Angry Infosec Analyst @AngryInfoSec

why companies require off-hours only tests against internet-facing systems is beyond me. the internet doesnt sleep, if you're concerned about an outage due to testing, you should be concerned about an outage due to internet traffic

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

how to be an effective ciso: do periodic internal vuln assessments, assign ownership to remediating results, do annual penetration tests, get an IR retainer at a reputable firm, and fight the executive red tape bullshit. how to be an effective ceo: give your ciso a good budget

0 0 1 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

i think you should report a critical-level finding on an external pentest if the client can't accurately provide you a list of their internet-facing IP addresses or even ranges. the amount of clients that give you IP targets they dont own is insane

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

if you dont have a strict deadline for your pentest, dont scream at your consultants when they cant give it to you tomorrow on last minute notice. especially in Q3/Q4. come on now, be happy

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

pretty nice to see ransomware attacks decreasing because the government is actually doing something about it for once. too bad it will only be temporary until the attackers get smarter

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

if you buy a pentest or red team and you designate large sections of your network as off limits, you (or your leadership) doesn't understand the purpose of an offensive test. bad guys are not going to avoid your "most critical systems"

0 0 1 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

Semgrep Community! @semgrepcommunit

4 years ago

https://t.co/vXCRWlElcL

131 16 145 0 3

Download Image

0 0 0 0 0

Download Gif

Angry Infosec Analyst @AngryInfoSec

4 years ago

"im going to talk to our antivirus vendor and see why they didnt detect X" get your head out of the 2000s. if you are relying on only antivirus to detect/block bad guys, you are already screwed

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

if you are an ass to your consultants or vendors, your projects are going to get staffed by new hires. no reason to treat people poorly

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

its terrifying how many (not good) penetration testers google for a vuln, find a random persons github that says it exploits the vuln, downloads the precompiled exe and runs the exe on client systems. imo this should be a fireable offense. why does no one talk about this problem

0 0 0 0 0

Angry Infosec Analyst @AngryInfoSec

4 years ago

no, putting the pentesters in a network with 1 phone system on it without connectivity anywhere else does not let you pass a pci pentest, no matter how much you argue