Charlie Snyder

I keep hearing some people in my industry say Cloud Costs never change and it isn't great for the On-Prem folks. Let me be first to tell you that is WRONG. Cloud Computing is not a SET-IT-AND-FORGET-IT... you need to maintain it just like your on-prem investment... but in this case... maintain and monitor your costs and adjust accordingly. Whether you are auto-scaling, turning off Cloud Infrastructure when not in use, controlling where storage is saved (Hot/Cold/Geo-Redundant/Local-Redundant) etc. You can keep your Cloud investment in your favor just by using the tools provided to you to build and shape your Cloud Infrastructure properly. There are of course new things to "maintain" and that is the changes the providers might have to keep things constantly updated and secure. So your change management processes might need adjusting to handle the sometimes rapid changes that can occur in the cloud. But the adjustment is an easy one once you learn the update cycles for all the providers. #cloud #cloudcomputing #cloudVSonprem #MoveToTheCloud

1

Part 2 of "What's in the bag?" Behind the scenes at vBrownBag.com is now live! This post covers the revised automator function that's being written in PowerShell and run on AWS Lambda. https://lnkd.in/gWQDTufJ

7

1 Comment

What if that surly employee is in the C-suite? 🤔💼 Imagine a scenario where a disgruntled executive deletes critical fleetd files from their device. 😱 It sounds alarming, but with the right strategies, it's a challenge you can manage effectively. In my latest sysadmin diary installment, I explore how we can restore fleetd files quickly. 🛠️ From resending configuration profiles using MDM to the nuclear option of sending an EACS remote wipe command ☢️, learn how best to restore host communications with Fleet Device Management. 🔄 Keep your fleet secure and compliant, no matter who tries to throw a wrench in the works. 🚀

17

1 Comment

Seeing Kernel exploits added to the CISA KEV is interesting because a lot of the time we see more web-based stuff... this one is important though: https://lnkd.in/gZTuJ5Bs. What's also interesting is the latest EPSS scores still show this scoring very low, despite evidence of active exploitation. Definitely worth a look. #cybersecurity. #KEV #vulnerability

18

this is so cursed wtf, i had no idea localStorage and sessionStorage were a map and that these were equivalent. i feel like this api is too recent for this to be excusable? this makes implementing the Storage interface a pain in the ass, basically requiring a Proxy.

16

2 Comments

Since I'm so down on CNAPP, people might assume I'm anti-platform. I'm actually pro-platform, but "cloud security" as the platform never made sense. Instead, there should be one scanning solution that gives findings to devs as far left as possible, and one runtime solution that protects runtime cloud infrastructure from attacks. Some examples are below. CNAPP is the worst of both worlds - it's scanning configuration when it's too late, sending those alerts to the wrong teams, and wrapping runtime in as an afterthought. Here are some example "platform" vendor pairings I think make a lot more sense than buying a CNAPP. For clarity, when I say ASPM I include being able to scan and when I say CDR I include a Kubernetes agent at the heart of that: 1. OX Security + Sweet Security (ASPM + CDR) 2. Cycode | Complete ASPM + RAD Security (ASPM + CDR) 3. Xygeni + Upwind Security (ASPM + CDR) 4. Aikido Security + ARMO (ASPM + CDR) 5. Jit.io + Sysdig (ASPM + CDR) 6. Arnica + Aqua Security (ASPM + CDR) 7. Backslash Security + Wiz (uniquely complementary overlap) With any of these combination of solutions, you're pretty well set with simple complementary tooling to "shift left" and "shield right"

175

56 Comments

So heartwarming to see exciting mentions of Action1 teeming in almost every Reddit discussion about #patchmanagement. Here is just of of many examples: "[Action1] support is some of the best I've dealt with" "Action1 development team are very much committed to their roadmap and building the product out based on user feedback which is great" "[Action1] has been great, especially great at patching" https://lnkd.in/gz9EaiG7

