Adam Hassan

Jason Blanchard, I appreciate the shoutout! For those unfamiliar with Jason, he creates exceptional content on the soft skills essential for success in cybersecurity, especially in his "Job Hunt Like a Hacker" series. Recently, two individuals contacted me for more information after watching his video. I always cherish the opportunity to assist and guide others in their career journey. See my mention and Jason's talk in the link below!

25

2 Comments

🖋️ Best Penetration Tester Resume 2024 (Templates & Examples) This article offers an in-depth look at what makes a great penetration tester's resume. We've covered elements from essential sections like certifications, experience, and education to tips on what to include (and what to leave out). We provide actionable advice on effectively showcasing your skills and knowledge, helping you meet and exceed employer expectations. Additionally, we include specific examples for each section and a complete resume template to help you present your qualifications most compellingly. Read more👉 https://lnkd.in/ghwjuC2z

27

It's been a few months since the release of NIST CSF 2.0. The release provided an excellent opportunity to observe how our standards and frameworks evolve right alongside of evolving security threats. My team and I have been working to align with CSF 2.0, and here are my biggest takeaways. 1️⃣ The introduction of the “Govern” function emphasizes the importance of establishing a strong governance framework for managing cybersecurity risks across an organization. While elements of governance, such as leadership commitment and risk management strategies, were already apart of CSF 1.0, they are now explicitly addressed within the Govern function. This inclusion highlights the critical role of leadership in fostering a culture of cybersecurity and it ensures that governance is given the attention it deserves in organizational cybersecurity strategies. 2️⃣ The expanded scope is one of the most significant changes. While CSF 1.0 focused on critical infrastructure, version 2.0 is designed to be relevant to organizations of all sizes and across various industries. This shift is signified by the removal of "Critical Infrastructure" from the framework's title. By broadening its applicability, NIST acknowledges the increasing cyber threats faced by all sectors, enabling a wider range of organizations to leverage the framework's guidance in developing cybersecurity strategies. 3️⃣ Because high-profile cyber attacks targeting third-party vendors have exposed vulnerabilities, CSF 2.0 has also enhanced its focus on supply chain risk. CSF 2.0 encourages organizations to assess the security posture of their vendors and implement safeguards to mitigate potential risks. 4️⃣ CSF 2.0 also shifts the approach from a one-time assessment to a continuous improvement model. Organizations are encouraged to regularly review and update their cybersecurity practices to address new threats and vulnerabilities. This was my first experience utilizing and becoming familiar with a framework and then having to review and apply revisions. So far so good though! #GRC #SecurityAwareness #NISTCSF #InfoSec

46

2 Comments

For those that are curious how to break into the security industry and land yourself that dream job, Jonathan Todd outlines the playbook driving by curiousity and vulnerability. A resume, certifications and eduction become irrelevant when you consistently engage and add value back to the security community. 🤙 #cybersecurity #infosecurity #securityjobs

17

1 Comment

🤔 Would you trust an AI to assist with secure code review? 🤔 👉 Let me know, why or why not? I'm completing a capstone project for my Master's in Cybersecurity at Georgia Tech on integrating AI into secure code reviews, and I have created a short survey on the topic. I would love to hear your thoughts, and hear any stories of successes or failures for anyone who has tried this so far. ✨ If you have just a few minutes, please take the survey, and share with other members of the AppSec community. Thank you! Survey Link: https://lnkd.in/eP3DP_Bn

21

2 Comments

Hey LinkedIn Community, I just took the CNSP exam and passed with merit. I want to thank the The SecOps Group for this opportunity. The exam covered diverse topics and wasn't too hard, but having basic and intermediate knowledge of networking and protocols is essential. It also included questions about ports, their TCP and UDP versions, and how they react when behind or not behind a firewall. Additionally, Windows and Linux topics were well covered. There were two questions on topics I hadn't encountered before, which made me realize the importance of those subjects. It's a lesson that nothing is less important in security, and the most dangerous attacks can come from unexpected areas. There was also a question (number 32 for me), about hashing algorithms. I'm confident there was no correct answer, so I chose "blowfish" instead of "bcrypt." I believe it was a mistake in the question, as "bcrypt" seems more appropriate. Additionally, other options technically fit the question, but they don't have the same properties or criteria for identification. I hope The SecOps Group will take a look into this matter. Overall, the exam was well-made, and I'm grateful for the opportunity. Keep learning and growing in your careers! Best wishes for success and good health to everyone.

35

5 Comments

Hi Purple Teamers! For those looking to expand their knowledge and skillset in cybersecurity, I came across an invaluable resource: "50 Methods for Dump LSASS". This comprehensive guide delves into various techniques for extracting credentials from the Local Security Authority Subsystem Service (LSASS), an essential aspect of Windows security. Don't miss out on this opportunity to enhance your understanding and expertise. Check out the link below: #APT #malware #Cybersecurity #InfoSec #PurpleTeam #LSASS #Security #mimikatz #redteam #blueteam #lsass #ftk #sharp #redteam #redteamrecipe #privilegeescalation #activedirectory https://lnkd.in/dj_VbUEb

