Brad Proctor

Have you ever wondered what browser extensions your users have installed and what impact they might have to your organization? If you have, I'd bet it wasn't easy to figure out if you tried. I've launched Secure Annex to help folks with that. The tool provides enrichment and deep code analysis of browser extensions so that folks can be sure that the web browsers their employees use, where most work gets done today, is safe from threats. Check out my quick tour of Annex to see what is possible.

111

17 Comments

The best pen testers? They're problem addicts. We crave the impossible puzzle. We thrive on "unbreakable" systems. Why? Because real attackers don't follow checklists. They innovate. They persist. They surprise. To truly protect, we must think like them. My team's approach: 1. Embrace the unknown 2. Question every assumption 3. Celebrate creative solutions Result? We find vulnerabilities others miss. #Cybersecurity #Pentest #Infosec

38

Phishing scams happen all the time. 🎣 I'm sure if you checked your spam folder right now, you'd find at least a few emails from "bank representatives" asking for your account information or "lottery officials" claiming you've won a large sum of money. These general phishing scams are easy to spot, and most of us know not to fall for them. But, of course, cybercriminals have other, more sophisticated tricks up their sleeves. One such tactic is known as whaling 🐋 - a type of phishing scam that specifically targets high-level executives and other top officials within an organization. These attacks are carefully crafted to deceive even the most cautious individuals. Here are 5 scenarios of what a whaling attack might look like: 𝟭. 𝗙𝗮𝗸𝗲 𝗜𝗻𝘃𝗼𝗶𝗰𝗲: A finance manager receives an email from the "CEO" with a fake invoice attached, requesting immediate payment to a fraudulent account. 𝟮. 𝗪𝗶𝗿𝗲 𝗧𝗿𝗮𝗻𝘀𝗳𝗲𝗿 𝗥𝗲𝗾𝘂𝗲𝘀𝘁: An accountant gets an email from the "CFO" asking for a large sum of money to be wired to an unknown account. 𝟯. 𝗣𝗵𝗼𝗻𝘆 𝗦𝘂𝗯𝗽𝗼𝗲𝗻𝗮: The legal team receives an email from a "lawyer" with a fake subpoena attached, requesting sensitive company information. 𝟰. 𝗜𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗣𝗼𝗹𝗶𝗰𝘆 𝗨𝗽𝗱𝗮𝘁𝗲: Employees receive an email from the "CEO" announcing a new internal policy requiring them to update their login credentials on a fake website. 𝟱. 𝗙𝗿𝗮𝘂𝗱𝘂𝗹𝗲𝗻𝘁 𝗝𝗼𝗯 𝗢𝗳𝗳𝗲𝗿: A top executive receives an email from a "headhunter" with a lucrative job offer, but first needs to provide personal information and pay a fee for the opportunity. These are just a few examples of the many ways cybercriminals can target high-level individuals in an organization. How is your company mitigating the risks of whaling attacks? #PhishingScams #WhalingAttacks #Cybersecurity

1

Excellent commentary on the need for technical understanding as necessary for GRC. Key point here is UNDERSTANDING not necessarily EXPERIENCE, though it certainly helps.

7

1 Comment

For 2025, I've noticed a lot of hiring trends month over month. The different buckets of cyber security spiking and dipping. From what I can tell there's going to be an influx of CMMC and FedRAMP folks entering the market, and more service providers applying for 3PAO status. The good news is there will be more readily available auditors and assessors for companies to access, the cost of assessments could potentially become more competitive with more access, and bias could be eliminated from the auditors working with the clients that also utilize them for remediation. Since September, the number of GRC and IT Audit positions coming onto the market has spiked. The need for someone who can design frameworks more than simply test controls is rising. We've already started to see companies begin to bring security back in-house. Saas starting to recognize developers can't be liable for creating secure code. We weren't taught to grade our own homework. The rise of App/Container Sec? I wonder, what will trend in Q1, 2025? #Cybersecurity #ITRecruiting #MotionRecruitment

36

9 Comments

🤔 Well said Help Net Security “The tool excels in distributing software across various secure development settings, including edge and embedded systems, secure clouds, data centers, and local setups.” “Zarf simplifies deployments into a single compressed file containing everything your app needs. It can be installed without an internet connection. Its declarative approach ensures consistent application deployment every time. The tool can also incorporate legacy code into modern DevSecOps environments, facilitating deployment.” https://lnkd.in/eRwgmKwG

57

2 Comments

Why I haven't had a CISSP in years: 1. Annual Maintenance Fee (AMF) Cost: $125/year 2. Conference Attendance Cost: $4,000/year (This is average, I've seen costs as high as 15k for BlackHat or RSA) This includes travel, accommodations, and the conference fee for events like RSA, Black Hat, or other security conferences. 3. Additional CPE-Related Expenses Cost: $1,200/year (there is always 2-3 credits you have to make up) Includes paid CPE options like courses, certifications, or materials. Total Annual Cost Estimate $125 (AMF) + $4,000 (Conference) + $1,200 (CPE) = $5,325/year average costs. Yes the AMF is reasonable; read the requirements some time. Companies don't pay for this; I do. If they did I would have it. If you require a certification; be sure to include a budget to cover the ongoing costs associated with maintaining them. The top 5 industry certification requirements are :: Aviation (15k a year), Finance (10k a year), Medicine (12k a year), Cybersecurity (5k a year), and Law (1500 a year) The only one of these that pays more than 90% of what I make is aviation and their certifications are included in their job duties (its a part of their package generally) and are fully funded by the companies. Finance can see 7 digit returns per year, doctors and lawyers can as well and those can be expensed to the firms or hospitals they work for. Where is my 7 figure job for maintaining the CISSP? Who is paying to maintain it? If someone offers me that position; I'll get it again and maintain it for as long as you need; Short of that; you really shouldn't require someone to maintain a CISSP for any reason.

