Company: “Our data is encrypted at rest, and in transit. We are SOC2 assessed and HIPAA compliant. Our Cyber team conducts quarterly audits, our Security Ops are 24/7, and our employees go through quarterly security training.”
That one developer about to run a wild query exporting all data to a CSV file: “Hold my beer!”
Invest in Data Access Controls
Does your establishment handle sensitive communication on daily basis? Are you looking for a secure, no compromise, zero trust, SaaS collaboration suite? Check out wickr; an AWS company.
Remember the days when server up-time was how we measured service availability and bragged about it? This Pi-hole DNS server running on a Debian-loaded mini PC at my home office, is now at 177 days since last reboot, yet is fully patched and running latest version of Pi-hole DNS. Maybe it’s because there are no windows near this mini PC 😏
About 12 years ago, we used a piece of software called Hudson to automate various tasks that were otherwise run by hand. Things like running backup jobs, initiating web server warm-ups, checking on stale DNS records, sending emails reports, executing shell scripts on remote servers, updating firewall rules during peak times of day (think home brew auto-scaling logic), and later on, integrating with Git repositories, and deploying code and config to servers in data-centers.
On a side note, did you know Jenkins used to be called Hudson? It has been around since 2005, and deploying code from Git is only one of the many many things it is otherwise used for by professionals.
Always think outside the box…
The deal with security compliance assessments and certifications is not just about that annual or bi-annual point in time, during which auditors certify your establishment as compliant. It’s about whether your organization and all of its individuals follow security guidelines and best practices as outlined in the assessment during their day-to-day operations.
Remember: Once auditors issue a compliance certificate and leave your office, from that point forward, your security is as good as your staff’s training, and discipline to follow security controls.
This is an everyday thing; not once or twice a year thing!
Going through modern Security+ material, seeing mentions of legacy technologies and methodologies such as Sub7 or War-driving was a pleasant time travel 🙂
If you’re attending a hackathon/security conference looking to recruit good security professionals, keep an eye for those using personal Internet devices, tethering via cell phone, or better yet, tethering via a cable connection to their cell phone to gain internet access.
As to those who are using the convention center’s free wifi during a hackathon/security event, maybe enroll them in some good security training programs first, if you really want to hire them.
I understand this topic is a matter of personal preference, but I have to say; having had exposure to both platforms, I’ll take Slack over Teams as a collaboration platform any day…
Feels like it was just yesterday when…
We transformed how a full-house inventory exercises were performed across warehouses, for an international book and magazine distribution business.
The solution we introduced included handheld PDAs running Windows CE, with bar-code scanning attachments, hooked up to a custom designed broad WiFi “mesh” network (before modern mesh WiFi became a thing you can buy), backed by a LAMP server hosting the inventory web front-end and database.
This setup was a game changer to the inventory team, as it reduced the amount of time it took to complete their yearly exercise from a multi-week effort to just a few days.
Bear in mind this was before the age of cloud computing, smart phones, 4G/5G networks, lightweight laptops and tablets.
To me, the level of excitement, the dropped jaws on the faces of all team members, senior management, and executive stakeholders, was the payoff to the work we did. It was quite the fun project to be a part of.
This was back in 2003. How time flies by…
