I retired as CISO from a public higher ed in Pennsyltucky. Now I'm working in private industry doing GRC/vCISO consulting for a local InfoSec company.
Hash Potatoes: #singleDad #minecrafter #sciFiFan #infosec #WindowsGeek #HITRUST #CISSP
| Opinions | I have some and they are all mine. |
| Force | Light Side |
| Pronouns | He/Him/His |
| https://twitter.com/CompuWatcher |
@accidentalciso Not sure if it helps anyone, but this is my current readiness checklist for applications.
Privileged Access Management
☐ Privileged access approvers list (group or individuals)
☐ Data access approvers list (group or individuals)
☐ Roles identified for PAM
☐ Targets identified for PAM
☐ Service accounts identified
☐ Secret inventory completed
☐ Secret rotation procedures written
☐ Access review strategy and schedule written
☐ MFA implemented
☐ Break-glass accounts created
Secure Configuration Management
☐ Unnecessary features/ports/services disabled
☐ Patch/update strategy defined
☐ Inventory added to CMDB with owners
☐ Baseline Configurations documented/exported
Detection Engineering
☐ Authentication logs sent to SIEM
☐ Administrative activity logs sent to SIEM
☐ Logging levels configured to capture security events
☐ Special IOC development
☐ Special rule development
Incident Response
☐ Determine SOAR necessity
☐ Endpoint isolation strategy
☐ Identity isolation strategy
☐ Downtime procedures documented
Incident Recovery
☐ Application operational/functional check procedure
☐ Service/system restart dependencies document
☐ Backup & Recovery test schedule
So, I seem to be making a fence between social media tools. I find myself gravitating to Mastodon for Infosec and IT stuff, and Threads for more personal/non-work. Of course the streams do cross sometimes, and that's ok. That's just like life.
I'm using Twitter less and less. Insta is still more personal, but it is also more photo oriented. So, I still go there. And Reddit is Reddit.
Well, my general thought on these Social apps is that Mastodon seems the most relevant to me (not even just the infoSec group).
Threads was interesting to peek at, but doesn't hold my attention yet.
Twitter is still a place for real-time trends because some bots are actually useful.
Facebook is still where my friends/family live.
Oh and Reddit is useful but still reminds me of the old BBS days with postings and replies. But makes for great rabbit-hole timekills.
So here's a wild thought. What if...
CISO reports to CIO. Since the CIO tends to still have the ear of the board, run with it. The CIO would have 3 pillars: IT Ops, Security/risk, accountability.
InfoSec sets the rules based on risks and vulnerabilities, IT does IT, accounting checks the work. CIO is the referee, sets priorities, and reports.
SIEM Shady
Venty 🇨🇭🫕
MicheleV_AK