Austin Baker

2.5K posts

Austin Baker

Austin Baker

@BakedSec

IR at LinkedIn | focused on the intersection of data science, engineering, and cybersecurity | Scooping up APT and bopping them on the head | opinions my own

가입일 Ekim 2018
263 팔로잉1.7K 팔로워
Austin Baker
Austin Baker@BakedSec·
Build a career where you always bring something valuable to the table - that can be depth, breadth, or even just unbridled tenacity and grit. If you do this, you'll find there's a seat for you more places than not.
Matt Zorich@reprise_99

People often ask me what they should learn or study in cybersecurity and my advice is always the same; aim for technical excellence with things you love to do and aim for broad technical competency in as many related things as you can - a diverse base of knowledge is career gold

English
0
0
7
570
Austin Baker
Austin Baker@BakedSec·
When you have a file lock on the investigation timeline so some goober associate doesn't try to merge in their horrendously formatted system timeline into the main one while you're compiling new IOCs to track (it me, I was the goober)
U.S. Graphics Company@usgraphics

LOTO (Lock-Out-Tag-Out) cards exemplify peak analog goodness: combining a physical tag, industrial graphics, and a locking mechanism—a critical safety tool to prevent unintentional and unauthorized actions during maintenance. 🧵

English
0
0
3
275
Austin Baker
Austin Baker@BakedSec·
As Brian notes, blameless does not mean without accountability. You have to be able to say "X failed because Y team made Z choice". Blameless means you don't call out individual persons and try to ruin their lives over what is typically an honest mistake.
Brian in Pittsburgh@arekfurt

"Blameless" is a very interesting word when it comes to investigations/post-mortems.😏 There are (at least) two very different senses of it: 1. No formal punishment is imposed or fault declared, but who did what where and why are still analyzed. 2. The problem fell from the sky.

English
1
3
9
2.7K
Austin Baker
Austin Baker@BakedSec·
@dinodaizovi Granted but I think the lament of most in-the-trenches practitioners is that A. Hardening is unevenly distributed and undo effort is often placed on securing niche attack vectors (the above) and B. Traceability is then neglected or upcharged by vendors for common vectors.
English
0
0
0
141
Dino A. Dai Zovi
Dino A. Dai Zovi@dinodaizovi·
Good cybersecurity is possible, it is just unevenly distributed. Remember the saying that if an attacker has physical access, it's game over? If someone says it, hand them a smartcard, EMV terminal, tamper-responsive HSM, or an iPhone and ask them to extract cryptographic keys.
English
14
7
58
7.7K
Austin Baker
Austin Baker@BakedSec·
People often misunderstand opportunistic targeting (baiting) employed by threat actors. You know those signs you see stapled to a pole saying you can make XXk a month only if you call this number? Yeah, they don't need to fool you - just the person desperate enough to call them.
English
0
0
1
195
Austin Baker
Austin Baker@BakedSec·
@HackingLZ Brb making my agent to translate my slides into crudely drawn mspaint pngs
English
0
0
2
145
Austin Baker
Austin Baker@BakedSec·
The conflict between these metrics, the push and pull as the organization grows and churns, is what helps confirm for you that the ecosystem is stable - not stagnant, never stagnant. But consistently operates within the boundaries of what is "acceptable/good" for each.
English
0
0
0
102
Austin Baker
Austin Baker@BakedSec·
The best metrics strategy for security operations is to find a core set of signals (3-5) that are not all aligned with each other. How fast you close a case vs. how many cases have to be reopened. How many new detections you wrote vs. your overall SNR.
English
1
0
2
266
Austin Baker
Austin Baker@BakedSec·
First World TTRPG Problems: A cool new dark, gritty setting comes out but all your "edgy" friends are now buttoned up IT professionals and only play 5E
English
0
0
0
206
Austin Baker
Austin Baker@BakedSec·
@Hexacorn A church because when all else fails in security, pray pray pray :D
English
0
0
1
197
Austin Baker
Austin Baker@BakedSec·
@HackingLZ Same thing happening with blue side certificates. Teaching investigation techniques that are largely irrelevant to modern security operations work - which has largely moved towards working entirely in EDR/SIEM land. The cert factory needs fresh bodies for our "unfilled" 1M jobs
English
0
0
9
681
Justin Elze
Justin Elze@HackingLZ·
All of the red team courses these days, I do wonder if people are being set up for failure. It’s rarely, if ever, an entry level job and continues to become more and more about development/research as the rate at which EDR and other defensive techniques iterate is much quicker than ever before. There are several routes to buying evasive tooling, implants, and other research, but that won’t completely plug the development/research gap long term.
English
21
11
257
60.3K
Devon Kerr
Devon Kerr@_devonkerr_·
1. Do you have visibility? 2. Do you have capability? 3. You can’t stop what you can’t see, can you? 4. If you can see it did you stop it? 5. Did you get 3 or more “no” responses? If so, start over at 1 and do the necessary thing to get to “yes”. I have solved security.
English
2
2
12
1.6K

탐색

@HackingLZ @dinodaizovi @FuzzySec @domchell @elonmusk @BarackObama @taylorswift13 @cristiano