Darin Fredde

If you hang around an industry long enough, you begin to see things...actions, decisions, etc...being repeated. In 2007, the team I was on began performing PCI forensic investigations, and sometimes we'd see where a technician had come into a merchant, and set the the POS devices in debug mode, leaving a clear text file of credit card numbers (CCNs) on the device. When they were done, there was no accountability regarding resetting the devices, so when the threat actor gained access to the infrastructure, they didn't need to do anything to collect CCNs, other than "yoink" the files. These days, *if* someone has a "security stack", actions will be taken during troubleshooting, some functionality will be enabled or disabled. AV may be disabled, host isolation may be disabled...and when the end is reached, those functionalities are not re-enabled/disabled. Something else we see a lot of is orgs doing a "test" rollout of EDR or some other tech, only to not move to a complete rollout, so that significant portions of the infrastructure are left unmonitored.

90

12 Comments

⚠️ COMPLIANT. BUT COMPROMISED. ⚠️ Most organizations are not losing cybersecurity they are killing it, knowingly or not, and replacing it with a performance. I call this Security Ghosting a term I coined. Controls exist on paper, dashboards are green, audit findings are closed. But the operational reality is different: logs exist but no correlation, SIEM exists but no use cases, EDR exists but no tuning, policies exist but no enforcement. Detection is weak, response is slow, and the attack surface keeps expanding. And the most critical failure: your best cybersecurity engineers are not doing real defense work they are busy producing reports, answering audits, and generating “evidence.” The people who should be building security are being used to simulate it. This is not security. This is a self-inflicted vulnerability. ⚠️ Verizon DBIR has been saying this for years: most breaches don’t happen because of missing controls, but because existing controls are not actually implemented. The problem is not lack of technology it is non-operational security. 🔒 Compliance ≠ Security. Evidence ≠ Control. If your best engineers are preparing audit documentation instead of detecting attacks, you’ve already lost. An organization that is better at passing audits than stopping attacks is not secure it only looks secure. 🔥 How many companies are truly protected, and how many are just practicing Security Ghosting? #CyberSecurity #SecurityGhosting #CISO #InfoSec #CyberResilience #SecurityLeadership #RiskManagement #Compliance #CyberRisk #DigitalRisk #BlueTeam #SOC #ThreatDetection #IncidentResponse #SIEM #EDR #CyberDefense #SecurityEngineering #ZeroTrust #Leadership

280

378 Comments

At HSDF's Cybersecurity Symposium, Jason Hill OSCP, GPEN dicusses utilizing technology to meet FedRamp goals and adapting to evolving cyber threats. As a former CISA member and military veteran, his insights on navigating the sea of cybersecurity tools in a resource-limited environment are invaluable. #Cybersecurity #FedRamp #TechSolutions #HSDF

5

Well, all the other cyber nerds are posting about it, so I guess it’s my turn. This is not anti-AI. It is pro-governance. Clawdbot. Moltbot. Pick your name. Another “AI-powered” tool that popped up overnight, spread fast, and is now being breathlessly shared without much discussion of what it actually does, where it runs, or how it handles data. This is exactly the moment where security teams should slow the hype down and default to a block-first posture. Unproven and untested tools should not be silently operating inside corporate environments. That means blocking known indicators at the EDR level, blocking destinations and IP ranges at firewalls, and stopping access through proxies. It also means actively scanning for indicators of compromise or usage artifacts associated with these services across endpoints and networks. Most organizations should already have a CASB or SaaS security control in place that blocks all AI tools by default and only allows explicitly approved services. Permit by exception, not by curiosity. If an AI service cannot clearly explain data sovereignty, retention, training use, and jurisdiction, it does not belong in your environment. New tools will keep showing up. Some will be great. Many will not. The discipline is in resisting “everyone else is using it” and sticking to fundamentals. Block first. Review deliberately. Allow with intent. Curious what others are doing here, especially around CASB policies and detection strategies.

20

3 Comments

Your SOC analysts are drowning in alerts. Burnt out. Leaving for other jobs. Before you blame them for poor performance or the tools for generating noise, look upward. SOC fatigue is a leadership failure, not a frontline failure. If your analysts are overwhelmed, it's because leadership hasn't made the hard decisions about what to monitor, what to ignore, and what actually matters. They've taken the vendor default configurations, enabled everything, and left analysts to figure out what's signal and what's noise. The problem isn't that your team can't keep up with the alerts. It's that leadership hasn't defined what "keeping up" should look like. They've prioritised visibility over insight, coverage over clarity. Smart security leaders don't maximise alerts, they optimise them. They make tough choices about detection priorities. They tune aggressively. They accept that you can't monitor everything equally and focus on monitoring the right things well. Your SOC doesn't need more people, better tools, or longer hours. It needs leadership that takes responsibility for the signal-to-noise ratio. Every alert that reaches an analyst should be worth investigating. If it's not, it shouldn't be generating alerts. That's a tuning decision that leadership owns, not an analyst competency problem. This week: calculate how many alerts your SOC receives versus how many they can meaningfully investigate. Close that gap by reducing low-value alerts, not by demanding analysts work faster. What percentage of your SOC alerts lead to actual investigations versus being immediately dismissed? Follow me for more real-world OT security thinking ♻️ Repost if it shifted your thinking 💾 Save this for your next team meeting

13