55

76 Comments

The easy way to double your pay: Step: 1: Become an Internet scammer. Step 2: Rescam your victims.   I’ve read about this type of fraud in the past but it’s reared it’s ugly head again. Unfortunately, seniors are the most frequent victim of this tactic. But I don’t see why this couldn’t also happen with businesses.   This is how it works: After a "successful" scam, the bad guys impersonate a trusted group and contact the victim, claiming that for an up-front fee, they can recover a portion of their losses.   Or even worse, they contact a victim impersonating another victim and claim that they were able to recover funds using a fake recovery service that the bad guys control. The actual victim believes they received a valid reference and proceed to use the fake recovery service.   If you, your business, or someone you know, is a victim of a scam, be wary of anyone other than your own insurance company offering to help recover costs.

3

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

If I'm a bad actor and I'm seeking hard targets or Cyber ones, I'd actively look at organizational security cultures that ooze "We've always done it this way." or "No one's ever tried that before." or "We'll never get budget approval for that." Not hard to do.

6

I didn't expect there to be "Enterprise Browser washing" (like SASE-washing) so soon, but it's here. As a customer, when you're looking for enterprise browser solutions don't just scratch the surface and take what is said by the presenters at face value. Dig deeper. Understand what the solution is and isn't and whether it really meets the use cases identified or its just glossing over the technology. Understand whether the solution offers a low-friction cohesive offering or if there's just some products or features slammed together. We shouldn't tolerate things like this anymore. Customers deserve better.

9

Cyber Fraud Alert:  The caller stated, "We are from the cybercrime department. Your personal information is on the dark web. Please report this within two hours." If not, we'll file a lawsuit against you. Press 9 for reporting. Use Chakshu, the government's Suspected Fraud Communication Reporting Portal, if you come across such a situation or start receiving fraud calls. https://lnkd.in/dpiDqQaJ Other Useful Links - Block your lost / stolen mobile  https://lnkd.in/dBRuuSCM Know your mobile connections  https://lnkd.in/d_GPDiUf Know your mobile / IME verification  https://lnkd.in/dh-fusV9 Report incoming international call with indian number https://lnkd.in/d-JWyc-Q Vijjayy Kale #cybersecurity #awareness #cybercrime #sancharsaathi

9

Missed day 10, but here's Day 11 - Sharing a unique perspective on the debate surrounding the coding skills required for testers. As a former developer, I believe strong coding skills are not mandatory for testers, but they can certainly be beneficial. The key to excelling as a penetration tester lies in possessing a relentless drive and a great deal of patience. Testing demands time, diligence, and resilience. It's frustrating as a former dev to see developers who prioritize system performance over critical factors like functionality and security. Remember, performance ranks third in importance - functionality and security take precedence. #SoftwareTesting #QualityAssurance #TechInsights

5

3 Comments

In the past year, I've spoken and worked with dozens of senior security professionals who found themselves navigating a job market they didn’t recognize.   These are individuals who never had to actively seek their next opportunity, often fending off recruiters like myself with fresh opportunities.   Helping people overcome these challenges with more confidence and clearer direction has become the primary focus of my coaching and career search advisory practice.   If you're someone who feels completely stuck, out of ideas, and looking for direction, please reach out to me. I can explain the changes in the market, share proven strategies to overcome them, and provide you with the tools you need to take more control over your career destiny.   If you’d like to schedule a 30-minute exploratory call, message me here on LinkedIn, send an email to jeff@combssearch.com or see if any of my current availability works for you. https://lnkd.in/eXy9TZuy #CybersecurityJobs #CyberSecurityCareers #InfoSecJobs #CyberSecurityOpportunities #InfosecCareers #CareerCoaching #CareerAdvice #CareerGrowth #ProfessionalDevelopment #CareerDevelopment #PersonalDevelopment #SelfImprovement #SkillBuilding #GrowthMindset #getunstuck #pathfinder #developingleaders

32

I'm asked from time to time, "How did you get started in Information Security?" I will tell you my story, and if you like, tell your "origin story" as a comment. My Information Security "origin story" started over 15 years ago when I was a software development contractor coming off of a large systems re-engineering project for an international manufacturing company. I was looking for something different in my next job. At an earlier role as a software tester, it was fun finding the vulnerabilities in software, discovering how to break and then fix software. A "large aerospace company in the Seattle area" needed a software contractor within their network perimeter security group. The interview was a great match of skills to need and I accepted the gig. The role morphed into testing custom and COTs software for vulnerabilities before being used by several major aircraft programs. I changed from contractor to permanent employee. Soon after, I formed the company's first application security team, formalizing it into a program, for testing apps and sharing approaches to secure coding. Along the way I completed a Master of Science Degree with a focus on Information Security (long before formal security degrees appeared). After 10 years at that company, I left to create a software security program from scratch at a different company. And, as they say, the rest is history. . . What's your "origin story"?

2

1 Comment