Robert Saffell, CISSP, GRID

🚀 Absolutely worth it — if you're serious about building (or advancing) a career in cybersecurity, this is one of the smartest moves you can make right now. Comtech’s live instructor-led CompTIA Security+ (SY0-701) training delivers exactly what most people need: ✅ Real-time interaction with expert instructors ✅ Hands-on virtual labs that actually stick ✅ Practice exams + performance-based questions that mirror the real test Security+ remains the #1 most requested entry-level cybersecurity certification and is required for many DoD/government roles. In today’s threat landscape, the skills you’ll gain in network security, risk management, threats & vulnerabilities, and operational security are immediately applicable on the job. Whether you’re transitioning into cyber or leveling up your current role, investing 5 focused days in May can pay dividends for years. If you’ve been thinking about getting certified in 2026 — this is your sign. Spots are limited and the May 18–22 session is coming up fast. 👉 Secure your seat here: https://lnkd.in/g9Ka8dyi Who else is planning to knock this cert out this year? Drop a 🔥 or comment below — happy to answer any questions! #CyberSecurity #CompTIA #SecurityPlus #CyberStronger #ProfessionalDevelopment #Infosec

3

1 Comment

Fail of Fame: ClearanceJobs.com 1. CSP set to “Please Hack Me” default-src * blob: data: 'unsafe-inline' 'unsafe-eval' • This is the CSP equivalent of leaving your front door open with a neon “WELCOME” sign. • Allows any script from anywhere, runs any inline code, and even executes arbitrary strings with eval(). • Impact: Any XSS bug instantly becomes full account compromise, data theft, or drive-by malware. No browser-side safety net at all. 2. CORS Misconfiguration From Hell Access-Control-Allow-Origin: *.clearancejobs.com + Access-Control-Allow-Credentials: true • Wildcard origins aren’t valid with credentials — browsers should ignore it, but backend logic could still misapply it. • If improperly enforced server-side, this could let a malicious subdomain read authenticated API responses. • Impact: Potential data leakage of personal info, resumes, or job activity from logged-in users. 3. Permissions-Policy? Referrer-Policy? COOP/CORP? Nope. • Zero modern isolation headers to reduce the blast radius of a compromise. • Impact: Easy clickjacking, over-sharing of referral data, and no site isolation to contain injected code. 4. Audience Risk Profile Off the Charts • The user base isn’t random shoppers — it’s people with active or pending security clearances, working in defense, intel, and government. • Impact: An XSS or session theft here isn’t just personal inconvenience — it’s an espionage goldmine. 5. CloudFront Popcorn Machine • Sitting behind AWS CloudFront, so an attacker only needs one injection point in any origin server to serve malicious code globally in minutes. • Impact: Massive scale, instant reach, global compromise in one hit. 6. No Defense in Depth • No content isolation, no sandboxing, no enforced HTTPS beyond HSTS, and no selective resource loading. • Impact: Everything depends on backend code being flawless — and backend code is never flawless. Translation: Right now, any competent attacker who finds a small injection or misconfig on ClearanceJobs.com could: • Steal logins and personal data from people with active clearances. • Pivot to spear-phishing campaigns targeting high-value individuals. • Potentially harvest sensitive employment history that could be used for foreign intelligence targeting. Source:

22

11 Comments

Any builders making cloud platforms in Gov/GovCon, be prepared for the flood of “how much time/money/effort will it take for you to move out of Azure?” questions. FWIW, building in Azure made/makes a lot of sense, because DoD/USG is in deep with Azure, so connecting makes things easier, plus everyone on the gov side is pretty familiar with an Azure stack. Now we have to start dealing with the “yeah…but now we want out” conversations…

12

21 Comments