|
|
Post by Trowel 🏴 on Apr 4, 2023 17:39:06 GMT
Product Managers aren’t Project Managers. Yah. I’m Product Owner for our forensic tooling and processes. It’s just business speak wankery for ‘person responsible for’ Product Owner is a Scrum role responsible for the product backlog. Product Manager is responsible for the product. Get yourself a job title upgrade. |
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 4, 2023 17:52:37 GMT
I’d rather not have anything to do with it at all. I got tricked into it pretty much. I don’t mind owning the processes but all the paperwork around the tooling is a nightmare. I do not give a fuck about license renewals and support agreements.
|
|
ozthegweat
New Member
Releasing indirect freedom
Posts: 873
|
Post by ozthegweat on Apr 4, 2023 18:01:25 GMT
And Ui/ID folk are fucked. As they should be. What did they ever do to you? |
|
|
|
Post by jeepers on Apr 4, 2023 18:07:30 GMT
And Ui/ID folk are fucked. As they should be. What did they ever do to you?  There are some awesome UI folk who are invaluable. And then there’s all the rest who think research is an option and that spending three weeks futzing in Figma is strategic. I have a few too many of the latter. |
|
ozthegweat
New Member
Releasing indirect freedom
Posts: 873
|
Post by ozthegweat on Apr 4, 2023 18:32:30 GMT
Yeah dribbble design circlejerk is a problem. I don't consider research as optional, but I don't get any budget or time for it, and if I had the time our clients wouldn't let us near users and either tell me they would tell me what to do or if something was wrong, and/or insist I just ask them (AKA the people from the client's IT department that don't use our software and have a different profession and have not even heard of things like contextual inquiry, personas or usability walkthroughs and don't care about their users) and even if I had access and would be able to identify issues I don't get any budget or manpower to fix those.
|
|
|
|
Post by jeepers on Apr 4, 2023 19:05:09 GMT
I feel your pain. That makes the job tough.A really good UI person is an amazing addition to a team. Mediocre ones tho? Oof.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 6, 2023 8:51:51 GMT
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 11, 2023 9:11:57 GMT
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 11, 2023 10:00:30 GMT
This is always the answer to the 'if youve got nothing to hide, youve got nothing to fear' lot. I dont want idiots to have information that could be used to bring my life down.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 11, 2023 11:09:57 GMT
This is always the answer to the 'if youve got nothing to hide, youve got nothing to fear' lot. I dont want idiots to have information that could be used to bring my life down. Well, indeed. I've only ever actually heard that said by Tories and idiots (venn: intersects) anyway, tbh. Because no one's ever been wrongly accused of or prosecuted for anything, ever... for example.
Anyway, the Capita thing really is a textbook case, though. Specifically, how they:
1) Denied it 2) Suggested it was an internal IT problem 3) Admitted it was a hack, but said only affected some 365s 4) Admitted that it was a ransomware, but said no customers were affected 5) Had to backpedal and admit that some customer data is affected after it was made clear by 3rd parties that this was the case.
I understand why companies and service providers are wary of admitting they've been gotcha'd, but it never ends up well. It always looks worse when they finally have to publicly admit the breadth of the breach.
All that money they get from the government and they're still absolutely fucking useless.
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 11, 2023 11:36:23 GMT
It was a tune Labour also used to play when they went full bore surveillance state, to be fair. They were actually even worse than the tories on that front.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 11, 2023 11:43:20 GMT
I did say "Tories and idiots", which I think covers Blunkett, Blair et al. |
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 11, 2023 13:34:42 GMT
We do ransomware readiness exercises quite regularly. Scenarios, drills and table tops and all that.
We had a guest speaker from a fairly big firm that was hit and his advice was ‘just pay it’. They wanted 1.5m which they refused to pay only for the final cost for return to service, after six months of absolute hell, to be nearly seven million.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 11, 2023 13:50:32 GMT
Us too, as part of regular testing. I think it's a far better idea that the other options, too...
As for paying, fair enough I suppose, that's their choice... but that's specifically against NCSC and ICO's guidance and there's plenty of examples of people paying and not having their data unencrypted or being immediately attacked again because its now known that they'll pay. Not to mention the possibility that some places (US mainly, but Europe and ME too) are now considering it aiding and abetting a criminal enterprise to do so. |
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 11, 2023 13:59:19 GMT
The point he was making, really, is that the ransom should costed into the overall recovery. If they dont decrypt youre, in this instance, down 8 rather than 7 million but if they do decrypt thats a whole fuck load of time and money better spent on making sure it doesnt happen again.
It is against guidance and against everyones first instinct but, yeah, he made a lot of good points in terms of risk/reward. A chance you get back on your feet quickly Vs 'This is definitely going to take months'.
