Just a reminder to please please please have a plan right now. Posted anonymously from an international DFIR friends’ chat. Anyone in consulting IR can confirm it’s horrible right now and we can’t likely help if you don’t have a plan or retainer.
0 Boosts
1 Like
@hacks4pancakes got external IR last week, next day 😅 so there are some mixed messages.
But yeah, folks pretending to do security are having a bad time.
It's worse.
Often enough it's already "... even if you have a retainer."
Especially if you are only at several million dollars loss a day (or below).
@hacks4pancakes What is IR & DfIR?
@hacks4pancakes hearing the same things from the main IR vendors. Unless you have a retainer, they won't be able to work your DFIR
@lowlands that’s a chat with peers from all the big firms.
Yea a lot of this is AI based but the initial entry is definitely not sophisticated. It’s just everyone’s dirty laundry getting aired at once, and killing security by obscurity.
It’s my full time professional area, and I’m very honoured my follower base has expanded beyond it.
The long and short for not the target audience is we have run out of forensic analysts to respond to hacking of businesses because it’s so horrible right now.
@hacks4pancakes I've always assumed that you only write for the target audience of professionals but if you're stating that you appreciate being read outside of your circle:
It would be nice if you use less acronyms or write them out - sometimes I'd like to guess it or google but most of the time I just skip it. No idea what (DF)IR is 🤔
@mr_harm it’s sometimes tricky because they’re well understood acronyms for my industry - sometimes people understand them less spelled out. But I think that there are definitely cybersecurity things non cybersecurity people should be aware of especially when they can impact their lives.
@hacks4pancakes I regularly read security focus in the late 90s and then stopped because I didn't really understand what was being discussed. I wouldn't cut my teeth on programming for a few more years.
Coming here and seeing so many posts in this and adjacent spaces has been one of the highlights of being back on mastodon for me.
So thanks from another expanded follower base follower.
I will include one excellent digital pancake stack 🥞 for your enjoyment
@hacks4pancakes
Thank you from a member of the expanded beyond follower base.
Funny how AI has enabled automated attacks against stuff we begged to be secured but was ignored until it was in disrepair, but AI is not able to replace human defenders to the point we’re reaching critical burnout and lack of people in DFIR.
@hacks4pancakes A long long time ago at my thesis defence seminar -- on restructuring SCADA in the context of "smart microgrids" and how that will turn the control room inside out when everyone now suddenly have one hiding in their discomfort of their own home and not even the most religious of believers can sing the airgap hymn:
One industry representative in the evaluation committee remarked "Well, you suggest all these fancy resilience measures and virtualization and monitoring and hardening and whatnot, but aren't the lights still on? how would you convince anyone in an industry where the last way we got any relevant funding was a cascading blackout? "
The reply was that well, we won't, your stance now is <arms crossed gesture>, we will have to wait until <praying hands gesture> and hope that won't be too late. I recently got a text from the person, after many years of silence. The message was just a praying hands emoji.
I’m trying to think of a non technical analogy for what is happening. It’s like there’s a new supervillain who isn’t super strong or super smart, but his super power is just knowing the most embarrassing thing every company has ever swept under the rug for twenty years.
@hacks4pancakes ants ? they can get in the smallest hole, they will find that crumb under your fridge, and they will tell their friends that the fridge is on fire
@hacks4pancakes Funny how AI companies are spending millions on finding weaknesses in our project, but have no intention to contribute to improving the public good.
I am an old man. I can remember back to the distant past of the mass infosec layoffs last year, when my infosec friends were telling me that it was basically impossible to get a job in the industry and especially impossible for grads or juniors to enter it.
Welp.
I would say "I hope everyone in the industry is okay and doesn't burn out" but sadly I know better than that. All my love, everyone affected.
@hacks4pancakes The alarms for risks and the backslide about IT/OT/MT (and their convergence in ICS) security have been sounded louder and louder for over a decade.
Foxguard, Dragos, Coalfire, Rockwell, Tenable, Nozomi, all of them have been screaming and publishing papers, whitepapers, conference talks, and more all to get folks to pay attention.
If only people had...
@hacks4pancakes hey, ai did that laundry 🧺 for them now lol. Mkay it takes a lot of talent I would guess to build automated systems that do this I would guess. Maybe people just vibe code hacking code now who knows. Anyone can do it now just need to figure it out.
It is pretty nuts AI is going to make low hanging fruit people don't clean up because it has a complexity modifier on the cvss. So vulns maybe more severe and less severe at lol
@hacks4pancakes I wish nonprofits and public agencies were better prepared.
Namely, thinking about my NYC borough's library system (which has the busiest branch in the whole U.S.): https://infosec.exchange/@AlesandroOrtiz/117560793394320594
@hacks4pancakes @catsalad What is IR?