Tim McConnaughy

Cyberthreat to Alabama state government ‘neutralized’ https://ift.tt/4Ywd0xR After a cyberattack first identified about 10 days ago, Alabama's IT leaders said the "threat has been neutralized and Alabama’s core operations are safe and stable." via The Record from Recorded Future News https://ift.tt/OaC4MhJ May 20, 2025 at 01:34PM

2

OK, so duplexing is a thing to discuss in P5G, so I break down the topic into the two most generic forms. Let's chat really quick on why it matters.

6

Custom fields might not sound sexy. In fact. I’ll put my neck on the line and say that outright aren’t sexy. But when you’re trying to find an ‘SC cleared, Avon based CCNA Engineer open to a fixed-term contract who’s already been through interview stage’, they’re golden. Every CRM will give you job title and contact details, salary and work preference. But the real value comes when you track the niche and nuanced variables that are important to your clients and your industry. Whether that be: · Clearance levels · IR35 preferred status · Regulatory knowledge · Tools experience · Preferred working pattern · Source of application · Technology · Industry background tags With solid field design, you can slice and surface hidden gems in seconds. Without it? You’ll be scrolling through 3-year-old CVs trying to remember who was who. BUT this only works if the whole team uses them. Consistently. Design and define your custom fields to deliver because you will have the feature. You just need to use it

11

Most people assume that hard work or volume of work will get them results. It doesn't! Alignment and direction are critical when working in groups or companies. Ask yourself this question, the rest I don't have to tell you - "Is my work aligned with company's Mission?"

24

5 Comments

ninety-nine point nine percent uptime sounds easy It's only forty-five minutes of downtime a month Now add one hour of planned maintenance per week Your uptime just dropped to ninety-nine point four percent That's the math most teams don't do before signing SLAs I came across a solid breakdown from the NSRC (Network Startup Resource Center), part of the ICANN ISOC NSRC Registry Operations Curriculum No individual author credited, but the content is worth sharing Here's the deal They break network management into what they call the "Big Three": Availability - think Nagios Services, servers, routers, switches Reliability - think Smokeping Connection health, RTT, latency Performance - think Cacti Traffic, CPU, RAM, disk, port usage There's overlap between these tools That's fine But running zero of them? I've seen that too many times The part that hit home for me was baselining If you don't know what "normal" looks like on your network, you can't spot problems early Typical link load, jitter levels, resource usage, background noise from scans and errors You need that data before anything breaks And then there's documentation Basically, if you're not tracking every switch port, every config change, every upgrade, you're flying blind The NSRC recommends tools like Netdot, Netdisco, and RANCID for automating this Old school? Sure But they work The FCAPS model still applies here Fault, Configuration, Accounting, Performance, Security It's not new But most teams only cover two or three of these Bottom line, monitoring isn't just about knowing when things break It's about knowing before your users do What's your go-to monitoring stack in production, and how do you handle planned maintenance windows in your SLA calculations? #smenode #NetworkEngineering #NetworkMonitoring

48

1 Comment

Lock down your Tiger Data services, without the overhead of a VPC. Here’s a quick walkthrough of using IP Allow Lists to control access to just trusted networks.

14

Why isn't my CTI team providing more actionable intel? Recently I started thinking about the different pitfalls I've seen different CTI teams fall into and I thought I'd put it into a multi post thread. Reason number 1 your CTI team isn't providing more actionable intel 1. Lack of Enablement or Empowerment CTI can’t take or trigger action • No authority to block, alert, or modify detection content. • Output stays passive (PDFs or Slack blurbs) instead of getting embedded into SIEM/SOAR systems. Missing execution pathways • No technical glue to make IOCs flow into action (e.g., auto-tagging, enrichment, alerting, detection rules). Bias toward only “immediate action” • Leadership and responders may only consider an IOC blocklist actionable—but that ignores preparatory or situational awareness intelligence that enables faster decision-making during future incidents.

168

4 Comments

For years, security tools told us IPv6 was "too large to scan" and "not worth worrying about yet." Every vendor knows IPv6 exists. Every vendor knows modern infrastructure is dual-stack. Every vendor knows attackers actively scan IPv6 space. And every vendor is praying you don’t ask about their IPv6 coverage. While most ASM platforms stayed IPv4-only, IPv6 quietly became the largest unmanaged attack surface on the internet. Today, we’re introducing DefndIT - a dedicated IPv6 monitoring platform, bundled with Attack Surface Management, built on real-world IPv6 research. We regularly scan 500M+ IPv6 addresses, surfacing exposed and misconfigured deployments. Join the waitlist for free. Register with your corporate or organization email address at https://defndit.com.

50

2 Comments

Ever been told by a customer: “I don’t know what I want, but I’ll know it when I see it”? That came up in a session I had this wee with some folks from NPower. They’re working on a real use case—migrating from on-prem storage to the cloud—and it brought up several lessons that apply to almost any architecture project. First: diagram everything. As soon as we started sketching options, the right questions came: – What happens if the network goes down? – What if this component fails? – How do we address business continuity / disaster recovery? A diagram isn’t just a pretty picture; it’s a thinking tool. Second: document assumptions. Clients don’t always know what they want—or can’t articulate it. Making reasonable assumptions, writing them down, and testing them through iteration is how you uncover the real requirements. Some of my best lessons early in my career came from this exact dynamic. Third: how to present. I recommend going in with a primary solution mapped directly to requirements (or your documented assumptions), but also having a Plan B in your back pocket. It shows thoughtfulness, flexibility, and builds trust. And especially when working with less technical teams or customers, don’t expect them to follow every detail of the architecture. Part of your role is to guide them through the complexity, translate the jargon, and help them understand the tradeoffs. Architecture is rarely about drawing the “right” box diagram on the first try. It’s about facilitating the right questions, assumptions, and choices that get everyone to a workable solution. ❓ Curious—when you’ve been in front of a client or stakeholder, do you prefer showing one strong recommendation or a menu of options? #CloudSecurity #Architecture #Mentorship #Leadership

7

2 Comments

Cato Networks is releasing a feature in Socket v25 that proves they're listening to the people in the trenches: Firewall Hit Count Reset / Refresh What I'm a really big fan of is the Refresh ability. Currently, the hit counter displayed next to firewall rules refreshes every 24 hours. If you put a rule in place and want to validate its immediate functionality, you usually have to open a new tab and dive into the Events page. But a new tab is a new distraction. And when you have hundreds of other firewall rules generating events simultaneously, that "quick check" becomes research. In version 25, admins can remain focused in the midst of troubleshooting. Ask the user to generate the behavior, click refresh, and quickly validate. This feature isn't earth-shattering in itself, but it signals what executives and practitioners value most: a partner that listens and cares about the daily workflow. It's one of the many reasons we've been pairing the Cato solution with our clients around the globe since 2018.

3

1 Comment