Tom Hall

Director, Cyber Incident Response and Remediation @PwC_UK. Ex Mandiant. All thoughts are my own.

[Tom Hall @thall_sec]

We're looking for a senior manager for remediation during cyber breaches. If you've got experience supporting the recovery of environments following a breach or have an architecture/engineering background and want a new challenge, follow the link. https://t.co/zaJlA86Ki2

[Tom Hall @thall_sec]

@KathrynPorter26 We took what was a three day old baby in after being told to go to A&E by the midwife team and had to delay starting to be seen while I checked her in on an iPad and answered questions on how I arrived at the hospital, whether by car or public transport

[Tom Hall @thall_sec]

@ImposeCost How about all the artefacts with undocumented timestamps ..

[Tom Hall @thall_sec]

@sashayanshin Then you go to pay and find your iPhone decided to remove it to save space and you have no signal

[Tom Hall @thall_sec]

@MalwareJake Completely disagree. There are various roles in an incident response team from analysts to leads and there is completely a place for entry level positions within that model with the appropriate training and oversight.

[Tom Hall @thall_sec]

@ImposeCost Exfiltrate

[Tom Hall @thall_sec]

@BakedSec @bwithnell Biggest pet peeve while at fireeye

[Tom Hall @thall_sec]

@crypt0_goldfish @troyhunt Agreed but that’s not what was done here, the article says they made changes and requested data. That’s a data breach without prior authorisation and potentially a GDPR reportable incident for the organisation.

[Tom Hall @thall_sec]

@GazTheJourno @ciaranmartinoxf If you read the job description they’re looking for someone to manage two apprentices. What we should be calling out is hyper inflated job titles with no clear accountability.

[Tom Hall @thall_sec]

@4n6lady Ignore most things you read on infosec Twitter

[Tom Hall @thall_sec]

We’re recruiting! Incident Response positions open at Manager and Senior Manager. Drop me a message if you want to work with some of the best talent in the UK.
https://t.co/VWnKC1C5X3
https://t.co/NjaeT5u4SO

[Tom Hall @thall_sec]

@ImposeCost Worst case you see a similar product appear in a different market five years down the line, most organisations have far bigger problems outside of government supply chain where it’s a risk to continuing contracts

[Tom Hall @thall_sec]

@GazTheJourno Just wait until they discover I shot the sheriff

[Tom Hall @thall_sec]

@BushidoToken What would you put it at? I think there are bigger misinformation opportunities to spend money on, most people would agree that lockbit are currently the most prolific

[Tom Hall @thall_sec]

@uuallan @jwarminsky @FT @iankmsmith It’s likely following guidance from Lloyds for cyber insurance which follow the same direction https://t.co/mtBocwFldo

[Tom Hall @thall_sec]

@DebugPrivilege Far easier to wait ten minutes for it to overwrite itself

[Tom Hall @thall_sec]

@likethecoins @SANSInstitute @NCSC See you there!

[Tom Hall @thall_sec]

@x04steve If someone is talking about a breach they aren’t working on it