14

1 Comment

I run my own internal Certificate Authority, to make building servers internally cheaper, and easier. Below is a script I put together that does virtually everything I need SSL related in the terminal. I just happened to be deploying something and I wanted to unify some of my workflow, and this is the output. Maybe It's something you need too, or just want to play around with certificates and signing? I know its a bit confusing at first with the nested relationships. A CA is a certificate that ISSUES other certificates. It's the thing at the bottom of the list of things that says.. everything signed by me is trusted. When doing your own hosting. Having your own CA can save you a metric ton of cash. The rules are simple. You can make and sign as many certificates as you like for free, but they are only trusted if the person/device visiting the endpoints has your CA cert installed. For myself, I install my CA Bundle on all my machines, and viola.. no problem. External endpoints I just pay for certs/wildcard certs. This script will setup a CA ROOT cert and an intermediate CERT for a given domain. It will also create a Certificate signing request for a SSL cert and then Sign it with the Intermediate CA. Generally it helps with setup creation, and deployment of SSL CA/s and Certs. Yes this could have been ansible... or.. I can avoid all that and just make a single script that works.. Lets not over complicate things bro. Below is the script menu, to give you an idea of what it does. SSL Certificate Management Menu: 1. List Certificate Authorities 2. Deploy CA to Remote Server 3. Install CA on Remote Server 4. Install CA locally/Update CA Trust 5. Create SSL Certificate 6. Deploy SSL Certificate to Server 7. Copy Public key to Remote Server 8. Create CA and Intermediate CA 9. Create and deploy a java keystore for existing certificate As always, everything I do is opensource. I welcome feedback and collaboration. Repo: https://lnkd.in/ea3YSfkw #bash, #ssl, #certificateauthority, #ca,#csr, #homelab

23

Did you know that 66% of the leaked secrets from developer code repos come from 𝙥𝙚𝙧𝙨𝙤𝙣𝙖𝙡 accounts? Yeah, me either, and these are accounts that security tools aren't checking, and that's a problem! These are happening for one of two reasons: - accidental, (wrong account was used) - intentional, (developer keeps a copy for personal use) But which one doesn't matter! The fact is that it 𝘸𝘪𝘭𝘭 happen! Which means secrets need to be handled differently. - no more hardcoding them - no more keeping them in a separate file or folder - no more depending on a time-based refresh Just like everyone needs password managers, everyone with their own code needs a management tool for secrets. (And yes, some password manager vendors like Keeper Security, Inc., 1Password, Bitwarden etc do have that functionality available as well.) Your dev team may be awesome, but they're also human... #CIO #CTO #cybersecurity #SMB

4

🚀 Excited to share that I've decided to sort of "opensource" a collection of Gitlab (V4) APIs I’ve created for GitLab enthusiasts and API testers! The ones I could find on internet were either: - on a V3 schema; - containing just a few endpoints; - focused on one category (example: only on Group APIs); - or simply not well organized, not supporting a dynamic allocation of domain and access_token; It's a compilation of endpoints, mainly around CRUD http verbs, that can be tested via Postman. It includes a wide range of API groups and I'll restate this - is organized for a dynamic / seamless switching between Sandbox and Production environments with just two clicks, populating the other domain and access key everywhere. Perfect for DevOps engineers, developers, QA testers, and anyone working with GitLab APIs who needs reliable testing. If you want to visualize what you'll get, check out the "map" of API schemas I've provided in the Readme file here: https://lnkd.in/eE-giuZS Feel free to import it and extend over it, if you feel you need other endpoints included! I’d love to hear your thoughts and how it can further improve your workflow! 📥 Let’s simplify GitLab API testing together! 💡 #GitLab #API #Postman #DeveloperTools

2

I just realized I haven't posted a Linux tip in quite a while, so here's one that's a bit more advanced than my other ones. CAUTION this is pretty nerdy: The [mapfile] command is a seldom used builtin BASH command that is more often used in scripts than directly in the terminal emulator itself. What it can do: It allows you to create a new array variable from standard input (stdin) with each entry terminated by a delimiter of your choosing (or newline [NUL] by default.) Did I lose you? It's OK, let's just keep going. Let's say you have a file called "names.txt" with the following three lines in it: Adam Paul Robert Let's create an array variable called "people" using each line from the names.txt file: mapfile people < names.txt Here we have created an array with three entries. Each entry is given its own number in ascending order starting from zero. So 0 is "Adam", 1 is "Paul" and 2 is "Robert". Understand? Zero is a number too. So what can we do with this? We can call any given line from the array and use it however we like. Let's simply echo the first entry from the variable to display it on stdout: # echo ${people[0]} Adam We can also display all of the entries at once by using the @ symbol rather than a specific array assignment: # echo ${people[@]} Adam Paul Robert Now, if you're an advanced BASH user you might be asking why not just use a "read loop". Sure, that would be a more portable option but creating an array in this fashion is much faster. Final thought: You don't have to use a file to create an array with mapfile. You may use anything from stdin with any delimiter you like. Use your imagination. Now tell me what this one does and you win the internet for today: mapfile -t parts < <(lsblk | grep part) #linux #nerdystuff #programming #scripting #BASHscript

7

2 Comments

Well, day one of the deploy in public challenge and I've already run into my first issue. For some reason I'm not able to SSH from my bastion host to the EC2 instance on my private subnet. I created both EC2 instances with the same key pair and configured an identity in powershell to point to the private key. I've configured the security group of the private EC2 instance to allow incoming SSH connections from the bastion host security group. I am then able to SSH into my bastion host with the -A option for agent forwarding. However, when I try to SSH from the bastion host to the private EC2 instance I get a permission denied error. Has anyone else run into this issue or know what I'm forgetting? #codingwithcallie #aws #learninpublic

