The user is deciding whether to pursue an MBA for a resume boost or to focus on obtaining the CISM or CISA certifications, having already acquired multiple advanced degrees and certifications in cybersecurity and project management.

The CISA has reported that a high-severity vulnerability in Windows Server Message Block (SMB) is currently being exploited in cyberattacks, posing significant security risks.

Hackers exploit 34 zero-days on first day of Pwn2Own Ireland

For pentesters and red teamers: What actually takes the most time in your workflow?

The post discusses creative data exfiltration methods, mentioning attackers using DNS TXT queries to sneak data out as regular traffic, and a proof of concept where smart lightbulbs leak data via brightness changes to an outside camera. It invites others to share strange methods they've encountered.

Mentorship Monday - Post All Career, Education and Job questions here!

A subreddit mod noticed an increase in posts suspected to be from engagement bots. These posts, often from new or history-wiped accounts, ask open-ended questions. The mod seeks advice on handling these posts and requests users to report them for further investigation.

BSides is a mess - anyone actually able to attend a local meeting?

Is the field of Cyber Security as over saturated as Computer Science? Is it time to consider a change?

The post questions whether large-scale internet outages, affecting services like Snapchat, Amazon, and Fortnite, are due to a cyber attack or just server hosting issues, expressing uncertainty as no information is available.

The real security vulnerability may be in 10-minute calls to Tier 1 helpdesk agents despite spending millions on EDR and firewalls. The concern is whether ongoing training is sufficient, as groups like Scattered Spider exploit this weak point. Are there effective controls to truly solve it?

The user is questioning if they should continue practicing writing code from scratch while working in Splunk SOAR, as they rely on tools like Claude to modify Python and JSON code efficiently. They wonder if other SOAR professionals also use such tools instead of manually coding.

Cybersecurity Professional Seeking Advice on Next Steps to Become a CISO

A user new to cybersecurity is confused about subnetting. They understand that for IP 192.168.1.0/28, the broadcast is 192.168.1.15, but they're puzzled why with IP 192.168.1.15/28, the broadcast becomes 192.168.1.31. They're seeking a clear explanation for this discrepancy.

China’s chilling stolen data plot for everyone in Britain…

What does Secure Boot actually protect against?

SSO is convenient but poses risks if the master account is compromised, potentially exposing all connected apps. Concerns include cookie theft and session hijacking, allowing attackers to bypass passwords and 2FA. This vulnerability has led to hacks, even on accounts with strong security measures.

The burnout, the grind, the money

The Reddit post discusses using AWS Secrets Manager as a personal password vault, noting its encryption with KMS, IAM access control, and CloudTrail audit logs. The author likes the secure and clean setup without third-party clouds and seeks opinions on whether this is smart or overkill.

The post mentions an $800 experiment that managed to intercept unencrypted calls, texts, and military data from space, highlighting potential vulnerabilities in communication security.

A nation-state threat actor breached F5, stealing BIG-IP source code and information about undisclosed vulnerabilities.

Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits

A large enterprise with 20,000 employees is experiencing a 40% increase in sophisticated targeted attacks, mainly phishing emails and impersonation calls. Incidents handled by CIRT have risen from one or two per week to two per day. Seeking insights on whether others face similar issues.

A user is having their first SOC analyst (Level 1) interview. They have IT experience but not in cybersecurity. The recruiter advised not to focus too much on technical skills, as they're looking for someone eager to learn about cybersecurity. They're seeking interview tips.

Trellix products, especially the McAfee-side, are frustrating with frequent issues and unresolved support tickets. Users face problems like DLP crashing Microsoft Edge and a clunky SIEM. The EDR is unreliable, making the overall experience unbearable.

An individual seeks advice on whether leaving an MSP job after 6 months would negatively impact their prospects with recruiters. They express dissatisfaction due to low pay, ticket mismanagement, untrained sales, and poor administration, which is affecting their passion for the field.

Cybersecurity order warns of "imminent risk" to federal agencies following possible breach

China Accessed Classified UK Systems for a Decade, Officials Say

The user seeks recommendations for effective Zero-Trust platforms and experiences from others. They are interested in real-world results beyond vendor claims or reports, and want to know which approaches (identity-first, network-first, or hybrid) have proven successful or problematic in practice.

F5 Security Incident - Nation-state Compromise

A paper highlights that ad-hoc upgrades to Meta Platforms' password storage, involving hash chaining, may introduce vulnerabilities. This first-of-its-kind exploit reveals weaknesses in Facebook's system. Ethical guidelines and vendor notifications were followed.

If you could implement a new cybersecurity law, what would it be?

The post questions if computer science is still the best field to pursue, seeking opinions on what the new "future job" might be, similar to how CS was previously viewed.

F5 has issued a statement reporting a compromise of its systems, and data exfiltration

There's a growing need for cybersecurity in AI applications, as many developers lack understanding of basic security principles, resulting in unsafe apps. AI speeds work, but most developers can't ensure security. There's fear around SaaS security and developers' awareness of breach risks.

Hackers can steal 2FA codes and private messages from Android phones using a "Pixnapping" attack. The malicious app needed for this requires no special permissions.

Seeking advice on entering cyber threat intel, with a background as an all-source intel analyst. Currently holds the CompTIA trifecta and working on CySA+. Believes prior experience could be beneficial in this field.

How are you handling selling Israeli-based cybersecurity products in the current climate?

The Trump administration is laying off almost 200 employees from CISA and reassigning others, with some needing to move across the country or resign.

What is your favorite and least favorite topic in cyber security?

A cybersecurity professional may be defined by their understanding and ability to handle issues, not just proficiency with specific tools. Concepts are important, as tools vary between companies but serve similar purposes.

A report highlights that satellites are unintentionally leaking sensitive data, including calls, texts, and military information, posing significant cybersecurity risks.

A court injunction is preventing sites like Have I Been Pwned from releasing data related to a Qantas leak.

From Full-Time Cybersecurity Engineer to Starting My Own Consultancy

Microsoft has identified a new scam named "Payroll Pirate", which involves phishing attacks aimed at stealing employees' direct deposit information. Cybercriminals are targeting users by sending emails that trick them into divulging their payroll data.

The post asks if others in cybersecurity have personal notes or "cheat sheets" with command snippets for quick reference, and inquires about how they're organized for easy access.

This is a weekly thread for posting career and education questions in cybersecurity. Feel free to ask about certifications, degrees, job requirements, or any general career queries. No question is stupid. You can also browse previous weeks for similar questions and answers.

A new Security Analyst at a small hospital is tasked with building a security program from scratch. The hospital currently has SentinelOne, Mimecast, PDQ, a checkpoint firewall, and Halo for IT tasks, but lacks formal security processes. They're seeking advice for focus areas in the first 90 days.

The Reddit post discusses encountering a fake SOC2 report from a small startup, raising concern over its absurd claims and mismatched details. The author queries if others have faced similar issues and asks about red flags in SOC2 reports, emphasizing the importance of transparency from vendors.

Get a Cyber Security Humble Bundle offer now. Enjoy!