Just a reminder to please please please have a plan right now. Posted anonymously from an international DFIR friends’ chat. Anyone in consulting IR can confirm it’s horrible right now and we can’t likely help if you don’t have a plan or retainer.
0 Boosts
1 Like
@hacks4pancakes hearing the same things from the main IR vendors. Unless you have a retainer, they won't be able to work your DFIR
@lowlands that’s a chat with peers from all the big firms.
Yea a lot of this is AI based but the initial entry is definitely not sophisticated. It’s just everyone’s dirty laundry getting aired at once, and killing security by obscurity.
It’s my full time professional area, and I’m very honoured my follower base has expanded beyond it.
The long and short for not the target audience is we have run out of forensic analysts to respond to hacking of businesses because it’s so horrible right now.
@hacks4pancakes I've always assumed that you only write for the target audience of professionals but if you're stating that you appreciate being read outside of your circle:
It would be nice if you use less acronyms or write them out - sometimes I'd like to guess it or google but most of the time I just skip it. No idea what (DF)IR is 🤔
@mr_harm it’s sometimes tricky because they’re well understood acronyms for my industry - sometimes people understand them less spelled out. But I think that there are definitely cybersecurity things non cybersecurity people should be aware of especially when they can impact their lives.
@mr_harm DFIR stands for Digital Forensics and Incident Response, which is my professional field and job title. A mouthful spelled out. We are the ones called in after major cyberattacks as digital detectives and crisis managers.
@hacks4pancakes I regularly read security focus in the late 90s and then stopped because I didn't really understand what was being discussed. I wouldn't cut my teeth on programming for a few more years.
Coming here and seeing so many posts in this and adjacent spaces has been one of the highlights of being back on mastodon for me.
So thanks from another expanded follower base follower.
I will include one excellent digital pancake stack 🥞 for your enjoyment
@hacks4pancakes
Thank you from a member of the expanded beyond follower base.
Funny how AI has enabled automated attacks against stuff we begged to be secured but was ignored until it was in disrepair, but AI is not able to replace human defenders to the point we’re reaching critical burnout and lack of people in DFIR.
I am an old man. I can remember back to the distant past of the mass infosec layoffs last year, when my infosec friends were telling me that it was basically impossible to get a job in the industry and especially impossible for grads or juniors to enter it.
Welp.
I would say "I hope everyone in the industry is okay and doesn't burn out" but sadly I know better than that. All my love, everyone affected.
@hacks4pancakes The alarms for risks and the backslide about IT/OT/MT (and their convergence in ICS) security have been sounded louder and louder for over a decade.
Foxguard, Dragos, Coalfire, Rockwell, Tenable, Nozomi, all of them have been screaming and publishing papers, whitepapers, conference talks, and more all to get folks to pay attention.
If only people had...
@hacks4pancakes hey, ai did that laundry 🧺 for them now lol. Mkay it takes a lot of talent I would guess to build automated systems that do this I would guess. Maybe people just vibe code hacking code now who knows. Anyone can do it now just need to figure it out.
It is pretty nuts AI is going to make low hanging fruit people don't clean up because it has a complexity modifier on the cvss. So vulns maybe more severe and less severe at lol
@hacks4pancakes I wish nonprofits and public agencies were better prepared.
Namely, thinking about my NYC borough's library system (which has the busiest branch in the whole U.S.): https://infosec.exchange/@AlesandroOrtiz/117560793394320594
@hacks4pancakes What is IR & DfIR?