Different team is rolling out an EDR to replace an existing EPP on systems. They asked how to best keep IT Security aware of which systems have been migrated. I asked for a project plan that shows how they plan to perform the rollout in a controlled manner and not just ad hoc and uncontrolled. Team member performing the rollout said the team was too busy performing the rollout to create a project plan. #InternalScreaming

https://thumbs.gfycat.com/IdleImpoliteAardwolf-size_restricted.gif

For those who do OSINT using Twitter — New rules from the Chief Twit:

“To address extreme levels of data scraping & system manipulation, we’ve applied the following temporary limits:

- Verified accounts are limited to reading 6000 posts/day
- Unverified accounts to 600 posts/day
- New unverified accounts to 300/day”

Hot take from a random commenter on an NSA LinkedIn post:

"Good way to solve cyber problems is stop to use phones and computers. Long time ago people survived well and they were kind of smarter."

Customer: Let's keep the people doing the work out of meetings and doing work.

Also the customer: We need you to attend this 90 minute weekly meeting where you have a 30 second speaking part because someone might have questions.

Do other organizations have inventory management, configuration management, and process documentation as IT Security owned areas?

I get it for things like vulnerability management, but asset and configuration management? Just doesn't make sense to me.

I think my organization just uses IT Security as a catch all since they own the system security plan.

Someone check on the hamster.

"Investigating - Reddit is currently offline. We're working to identify the issue.

Mar 14, 2023 - 12:18 PDT"

Does anyone else deal with the constant revisiting of the "sins of the father"?

Heard from a third person today the phrase "your predecessor...."

Usually used in a negative comment. "Your predecessor only visited this site twice in two years" or "your predecessor liked to give lip service" etc.

I can understand it as a, "here are some of the areas we would like to see improved", but usually it is completely negative feedback. More of "the person in that role before you fucked up. Don't fuck up or you won't be in that role long."

Do you ever have meetings with that one person who feels the need to always add input or commentary for some reason?

"I am not an IT Security person, but here is what I think...."

Why is that? Maybe I just don't understand it as an introvert.