82

1 Comment

Something that should be more widely accepted is that cybersecurity degrees are not a general measure of an individual's ability. All they're worth is what they teach you on your own personal journey, and I truly believe that anyone who says otherwise just has some type of gatekeeping-related mentality. The problem with a ton of the degrees is that they're great for theoretical knowledge, but when it comes to the practical application of that knowledge, there's a massive disconnect. This isn't true for all college or university degrees; I'm sure there are some great ones, but for the vast majority of them, it's true. Yes, they're great at teaching you the differences between TCP and UDP or what the CIA Triad model is, but when it comes to roles that don't just involve running Nessus scans all day for checkbox exercises, you're going to need some form of practical technical ability. I don't think cybersecurity degree classes teach that enough, so they're best combined with practical learning. I've met some people who have cybersecurity degrees and they're exceptionally talented, and then you have others with a similar degree who just hide behind buzzwords all day and haven't got a clue what they're talking about and genuinely shouldn't be in the role that they're in. The difference is literally that individual's own personal journey and what they did outside of that degree. If you require a degree for cybersecurity roles at your organisation, then you're missing out on some of the best talent in the industry.

401

36 Comments

🚜 Lab Setup Update: My Journey with Harvester Installation 🚜 Hope everyone is doing well and staying secure! 🔒 I wanted to share something super cool that I’ve been working on this week—installing and configuring Harvester. If you haven’t checked it out yet, Harvester is this awesome open-source Hyperconverged Infrastructure (HCI) solution that I’m using as a replacement for VMware. 🛠️ Step-by-Step Guide: For anyone interested in giving it a go, here’s the official Harvester installation guide I followed: https://lnkd.in/eTYW6wJV 🌟 What I Loved About It: 1. Easy Installation: Surprisingly straightforward to set up. 2. Versatility: Great for running multiple VMs and different storage solutions. 3. Community Support: There’s a fantastic open-source community backing it and it’s open source components(Rancher, KubeVirt, etc) 💬 Let’s Chat: I’d love to hear from you all: • Have you tried Harvester yet? What did you think? • Any other HCI solutions you’re excited about? • Got any tips or tricks for the community? • Any automation tips for migrating OVA/OVF to KubeVirt? Looking forward to your thoughts! P.S. I’m working on a little walkthrough for installation and configuration to support certification prep. Stay tuned!

3

This was a short bit ago, but Canvas wasn't letting me share it at first. I need more practice! However, I definitely learned some new crypto stuff on this one, and brushed up on some Python. If you know of any CTF's happening, let me know... "Congratulations! You participated in the Season IV, US Cyber Open Capture the Flag (CTF), where you competed on a number of challenges designed to assess your level of cyber skills in cryptography, reverse engineering, PWN, forensics, and web security." #CTF #cybersecurity #uscyberopen #geeklife

17

16 Comments

Day 1 of the Physical Audit Training with the Covert Access Team and Brian Harris is done, and let me tell you it was amazing! I have learned not only about planning and reconnaissance of a Physical Assessment but also a lot about doors, door handles, and locks (and how to open them of course). But a cherry on top was the part on miscellaneous cameras and ways to obscure the view or blind them. That training helps me get into the #hackermindset and think not only as an #attacker but also as an #auditor sharing his pearls of knowledge and guidance to the audited companies on what to pay bigger attention to. I loved the group work tasks, and I felt really happy being among such smart people with the same interests and passions. It was that togetherness feeling, and I think it's beautiful. As homework, I am supposed to find the vulnerabilities in my neighborhood, but I need to admit that this forest is absolutely perfect. So, having that out of the way I am now off to learn the tabs of Evidence (by Faith no more): "If you want to open the hole Just put your head down and go Step beside the piece of the circumstance Got to wash away the taste of evidence" Today I am a giant sponge of learning :) #learningeveryday #nevergiveup #covertaccess #physicalaudit #thiswasanamazingexperience #hackermindset #recon #hacker #physicaltesting

71

20 Comments

Current study list while in military - C Language ☑ - C++ - Lua - Cybersecurity My goal for the next 9 months inside military is to improve on those 4 languages.

1

I saw a poll for how many people have heard of the Mitre Attack Framework, and I’m surprised actually, that there are people in Cyber who haven’t heard of it before. So if you don’t know what the framework is, this is a basic overview. I recommend getting to know it through Mitre’s MAD program and certifications. They are amazing for gaining a broader perspective on it. The Mitre ATTACK Framework is a series of tactics, tools and techniques that threat actors use, as well as TA groups, individuals, software, and mitigation solutions to those TTPs.(Tactics, Techniques and Procedures). Many researchers, analysts, and other people in the industry use this framework to identify potential threats in their environment and see where they are coming from. They will take the TTPs that they see in the environment and map them to the framework to gain better understanding. Navigating the framework can look intimidating at first, but I recommend going to the website itself and kind of familiarizing yourself. For example, perhaps you see someone in your environment trying to dump potential passwords from LSASS with Mimikatz. This is part of the technique, “OS Credential Dumping”, under sub-technique “T1003.001”. (Link: https://lnkd.in/eEMS2mkW) EDR tools such as SentinelOne will use Mitre ATTACK as part of detection engineering, to help analysts identify adversary operations in a client environment. This is just a basic overview of the many TTPs that Mitre ATTACK lists on their website. Go there, play with it, and gain some understanding. I hope this helps a bit. #mitreattack #adversaryoperations #threatactors #cybersecurity #securityoperations #securityresearcher #knowledgesharing #blueteam #redteam

10

3 Comments