Shit InfoSec Says

Trying to do what's right... but usually just doing what's easy.

[Tom McCheese @Wookiee__]

CISO: “ we find it best to not enter tickets to the IT team for security issues”
ME: “..how do you track progression and have accountability?”
CISO: “we just do”

Terrible mindset. #infosec

[Shit InfoSec Says @InfoSecSays]

#log4j

[Horse ebooks @Horse_ebooks]

Everything happens so much

[Shit InfoSec Says @InfoSecSays]

"Certain types of badge must be held closer to the reader, due to the layers of advanced encryption."

[Shit InfoSec Says @InfoSecSays]

Assessing supply chain security risk like

[Shit InfoSec Says @InfoSecSays]

Parallel universes are not a security boundary

[Shit InfoSec Says @InfoSecSays]

"It will be totally airgapped, but we'll still need to have some holes poked."

[Shit InfoSec Says @InfoSecSays]

Five years and ISACA still refuses to award me any CPEs for running this account. #MyTwitterAnniversary

[Shit InfoSec Says @InfoSecSays]

i hate how everyone keeps asking for things on tickets. i feel like we have enough things.

[Nick Mathewson is now @[email protected] @nickm_tor]

Gaze not into the abyss, lest you become recognized as an abyss domain expert, and they expect you keep gazing into the damn thing.

[Accidental CISO @AccidentalCISO]

Team: I have updated the incident response plan. Effective immediately, the emergency assembly location is now the pub down the street.

[Shit InfoSec Says @InfoSecSays]

@PANTH13R TCP/IP is an add-on feature, please contact sales for pricing.

[Sam. Beaumont @PANTH13R]

Vendor: “The mechanism is secure because the upgrade server doesn’t have an IP address. Just a domain name”

🙈

@InfoSecSays

[Cannibal 🎃 @Cannibal]

How do I setup the ACL on this router?

[Shit InfoSec Says @InfoSecSays]

Break-glass admin accounts are just backdoors that have been documented, change my mind.

[Shit InfoSec Says @InfoSecSays]

This latency is unbearable. We need a faster speed of light.

[Shit InfoSec Says @InfoSecSays]

Tech needed onsite to update connection settings, but delaying due to flooding. De-escalating ticket priority as the client is not blocked by outage, because they have been evacuated.

[amy nguyen @amyngyn]

COWORKER: we need to find the root cause asap
ME: *takes long drag* the root cause is that our processes are not robust enough to prevent a person from making this mistake
COWORKER: amy please not right now

[Shit InfoSec Says @InfoSecSays]

Audit finding: Vulnerability scan results reveal host and domain names
Remediation: Redact or obfuscate identifiable information in vulnerability reports

Management response: We need that information to know where we need to patch, won't fix

[Shit InfoSec Says @InfoSecSays]

I don't have an issue with this software if you're making Gantt charts of how you plan to execute a dinner party or something completely unrelated to work, however it absolutely cannot be used with any company data until a formal review has been completed.

[Shit InfoSec Says @InfoSecSays]

Ain't no party like a CI/CD party cuz a CI/CD party automatically deploys to prod