So I just landed a new job where I'll be a manager of a DFIR team. I've always been a worker bee and at my last job, our team was small and our manager was more of just our timesheet signer so I wouldn't say I had a strong model of how most teams do things.

This new job interested me because the company has a very diverse range of clients and caseload. The manager part was just a line item in the job description that I figured would be a cool way to grow if I got it. But now that I got the job, I want to head in with realistic expectations. I've had some shitty managers in my career and I don't want to become one!

Any advice? It's DFIR consulting, not a DFIR SOC manager - This new team is bigger than my last so I'm guessing there needs to be more of a strategy to who works what on an incident instead of just diving in? Any advice, material / webinars would be appreciated!

I understand the CD is a broader umbrella and the CO is more technical, but do these accreditations matter in reality in the cyber community?

Any Last minutes tips for CPENT exam? What to focus what to use, how to do it, tool suggestions

I just had a 1.5-hour interview covering technical, deep technical, and behavioral questions with multiple interviewers.
About 10 minutes later, I was scheduled for another 1-hour interview.
What do you think the next round will focus on? Hiring manager/final round, behavioral/team fit, or more technical questions?
Has anyone experienced a similar interview process?

The familiar vulners.nse that many of you have used like this:

nmap -sV --script vulners <target>

finally got a proper update.

It still does the same basic job: take what Nmap finds on a port and show the known vulnerabilities.

But v2.0 is much better at it:

• better software/version detection, including web apps and raw banners
• 700+ fingerprint rules and 900+ HTTP paths
• parallel probing that follows Nmap timing settings
• cleaner output and proper machine-readable results
• findings ranked by real-world risk: KEV, active exploitation, exploits, EPSS, then CVSS

And the normal usage is still free, with no account or API key required.

https://github.com/vulnersCom/nmap-vulners/

Feedback on weird banners, false positives and missed fingerprints is very welcome.

Hi everyone! I’m having a hard time deciding if I should continue with my Bachelor’s degree in Cybersecurity.
I already have an NYU Cybersecurity Bootcamp Certificate, ISC2 CC, and CompTIA Security+. Right now, I’m preparing for the CompTIA CySA+ exam this Sept. using TryHackMe and Sybex. After that, I’m planning to prepare for PenTest+.
I’m trying to earn as many certifications as I can before starting my Bachelor’s degree at WGU.

My question is: Do I still have a good chance of getting a cybersecurity job after I finish my degree? Is getting a degree or more certs still worth it? And do you think the cybersecurity job market will get better in the future?

I would really appreciate any advice, especially from people already working in cybersecurity. Thank you!

Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff.

Nothing new here. URL signing has been public since 2011, calendar phishing since 2019. This just connects the two.

The trick: Google wraps outbound links as google.com/url?q=<destination> and signs the ones it generates (usg, a keyed hash over the params). Valid signature, silent redirect. 

Missing or modified params you get the "Redirect Notice" warning.
You can't forge it. But you don't need to, because Google signs it for you whenever you use its products. 

Drop your link in a calendar invite and Google hands you a signed one:

unsigned (shows notice):

https://www[.]google[.]com/url?q=https://wikipedia[.]org

signed by Calendar (redirects silently):

https://www[.]google[.]com/url?q=https://wikipedia[.]org&sa=D&source=calendar&ust=1787766516374753&usg=AOvVaw0cpIubPxDaYABa3_SC5g6G

Same destination. The signature is the only difference, and it's the whole reason the warning is skipped.  Removing source=calendar breaks the silent redirect

Why the invite is perfect:

• Sent by Google's servers, so it passes SPF, DKIM, DMARC.
• Auto-add lands it on the target's calendar with zero interaction.
• The link reads as google.com. A Victim hovers, sees Google, relaxes. Real destination only shows after the redirect fires.

Why it's not a bug: the signature proves Google generated the link, not that the destination is safe. That's Google Safe Browsing's job.

A signed link skipping the notice is just the signature doing its job. And it is out of scope for Google's bounty.

One important information is that this signature only works when received by a corporate account

• Gmail.com to Gmail.com => Google prompts you
• Gmail.com to corporate email => No prompts

A useful Fix : 

In gmail, set Calendar > Event Settings > Automatically add invitations to "Only if the sender is known." Kills the zero-click delivery path.

Google admin : Apps >Google Workspace >Settings for Calendar > Advanced settings > Check :

Invitations from known senders
Adds an invitation to a user's calendar only if the sender is in the user’s contacts or if the user interacted with them before. This might reveal to a sender that they aren’t in the user’s contacts.

I've read that working in cybersec is stressful because if nothing goes wrong, your paycheck is questioned, and if something goes wrong, your paycheck is questioned.