|
|
zagibu
Junior Member
Posts: 1,971
|
Post by zagibu on Apr 11, 2023 14:57:55 GMT
That guy was probably part of the scheme. You NEVER pay. Everybody who pays is only boosting this fucking cancer.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 11, 2023 15:14:14 GMT
The point he was making, really, is that the ransom should costed into the overall recovery. If they dont decrypt youre, in this instance, down 8 rather than 7 million but if they do decrypt thats a whole fuck load of time and money better spent on making sure it doesnt happen again. It is against guidance and against everyones first instinct but, yeah, he made a lot of good points in terms of risk/reward. A chance you get back on your feet quickly Vs 'This is definitely going to take months'. Don't get me wrong, I'm not saying he's wrong (I wasn't there either for his talk or his business' issue, for a start!), but more that I suppose that's a decision everyone has to make individually. I'd be interested to know what their preparedness status was. Did they have mitigations in place and a BCP, for example. It's not (paying) considered a mitigation to having to announce data loss by the ICO, so it won't protect you from any potential reputational damage either. Not being properly prepared is a shitshow, eh? Another interesting thing which has me learning new stuff is that a lot of our product devs are moving away from the more traditional types of architecture and into things like serverless (CaaS/FaaS/Lambda etc) for ephemeral applications which if it's done properly looks like your more traditional "give me BTC!" ransomware might have issues with. Obviously, it's not immune to vulnerabilities (poor segregation, stolen credential issues etc) but it's not as likely to be encrypted by malicious actors because you can just turn it off and spin up another instance from your templates which are elsewhere. Presumably, they'll catch up to that sooner or later. |
|
zagibu
Junior Member
Posts: 1,971
|
Post by zagibu on Apr 12, 2023 8:11:17 GMT
Serverless architectures usually also have better security, because they are running in data centers that actually know how to do security. Of course, the application level is still your own job, but it already gets rid of a lot of attack vectors.
|
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 12, 2023 8:13:29 GMT
That guy was probably part of the scheme. You NEVER pay. Everybody who pays is only boosting this fucking cancer. If you dont pay, there is 100% chance you dont get your files unlocked. Im not saying 'always do it' but to rule it out completely is pretty dumb in certain situations. |
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 12, 2023 8:22:07 GMT
Don't get me wrong, I'm not saying he's wrong (I wasn't there either for his talk or his business' issue, for a start!), but more that I suppose that's a decision everyone has to make individually. I'd be interested to know what their preparedness status was. Did they have mitigations in place and a BCP, for example. Its the old 'everyone has a plan until they get punched in the face' thing. Looks great on paper, not so much in practice. - can your build room actually churn out that many laptops a day? - can your server team actually rebuild that many servers a day? - are all the break glass accounts actually working? And so on and so forth. It was a long ass presentation and they seemingly did everything right, its just that doing it 'right' took fucking ages because they are a big org, same as us. Paying obviously is not a magic bullet and there is still a long road and hard work left but it lets you skip the most arduous part. |
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 12, 2023 8:24:19 GMT
Serverless architectures usually also have better security, because they are running in data centers that actually know how to do security. Of course, the application level is still your own job, but it already gets rid of a lot of attack vectors. In the traditional hardware sense, sure. But you still need to have it properly designed and setup, or there are a whole host of new vectors.
Eg:
|
|
zagibu
Junior Member
Posts: 1,971
|
Post by zagibu on Apr 12, 2023 8:31:40 GMT
Yeah, true, if you have a team that is new to serverless, it can actually lead to less security, because they don't know how to use the infrastructure.
|
|
askew
Full Member
Posts: 6,831
|
Post by askew on Apr 12, 2023 16:21:25 GMT
Has anybody had the 'pleasure' of creating a WordPress theme using 'Blocks'?
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 17, 2023 16:14:19 GMT
Spent a decent proportion of the afternoon on a conference call with a local Head of IT who can't quite grasp that his new application absolutely IS going to be thoroughly pen tested before it goes live, that it's not a "well, we might", but actually a "this is happening".
There's definitely not going to be anything to worry about here, they'll have done everything absolutely 100% by the book, right?
|
|
ozthegweat
New Member
Releasing indirect freedom
Posts: 873
|
Post by ozthegweat on Apr 17, 2023 20:33:28 GMT
Spent a decent proportion of the afternoon on a conference call with a local Head of IT who can't quite grasp that his new application absolutely IS going to be thoroughly pen tested before it goes live, that it's not a "well, we might", but actually a "this is happening". There's definitely not going to be anything to worry about here, they'll have done everything absolutely 100% by the book, right?  |
|
Bongo Heracles
Junior Member
Technically illegal to ride on public land
Posts: 4,666
|
Post by Bongo Heracles on Apr 17, 2023 20:57:01 GMT
I spent all afternoon in a meeting with people trying to work out what our potential exposure to Capita having their pants pulled down might be. Yay, outsourcing.
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 18, 2023 8:16:20 GMT
I spent all afternoon in a meeting with people trying to work out what our potential exposure to Capita having their pants pulled down might be. Yay, outsourcing. But it's a "case study in how to handle Cyber incidents"! They didn't even report it to the ICO, surely it's not going to cause any problems???
/s just in case
|
|
dogbot
Full Member
Posts: 8,738
|
Post by dogbot on Apr 18, 2023 8:16:51 GMT
|
|
minimatt
Junior Member
hyper mediocrity
Posts: 1,693
|
Post by minimatt on Apr 28, 2023 22:54:12 GMT
courtesy of b3ta, given the demographic guessing we're all old b3tans here
anyway, a hundred years ago as a lowly cisco certified network professional I was briefly engaged in a war with the ten year olds of oxfordshire LEA. reassuring to see the war is global and eternal, and the ten year olds are still winning
|
|
ozthegweat
New Member
Releasing indirect freedom
Posts: 873
|
Post by ozthegweat on Apr 29, 2023 11:21:59 GMT
Ha! I remember playing Snake and Solitaire on my TI-86. Good times.
|
|
