CSIRT Labrador Retriever

@sp1icer @Infosec_Taylor @_mbanana Look at it like a Labrador Retriever: “Wow, look at all this fun stuff I get to do! I get to learn cloud and kick squirrels off the lawn and talk to developers and write reports! What will I get to do tomorrow? Ball? Ball!”

@QuinnyPig @IsForAt Every Business Law I class has questions about this scenario.

This "OpenAI makes ex-employees sign lifelong NDAs or forfeit all of their equity" thing reminds me of something but I can't quite put my finger on it. Any ideas, @isforat?

@DanielW_Kiwi @hmemcpy This is going to sound dumb but in some systems the save button really does need extra help, at least for me. Sometimes I need to know if it saves and leaves me on the record so I can keep editing or saves and takes me somewhere else. Ticketing systems, Agile work items, etc.

@hmemcpy I had to write the help for every button on screen. The "save" button saves your changes I felt particularly proud of that one.

writing unit tests be like

@DM3k_tech “Sorry, I’ve not worked with your app before - can you explain X like I’m a Labrador retriever?” is a relatively common question I ask since I have to work with a ton of different teams/apps.

I'm starting to get off on explaining stuff to people who have degrees and certs in areas that I've had to teach myself in, to have them say "you're absolutely right" or "I never thought of that, that's brilliant"

Unsolicited dog pic. Was doing some stuff on the motorcycle and he wanted to be where the action was (instead of his soft bed 😛).

@benkershner In the most existential sense…

“Soaker” is just the American version of “hoser”, right?

@benkershner @rchrdbyd Aaahh I get it now. Good luck!

@RyanStalets @rchrdbyd This is the PT11 by Port Townsend Watercraft. It’s an 11’ rowing and sailing dinghy. By splitting the boat in half like this we can nest the bow inside the stern reducing the length to about 5’ 10”. This allows me to store the dinghy on the foredeck of our 41’ sailboat.

Flipping ahead a few pages un the build book, the dreaded snip is within sight.

@benkershner @rchrdbyd I thought you were getting a vasectomy until it clicked you were talking about your boat 😂. What is the purpose of this?

@rchrdbyd If this is what you think circumcision is you may need to have a conversation with your doctor. Maybe your lawyer too.

@Wookiee__ I see that you are a Service Eventually shop.

Message on Skype “you need to email <insert name> to request access” Me: “isn’t that the point of the ticket? I request access, my manager approves it via the ticket, then goes to another approval?” *crickets*

@chrismunns These things have always struck me as extremely not-fat-guy-friendly.

Nice! New farting booths in the office. Should make the general open floor experience even better!

@kvlly Allegedly I’m a “Principal Application Security Architect” and today I created epics and features in Azure DevOps and did only a little bit of architecture.

If you’re wondering how coding is going as a Director of Engineering, today I edited an HTML email template

@DoomsdayGoth @caterpillar Not sure when you graduate, looks like our full time college grad roles for this year are filled but both IT (which houses the central cybersecurity team) and Digital (web/mobile app engineering division, we have a small appsec team) still have summer intern roles posted.

@DoomsdayGoth You come join the cool kids at @Caterpillar 😎. We have a decent tuition assistance program, although like most others it comes with a commitment. pages.beamery.com/caterpillarinc…

I’m interested in obtaining a Masters degree in the future however I’m wondering how do I get my future employer to pay me to get my masters? How does that work?

@VPNSteve @AccidentalCISO I’m familiar with pyramid of pain but I’m thinking more design and less threat detection (I’m not a CSIRT Labrador retriever anymore but I have yet to figure out what labbo I am now and “feral raccoon of security architecture” is also on the list of possibilities 😂)

Does anyone have an example of a threat model done really well so that I can understand if what I see happen is what is supposed to happen? CC: @AccidentalCISO because that’s the only way I can get visibility out of the algorithm 😂

@yvesbd @AccidentalCISO Thank you for the resources!

@AccidentalCISO but the output I most often see is a tabletop vulnerability assessment complete with CVSS scores. It’s hard for me to feel like those add much to an already crowded conversation. But that’s why I want to talk to people, because maybe I just don’t understand. 2/2

@AccidentalCISO The reason I ask is that I think of a threat model as “determine the bad scenarios that might happen to my specific app and the likelihood of those scenarios occurring” (like scenario-based DR planning), 1/

@AccidentalCISO I mean Threat Vector would be at least a moderately OK band name.

If I ever release an album, I'm going to call it "Risk model in a bottle."

@AccidentalCISO @xTiffVicious The bummer about weaponized anxiety is that cybersecurity requires us to assess likelihood and if we could do that we probably wouldn’t have anxiety 😂

@xTiffVicious Have you considered a career in cybersecurity?

Why do our brains always seems to create worst case scenario narratives for the unknown?!