat hunting. Just so everybody's on the same page. SOC analyst or working in a SOC is looking at network telemetry, looking at application server logs to detect anomalous behavior and then go investigate it. Is it a bad problem? Is it a, is it a false positive? Do you call your end user? Do you reimage machines? Do you smash the oh crap, everything's gone to crap button? That's what a sock does. Okay, Thread hunting is going into the environment and looking for bad that you don't have detections for. Right? Remember like the best way to explain threat hunting is say you have your house, right? Everybody lives somewhere, apartment, a house, a double wide, whatever, it doesn't matter. Wherever you live, you let's just pretend you put an alarm on your front door. So someone opens your front door, it goes beep beep or you get a notification on your phone, whatever, your ring doorbell goes off. Okay? That is a detection. And if you're at work and someone enters your house through the front door and it goes off, you have a detection. You can now respond to it. Maybe it's a false positive. Maybe Amazon's dropping a package off and it went off. Maybe a burglar broke into your house and that's a true positive. Fine, but let's pretend for a second that you don't have any alerts or detections on your windows and a burglar busts through your window off the fire escape threat hunting and is going into your environment and going around and looking to see if there's someone in your environment to go look at the window and see if there's something weird with it. Okay, so just, just so we're clarifying and defining what these things are for people who don't know. Now as far as threat hunting goes, as far as I know, there are no certs for it for courses I do know. And Dan Reardon, correct me if I'm wrong, KC7 has pretty good training. Like hands on practical training. I know. Let's Defend has training. I know Hack the Box has that CDSA path which is pretty good. More around soc. If anything, I think a lot of homegrown training would be perfect for me. Realist2001 My first thought if I was trying to do what you're doing is I would go, I would set up a lab, right? Then I would get red canaries, atomic red team. I would not set up any alerts. And then I would fire off some, you know, atomic attacks. Then I would go use threat hunting to go find where those attacks appear. And then a part of threat hunting also is like being able to tell a detection engineer or write a detection. You would be so much more valuable as a candidate if you can both do threat hunting and develop the detection to detect the threat that you hunted and discovered. So that's what I would do. Akil George says threat intel is good. Yeah, that's another great thing. I mean going to Matrix Miter attack framework and looking at the ttps of different threat actors and going hunting for those that you're probably not going to find them in your lab environment. But that's a great way to do it. Especially since you're in a PM role. You're not necessarily going to have access to systems and go poke around in them. So you will need a home lab. That's what I would suggest. And by the way, everybody in chat who also answers the questions that are on stream, thank you, I appreciate it. Guys. I don't know everything, right? I literally. I know what I know and I know a lot. And I know, I know I. I know I don't know also a lot. Okay, this is getting comfortable with imposter syndrome. So any answers people provide is definitely appreciated to help the person asking them. I'm continuing to scroll Chat natural. Dave says what do you think is possible control to put in place regarding. Oh, you already asked that. Tony. Jack, CMMC is so hot that Hansel's so hot right now. Thank you. All right. Canary tokens are awesome. Rhett Retto Rhett Original film says I work for a small cyber company. I'm now doing four different jobs I didn't sign up for. Yeah, yeah. Welcome to IT and cyber. Okay, so I would. Here's the thing. You're definitely valuable to your company. Your boss knows It. I would ask for. I would ask for a raise for sure. At a minimum, I would ask. I would try it, right? So it depends what you make. Here's the deal. If you're gonna go for raise, you absolutely must have objective facts to bring. And don't just spring it like, say you have a weekly meeting with your boss. You can't be like, all right, yeah. And that's what I worked on this week, by the way. I want to raise. Like, I. I would recommend. Again, this is just my strategy. If anyone else in chat has an idea, let me know. Small company. I get it. Maybe this is a little overshot for a small company, but what I like to do is document. Hey, listen, here's my job, right? But I want to point out that I also do this, which is this job, and this, which is this job, and this, which is this job. And I'm fine doing it. I'm great at it. Thank you for the opportunity. You have to make it a crap sandwich, by the way. Okay? If you don't know what a crap sandwich is, a crap sandwich is compliment. Crap, compliment. The crap is where you're asking for a race, okay? You're basically sell. You're. You're doing sales right now. Okay? So anyways, hey, like, here's. Here's. I'd love to have a meeting with you. I'd like to discuss my current role. That's what, like, make a separate meeting for. I'd like to just. I'd like to discuss my current role and get a better understanding of it and make sure. Make sure you're. You're making it about them. I want to discuss my current role, and I want to make sure that I'm delivering value to you and the company. Simple. Okay? Then you get in there and you say, hey, here's what I'm doing. Here's what I'm doing. Here's what I'm doing. Here's what I'm doing. Now, I know my job is just this job up here, and I'm really grateful for the opportunity to do these. All these other jobs, but I got to tell you, I don't feel my compensation maps to the work that I'm doing. So what I would like to ask for is I. I would like to. I would like to ask you for a 10 raise. And I feel that this does align with the work I'm doing right now. If they say, oh, hey, we just don't have the money, don't take anything personal. Hey, like, at a minimum, ask them if they can go ask about it, if you have a good manager, they'll go ask. Okay? If you have a crap manager, they won't. If it's a small business, the person, if the person who's like owns the business is the one you're talking to, they know damn well whether they can do this or not. So just say, hey, listen, I really believe, you know, I, I be confident. Okay, I'm not being confident when what I'm doing right now. But just say, hey, here's all I'm doing. My current salary is this. I would, I want to request a 10 pay raise just for all this work I'm doing. I find, I believe it's reasonable and fair. What do you think? Now here's an important part of any sales. When you say, what do you think? Or what are your thoughts on this? Do not speak again until they speak. Do not speak again. You will absolutely torpedo yourself if you speak again. Let, even if it's an awkward silence, let that baby cook. Okay, what do you think? Now they're either going to say, sure, let me look into it.