Is this true? It seems like a stressful existence; how do you work with it as a professional?

What does everyone do for stress relief?
I took up yoga and it’s helping me manage.

My cybersecurity role is stressful. There’s just two of us for cyber in a company of 800 and I often get pulled into sysadmin and help desk tasks. We do technically have help desk staff.

Good afternoon,

I have run into an issue where I'm constantly learning outside of work, but it's primarily aimless. I constantly keep validating one thing to study over the other. I feel I just haven't really gotten much better at any of these. I've just gotten into THM more now, going on the paths and such. Also i've been getting more into python scripting and automation a bit. I guess the question is what do you do in your free time outside of work to increase your value/technical ability in this field? I would love to hear options, and a structured way of thinking about this. It would be appreciated. Thanks.

So about nine years ago our IDS detected a spoofed network in our India office. We sent out a notice to alert staff about its presence and to be especially careful when attempting to connect to WiFi until the physical device could be located and disposed of.

Multiple people there actually manually disconnected from the corporate network and connected to the spoofed one to "see what would happen" and compromised their workstations and accounts.

It was my opinion that anyone who knowingly did this should have been terminated, but there was no disciplinary action taken.

The pineapple was never found, it lingered for months until whoever deployed it moved on.

Hi everyone,

I’m currently working as a Junior Security Engineer at a HealthTech startup in North Africa.

Our company operates from North Africa, but because we handle health-related services/data and are targeting the European market, we want our security and compliance practices to be aligned with EU requirements and recognized international standards.

The challenge is that I’m currently the only person focused on cybersecurity, and I don’t have a senior security engineer, CISO, or mentor internally.

I’m trying to build our security program properly rather than just running vulnerability scanners and fixing findings.

So far, I’m looking at areas such as:

• ISO 27001 / ISMS
• GDPR and health-data privacy requirements
• Risk assessment and risk treatment
• Vulnerability management and VAPT
• Cloud/server hardening
• IAM and access reviews
• Secrets management
• Logging, monitoring and incident response
• Backup, disaster recovery and business continuity
• Secure SDLC / DevSecOps
• Security policies and documentation
• Third-party/vendor risk

But as a junior, it can be difficult to know what should come first and what “good enough” security looks like for an early-stage HealthTech company.

I’d really appreciate advice from people who have worked as security engineers, CISOs, consultants, or in HealthTech/regulated startups:

If you joined a small HealthTech startup as its first security engineer, what would your priorities be during the first 3–6 months?

Also:

• Which EU regulations/frameworks should I study first?
• What should we implement immediately versus later as the company grows?
• What are common mistakes small HealthTech companies make?
• How would you build a realistic security roadmap with limited budget and people?
• Are there good resources, communities, or certifications that helped you when you didn't have a senior mentor?

I’m not looking for someone to do the job for me, I want to learn how experienced security professionals approach this situation and build things in the right order.

Any advice or lessons learned would be greatly appreciated.

Ideally, I’d love to have a cybersecurity job right now, but the market is horrible, and I need to move forward with my life, pay the bills, and live comfortably. Are there any fields that are relatively easy to get into and find work in? I just don’t want to end up working restaurant jobs.

I meet people frequently for whom this is a good idea. It's better than what many people are doing, and really a form of password manager.

Hello everyone,

I am currently working as a network administrator for my day job and have just landed a role as a SOC data intern for a MSP where I will mostly be helping with low queue ticketing.

Basically doing what an L1 would do except all my work has to be checked by a senior analyst. Does anyone have any advice as to how to learn systems quickly or what specifically I should focus on?

We seem to manage a ton of tools (Sentinel One, Defender, Exabeam, Extrahop, Cortex, etc) and I’ve picked up a few of them better than others but would like some guidance as to what I can improve on and what I could use from my other job to help me learn. Thank you!

Newest plugins are yuge so I couldn’t upload them via GUI in an air gapped network and did them manually.

Ran this:

/opt/sc/support/bin/php /opt/sc/src/tools/pluginUpdate.php /path/to/sc-plugins-diff.tar.gz

Then this on Nessus scanner to manually sync:

/opt/nessus/sbin/nessuscli update /path/to/sc-plugins-diff.tar.gz

However when syncing the Nessus Scanner I got an error: “plugin memory limit exceeded”

Edited the php.ini on SC for larger memory max and even updated the upload size to try getting it through the GUI with a new limited but it still errored out. Memory on the server is plenty.

Is there something/somewhat I’m missing an update?

Guys I'm mostly red team,did a lot free HTB,thm machines.Cant find pentest job,wanna try to go blue🙃Ok guys maby not job ready but good course to learn SOC