300

>SOC2 is the best-known infosec certification

LOL. I've stop reading right there.

The problem is real and it's not the only one in this space. I was surprised to see so many words and so little substance. If feels like Troy didn't really try about this one.

I use Hugo. Lots of free themes here: https://themes.gohugo.io/

You can write your content in Markdown, keep everything in a repo, and only push static files to the hosting of your preference.

Here's what to do in the first few weeks:

1. Require not 1, but 2 people, for hire, right now. It will take a long time until it gets approved, HR does their thing, and you (or someone else) hire people to help you.

2. Document, as fast as you can, all of the assets in your environment. Don't waste time on looking for software. Plain text or spreadsheet will do for start.

3. Identify the most important assets (servers, network devices, etc) - and try to understand what are your priorities for each. For example, availability for your frontend servers. Confidentiality and integrity for your server storing PII. Based on this, you'll understand what are your biggest risks. Would it be a business disaster if your website is down for few hours? Likely not. What about if the PII is compromised and you get huge fines and be in the news? More likely.

4. Find out who has the access to the most important assets, and cut off anyone who doesn't really need it.

5. Establish some sort of monitoring for the most important assets.

By following the basics of ISO27K1, for example:

Good infosec teams keep inventory of all the software used in the org. If they see that the org already pays a vendor for software doing X, a question should be raised, why we need another one for doing the same thing.

Also, each new vendor or software provider needs go get a "security clearance", after the infosec teams checks their state of security.

These kinds of practices would probably discover the shady intents.

The only thing I wonder about here is how it's possible that the infosec/GRC team didn't notice this.

Here's a better source: https://www.theverge.com/2021/1/28/22255245/google-deleting-...

>The learning never stops :)

Totally. I wrote a book on it, and I still keep learning :)

>Is this how SnipMate, UltiSnip etc work under the hood?

No idea, I don't use these. I'm generally trying to use as few plugins as possible.

They could have blocked the user in Iran. It's without sense to block the organization's account.

Thank you, I mostly agree :)

And finally I have a good name for those people I discuss with on a regular basis - the "checklist experts" :D

More and more companies get compromised by a "highly sophisticated" actors.

And somehow, these companies immediately "know" that it was a nation-state actor. Same case here. There are only claims, but no facts, no evidence.

And lately, it's always "the russians" :) I'm just noticing the pattern.

Lastly, what I really can't understand is - how in the world these "highly sophisticated attackers" are so bad at covering their tracks. :)

The homepage is old, hence there are no samples. But here's the one, for example: https://medium.com/@jovica/the-power-of-recursive-macros-in-...

Mastering Vim Quickly: From WTF to OMG in no time

https://jovicailic.org/mastering-vim-quickly/

109 pages.