securityforge📡

infected

That’s a pretty new feature and mostly came about because of all the customers complaining that there were no scanning options 😅

But old-school AV is a huge hit on system performance, so most orgs. prefer the lightweight EDR+NGAV

Well the problem is the assumption that the EDR+NGAV would actually detect and/or stop the execution. I have experienced cases where old-school AV had better detection & prevention than EDR+NGAV in certain cases (and vice-versa to be fair).

Looking for a way to force the taskbar to show everything all the time because the registry fixes aren’t working for me

The latter looks like an average day for a Windows box 🥲

Looks like the maple syrup heist was just practice

This is the key. Its not for productivity reasons. It’s sunk-cost fallacy with commercial real-estate. Also many of the proponents of return-to-office have stakes in the commercial real-estate business.

Wait until you see the costs of the security software that can’t reliably detect the default shit. Most vendor stuff in this industry is a scam used to offload risk and pass the blame to.

Clink link Long press image Now you can choose to share the photo or save to your photos. Long press is unintuitive for iOS beginners. From my experience all phones have shit UX. Non-technical will struggle with either. Its why Apple offers classes at their stores.

Fair enough. Sorry, I probably should have looked deeper into it before suggesting. Good luck on your quest!

github.com/paperless-ngx/pap… Would this work? I haven’t tried it myself but I’ve heard good reviews about it.

Unfortunately, in many places those expensive controls check multiple compliance boxes whereas a red team only checks one off. For smaller orgs they probably don’t have the flexibility to actually fix the issues you would find. This industry is fun! 🥲

I think if Sysmon was built into Windows it would see a lot more use. From places I’ve worked, Windows systems already had 5+ Security & IT management agents so there was very little appetite to add anything more (even if it was better than what’s already there)

We wanted to but at the time of eval it wasn’t supported on the legacy garbage required in our environment. 😢

4th option: If your employees are accidentally pwning the org for $30 maybe that phishing sim budget should have been redistributed to their paycheques instead😅

The self-driving cars analogy is perfect. We seem to be constantly 5-10 years away from fully autonomous self-driving. Same thing with fully autonomous Tier 1 SOC.

Thanks for the info. I completely agree. If Bitlocker is enabled by default then having the key backed up with an MS account will be better for most users.

Not sure if that has changed at all in Win11 though, so I’m happy to be corrected if I’m wrong.

I personally disagree with it being useful for consumers. Back in my computer tech days I dealt with a large # of folks who forgot their MS account password and didn’t have access to recovery options (cell or other email). Recovering a local acc was easier than a MS acc.