As a fellow #infosec practitioner I enjoy maturing the Cyber Security capabilities of the organization I work for. And as we make progress almost every day, I keep thinking about what the perfect state will be like and whether a state of perfection can ever be reached.
So, what does a perfect state of Cyber Security Operations look like?
Modern ISPs will automatically provide your home devices with IPv4 and IPv6 addresses. For the privacy minded that means that you have to mask both IP addresses to properly hide your geo-location. Most VPN clients only take care of your IPv4 address – Therefore, you might want to disable IPv6 on your device.
On my main personal laptop I'm using Debian 10 at the moment, so here are the steps to disable IPv6 on Debian 10:
sudo nano /etc/sysctl.conf (at the end of the file add “net.ipv6.conf.all.disable_ipv6 = 1”)
sudo sysctl -p
This post stores notes about my latest #linux laptop setup based on Manjaro i3 (community edition).
If you are experiencing issues with email delivery for new registration confirmations or other notification emails, here are some things that might help:
Review Logs with...
> sudo journalctl -u mastodon-sidekiq | grep -i smtp
Try sending an email using your mastodon settings on SSMTP (https://linuxhandbook.com/linux-send-email-ssmtp/)
Reach out to your hosting provider and ask whether they are blocking SMTP by default (to prevent email spam)
Search Mastodon Admin forum at https://discourse.joinmastodon.org
In the last couple of months I have spent a good amount of time reading, trying out, and thinking about decentralized social networks on the Internet. This post summarizes my understanding of the three different types I have come across.
It probably is a good time to share books worth reading – Below you can find my favorite #infosec books.
Sandworm (Amazon) is currently my favorite because it gives you an understanding of nation-state actor capabilities. It gives you good reasons for making excellence in cybersecurity a habit and not an act.
The Cuckoo’s Egg (Amazon) I like because it plays in a time that is so long ago with inferior tech and is a good reminder that things used to take forever. Today we do so many amazing things in a matter of minutes or hours (our adversaries do too) that we forget about all the little details that have been automated by tech.
The cult of the dead cow (Amazon) is a book that explains a lot about the hacker culture in the US. This one might be a little nerdy but also gives some insight on how the US government came to understand cybercrime.
Key Performance Indicators (KPI) are what people in business generally use to measure the performance of a business function or team. In the Cybersecurity world we are blessed (or cursed) with plenty of KPIs. And even in the cyber sub-section of phishing we still have a lot of metrics that email security vendors force on us – Here are some examples:
Now, let's take a step back! Does any of the above metrics make any sense to a normal (non cyber) person? And who is giving you your cyber budget again..?
Over the last couple of years there have been numerous debates on whether it is a good idea to get rid of password expiration. The arguments against password expiration are usually variations of the below:
Forcing users to change their passwords on a regular basis leads to widespread use of weak passwords. Frequent password changes in many systems lead to password re-use (aka user is using the same password everywhere) Putting the burden of security on the user is wrong, technology should do the heavy lifting. What is interesting about most of the conversations I read, is that they seem to ignore all the other password improvements that the advocates for getting rid of password expiration usually cite – When you get rid of password expiration, you are supposed to also do the following:
A. Improve password length significantly (switch from passwords to pass phrases)
B. Get rid of some password complexity requirements (Special characters are really hard to remember!)
C. Introduce a Password Blacklist (e.g. block the word 'password' or its variations like 'p4ssw0rd')
D. Monitor your user accounts for leaked credentials and force password changes once you detect a leaked credential!
Now, A,B,C are really easy to deliver – You can just install and configure some tech, which will do the job for you. It is pretty much a set and forget kind of thing to implement. However, D is a completely different beast – See the paragraphs below.
