Austin Baker

IR at LinkedIn | focused on the intersection of data science, engineering, and cybersecurity | Scooping up APT and bopping them on the head | opinions my own

[Austin Baker @BakedSec]

Build a career where you always bring something valuable to the table - that can be depth, breadth, or even just unbridled tenacity and grit. If you do this, you'll find there's a seat for you more places than not.

[Matt Zorich @reprise_99]

People often ask me what they should learn or study in cybersecurity and my advice is always the same; aim for technical excellence with things you love to do and aim for broad technical competency in as many related things as you can - a diverse base of knowledge is career gold

[Austin Baker @BakedSec]

@HackingLZ When the red team realizes GDPR applied to them too

[Elmo @elmo]

Elmo loves you. ❤️

[Austin Baker @BakedSec]

When you have a file lock on the investigation timeline so some goober associate doesn't try to merge in their horrendously formatted system timeline into the main one while you're compiling new IOCs to track
(it me, I was the goober)

[U.S. Graphics Company @usgraphics]

LOTO (Lock-Out-Tag-Out) cards exemplify peak analog goodness: combining a physical tag, industrial graphics, and a locking mechanism—a critical safety tool to prevent unintentional and unauthorized actions during maintenance. 🧵

[Austin Baker @BakedSec]

As Brian notes, blameless does not mean without accountability. You have to be able to say "X failed because Y team made Z choice". Blameless means you don't call out individual persons and try to ruin their lives over what is typically an honest mistake.

[Brian in Pittsburgh @arekfurt]

"Blameless" is a very interesting word when it comes to investigations/post-mortems.😏

There are (at least) two very different senses of it:
1. No formal punishment is imposed or fault declared, but who did what where and why are still analyzed.
2. The problem fell from the sky.

[Austin Baker @BakedSec]

@dinodaizovi Granted but I think the lament of most in-the-trenches practitioners is that A. Hardening is unevenly distributed and undo effort is often placed on securing niche attack vectors (the above) and B. Traceability is then neglected or upcharged by vendors for common vectors.

[Austin Baker @BakedSec]

People often misunderstand opportunistic targeting (baiting) employed by threat actors. You know those signs you see stapled to a pole saying you can make XXk a month only if you call this number? Yeah, they don't need to fool you - just the person desperate enough to call them.

[Austin Baker @BakedSec]

@HackingLZ Brb making my agent to translate my slides into crudely drawn mspaint pngs

[Austin Baker @BakedSec]

@FuzzySec @domchell Man if only those bad guys hadn't lost all their scruples! :D

[Austin Baker @BakedSec]

@FuzzySec @domchell Why use good pretext when bad one do?

[Austin Baker @BakedSec]

The conflict between these metrics, the push and pull as the organization grows and churns, is what helps confirm for you that the ecosystem is stable - not stagnant, never stagnant. But consistently operates within the boundaries of what is "acceptable/good" for each.

[Austin Baker @BakedSec]

The best metrics strategy for security operations is to find a core set of signals (3-5) that are not all aligned with each other. How fast you close a case vs. how many cases have to be reopened. How many new detections you wrote vs. your overall SNR.

[Austin Baker @BakedSec]

First World TTRPG Problems: A cool new dark, gritty setting comes out but all your "edgy" friends are now buttoned up IT professionals and only play 5E

[Austin Baker @BakedSec]

@Hexacorn A church because when all else fails in security, pray pray pray :D

[Austin Baker @BakedSec]

@HackingLZ Same thing happening with blue side certificates. Teaching investigation techniques that are largely irrelevant to modern security operations work - which has largely moved towards working entirely in EDR/SIEM land. The cert factory needs fresh bodies for our "unfilled" 1M jobs

[Austin Baker @BakedSec]

@h4wkst3r @XForce @MSFTBlueHat @hthackers Very cool, you will have a wonderful audience :)

[Austin Baker @BakedSec]

@Hexacorn @anton_chuvakin Ah I see - thank you for clarifying :) I haven't run into one of these yet but it sounds fun :D

[Austin Baker @BakedSec]

@_devonkerr_ Cybersecurity got us like: