secfirstmd

Yep totally. It's something I've incorporated. Especially where the main incident commander gets overwhelmed with decisions, tunnel vision or distraction. For example getting trapped into threat hunting rather than commanding.

I actually think most cyber incident responder training for the commander is pretty weak because it doesn't do a great job of instituting the stress element. Physical security training does it in a much better way. The result is the need to create custom stuff. Because some shitty off the shelf big vendor table top or similar ain't gonna do it.

So as someone who runs and trains cyber incident response teams. Where a big focus is on MMTx and reducing chance for adversary breakout times. Which are gonna get worse thanks to AI. This paper was actually part of me calling the approach Formula One IR.

Specifically about getting people joining the IR to already have their assigned speciality and first moves ready to go and to begun, as a way to support the incident handler. There's really big benefits to studying the metrics of specific incidents you have to the minute by minute level. So much time saving to be made, accuracy to be enforced and duplication to be reduced.

You can find there's less time wasted in an incident dividing out jobs or lost go inevitable context switching to join the incident. There's already searches, people and clarity about what should mostly likely be done in the first few mins, even though the plan will change and details initially are probably scare. It's really effective and cuts MMTx down a huge amount.

Obviously then the handover itself is a vital part in IR to get done accurately and with speed. So that flows into all of the above. It's a really good paper for thinking through workflows

I must get around to writing it up some day.

ARC always feels like a feature not a product. Don't see how Atlassian connection is really gonna make either better.

MCP? I find the name MCP over used but not offensive.

Eh I got news for ya.

The file size problem is still an issue for many big name EDRs.

I think there is an argument that currently Google Gemini is best place to tie everything together. Assuming Google executes on it well.

Most people use Gmail, Docs, Google Maps, Google Calendar above Apples alternatives. Gemini could really tie them up well.

Lol, pretty sure you can. See Afghanistan withdrawal, Iraq, Vietnam etc etc

Failed country? By what measure? One of the highest GNPs per person, one of the most democratic, one of the highest winners of novel prizes for literature per population, one of the safest countries in the world, one of the most food secure countries in the world, overall very good and mostly free health and education, a high redistributive tax system, friendly people, easy place to work...

I worked at the MIT Media Lab Europe and in the army for my transition yeah.

Oh and drank a lot of beer. Great times!

Intersting. Pidgin and variations are used by some gov orgs.

At secfirst.org over the past 10+ years we've probably trained hundreds of journalists on this exact scenario and how to detect/mitigate it.

Unfortunately though this means the amount of people who can use it is dramatically reduced.

Obligatory Mitchell and Webb: Homoeopathy Accident and Emergency Ward

https://youtu.be/HMGIbOGu8q0

Sadly Mozilla is essentially a company that survives on a Google handed, given by the big G to reduce any risk of anti-trust.

TBH I'd say the same about Notion.

Threads is the most harrowing movie by far. Remember watching it in college and not being able to get out of bed the next day because I was so fucking depressed.

I think what we are specifically speaking about here is one where it can be done remotely. Intelligence orgs have had secure(ish) digital dead drops for years. Example:

https://www.bbc.com/news/world-europe-16614209

He bought an extremely dangerous product in Twitter, remove most content moderation and now is contributing to huge risks to democratic systems all over the world.

It's probably not possible to do a regular hire in 1.5 months. To purchase a full business in that time? No chance.

So we are cheaper for insurance but you do actually pay more than that when you include the black hole that is your taxes to the HSE.

Who cares if it was developed by ChatGPT if it actually works? Why not try it out first before crapping on someone's hard Open Source work?

This is a joke right? No new major social media networks since Snap? Eh what about TikTok?

Companies have moved off PagerDuty? To where?

Also China is pretty good at espionage these days...

This

Why would Scottish independence matter? Are they gonna take their wind with them?

They [Young People] have exalted notions, because they have not been humbled by life or learned its necessary limitations; moreover, their hopeful disposition makes them think themselves equal to great things -- and that means having exalted notions. They would always rather do noble deeds than useful ones: Their lives are regulated more by moral feeling than by reasoning -- all their mistakes are in the direction of doing things excessively and vehemently. They overdo everything -- they love too much, hate too much, and the same with everything else.

(Aristotle)

So you work for the government?

As a European in a country with complex multi-party coalitions and most people voting across the party system every couple of years. This comment is just so weird.

One big area will be security.