One Article Review
| Source |  AlienVault Blog |
|---|---|
| Identifiant | 1679420 |
| Date de publication | 2020-04-28 12:00:00 (vue: 2020-04-28 13:01:32) |
| Titre | Working from home? Use the spare time for professional development |
| Texte | This blog was written by an independent guest blogger. It’s 2020 and our world is rapidly evolving. Many conferences and training programs have been cancelled, most of us are working from home, and it may seem like learning opportunities are scarce. If you are locked in your house due to COVID-19, what could you be doing to improve your cybersecurity & information security skills? Let me share a few ideas. Let’s start with the most straightforward suggestion I give every person who wants to jump into infosec. In my opinion, it is the fundamental skillset that will lift you above any and all of your peers and most seasoned professionals. It is considered by many in the industry to be beneath them and boring work that it is often overlooked, but is so essential to almost all organizations that people who have this skillset within an organization become critical to infosec operations and can easily flip between blue team and red team operations. So what is my first recommendation? Learn Microsoft Active Directory. Microsoft Active Directory (AD) is the heart and brains of most organizations today. AD controls who and what is part of the corporate network, access and permissions rights, visibility, logging and reporting, and more. When malicious actors want to “stop by for a visit”, their initial goal is to gain access to AD so that they can accomplish their larger objectives. Think about this for a second, you wifi Access Point is nice, your endpoint is nice… but Admin privileges on the Domain Controller?!? With those, they can go anywhere and take anything on the network. Here’s a bigger secret: Most AD environments are a mess. Total disaster that is being held together by hopes and prayers… and it is only getting worse. Organizations buy products to enhance their security because they don’t know how to use Active Directory! If you learn how to build trust relationships, user permissions and shares, roles, a GPO set that actually works the way it is supposed to, PKI management, proper logging and reporting and apply that knowledge to your environment, you will have a very clear understanding of how malicious actors will attack you and how to identify and stop them. My second recommendation, if you are able to, is to learn how to use the security tools your organization owns. In my experience, many organizations purchase tools for a specific purpose rarely implementing all of the tools features. People that have a deep understanding of each of the tools become invaluable when something goes wrong. My secret? Start with the tools that the team takes for granted, the tools others don’t find interesting. Some examples I’ve seen throughout my career include Antivirus, endpoint encryption, multi-factor authentication, but sometimes it can be firewalls, EDR or other tools. Often it is the tools that team members have the least experience with or know the least about. Regardless, all of these provide an opportunity to learn more, enhance your skills, and become more valuable to the security organization. My third recommendation is to build your professional network. Now is a perfect time to join LinkedIn and Twitter. Now is a perfect time to join virtual meetups, free training sessions, and chat groups. It doesn’t matter how much you know, if this is day 1 or day 10,000 in cybersec, engaging (professionally and politely) with others is a great way to widen your perspective, learn new things, and develop professional skills. Added Bonus: developing and maintaining professional relationships now will help your career trajectory over time significantly. My fourth and final recommendation is to focus on learning more about your industry |
| Envoyé | Oui |
| Condensat | “stop https://channel9 000 2016/m354 2020 @blackroomsec https://www @girlgerms @infosystir @swiftonsecurity https://decentsecurity able about above access accomplish active actors actually acumen added admin alerts all almost amanda amazon antivirus any anything anywhere apply are are: attack authentication because become been being beneath berlin between bigger blackroomsec blog blogger blue bonus: book: boring brains build business but buy can cancelled capabilities career centric chat clear com com/ com/events/ignite/new com/training/ competitors conferences considered controller controls corporate could covid critical cybersec cybersecurity day deep defensive develop developing development directory disaster dodson doesn’t doing domain don’t due each easily economist economy edr encryption endpoint engaging enhance environment environments essential every evolving examples existing experience factor features final find firewalls first flip focus four fourth free from fundamental gain general getting give goal goes google gpo granted great groups guardian guest handbook happenings have have heart held help here's here’s home hopes house how https://aws i’ve ideas identify implementing improve include independent industry information infosec initial interesting invaluable it’s jess join journal journals jump know knowledge larger learn learning least let let’s lift like linkedin list lobby locked logging magazines maintaining malicious management many matter may meetups members mess microsoft more most msdn much multi nc2=sb network networking new news nice nice… notifications now objectives often only operations opinion opportunities opportunity organization organizations other others outlets over overlooked owns part peers people perfect permissions person perspective pki point politely possible prayers… prepared privileges products professional professionally professionals programs proper protecting provide purchase purpose rapidly rarely read recommendation red regardless relationships reporting resources rights roles scarce seasoned second secret secret: security see seem seen sessions set share shares significantly sitting skills skillset some something sometimes spare specific start stop straightforward street subscribe suggestion supposed take takes team them these things think third those throughout time tldr: today together tools total training trajectory trust twitter understanding use use: used user valuable very virtual visibility visit” wall want wants way what when who widen wifi will within work working works world worse would written wrong wsj www your zealand |
| Tags | |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.