2

11 Comments

Having taken a few HackTheBox courses and running a few challenges, I've come to realize just how much Powershell I've forgotten since I last used it. I once heard someone say "Two weeks without coding and I've forgotten 30 years experience." This sent me down a rabbit hole of looking through my old notes and comparing it against some more modern tips and tricks for Powershell Pentesting. As someone that's more at-home at a bash shell, powershell is definitely one of those things you just have to use often to really become accustomed to it. For that reason I wrote a little how-to for myself to recall some of the typical tricks I'd need for pentesting a Windows server. Hopefully you all can get some usage out of it too! I know I'll be referring back to (and most likely updating) this often.

75

5 Comments

Predictably, Caleb H. Mattingly, CISSP's post on #cybersecurity #gatekeeping is getting a lot of attention. I think that a lot of folks guard so jealously the #CISO role based on the effort it takes to get to a truly thankless position which is subject to all of the vulnerabilities of the executive suite with none of the spoils that threats to that status are offensive. Pick a thing we've heard over the years. ➡ You can't be a CISO if you don't have the right certifications ➡ You can't be a CISO if you don't have the right degrees ➡ You can't be a CISO if you didn't come up through the #informationtechnology ranks ➡ You can't be a CISO if you've never been a CISO before (yeah; let that marinate a moment. Caleb calls out this absurdist notion in his thread). This 'battle' has apparently stagnated to the extent that the #InfoSec community has now targeted the #consulting community. You can't be a consulting CISO or fractional #cybersecurity leader if: ❌ You don't have the right certifications ❌ You don't have the right degrees ❌ You don't consult on All Things Technology ...And of course: ❌ You've never been a CISO in enterprise I'm not here to debate the value in leaders in this space understanding the technologies involved. I'm also not here to engage the insourcing vs. outsourcing debate. I *am* going to put a flag in the ground here by saying that #business leaders are looking for the CISO role to understand *their* language. Consultants bring a unique perspective to the conversation having had the pleasure and honor of working directly with clients in multiple industries, of multiple shapes and size, and with varying priorities. They didn't come up through the ranks of a singular organization - they came up through the ranks of many. ...Unless, of course, you're dealing with someone new to the organization entirely who's wearing a title they haven't quite earned, but let's be honest with ourselves: that's by no means unique to the fractional/virtual CISO role. I've met more than a handful of 'technology experts' who were pushing cellphone cases at a mall kiosk ten days prior. If you could name three things you wish your CISO knew in five words or less, what would that be?

7

5 Comments

Fake Chrome errors known as ClickFix are used to trick victims into running a malicious powershell script as a "fix". This "fix" does some "checks" displays a "Google Chrome warning stating a problem displaying the webpage." The victim is instructed  to install a "root certificate" by copying a PowerShell script into the Windows Clipboard and running it as Admin in a Windows PowerShell console which installs DarkGate, Matanbuchus, NetSupport, Amadey Loader, XMRig, a clipboard hijacker, and Lumma Stealer. #Windows #Chrome #Malware #ClickFix https://lnkd.in/euKZbv-Y

1

You lied to your CISO so they would accept the job. Terrible move. (But not uncommon) I hear this SO much. -I was told they took security seriously. -I was told I would have X budget. -I was told I could build a team. If you plan on telling these little porkies in the interview, remember; This massively damages your brand. People in security talk, and before you know it, nobody wants to work for you. Secondly, this will cost you. It took you 6 months to make a decision in the first place + waiting for a 3 month notice period to finish. Then they leave within the first 6 months. That's potentially 15 months of time, money & resources down the drain. Getting it right the first time doesn't seem so bad now does it? Stop wasting your time hiring security folks to tick boxes. It won't get you any of the results you want.

84

14 Comments

Even though people describe be as a "cybersecurity" __whatever___ (fill in the blank), I've been architecting secure network infrastructures for 20 years. And I've been wondering "WHAT IF..." we could use all that data to train AI/ML engines for security. The Role of Network Providers in Enhancing Security https://lnkd.in/ePYV96Qe #sponsored #networksecurity #cybersecurity #ai #ml #cyberdefense #attbusiness #attinfluencer #5G DALL-E's rendition of a female network engineer, apparently melding with the ether(net)s (literally). 😅

44

2 Comments

here's a fun way to learn and experiment about cloud pipelines security as seen at NorthSec 2024 Messy poutine, a GitHub organization demonstrating ⚠️ purposely vulnerable build pipelines⚠️ . This is a Capture The Flag (CTF)!

52

3 Comments