I often get asked to weigh in on the value of cert X or training/cert company Y.
IT and InfoSec are broad. Too many folks get siloed or disappoint themselves by not first selecting a reasonable goal and working backwards. We need to be purposeful about our studies and efforts by ensuring they align with our goals. Otherwise, we’re just wasting time.
If you’re interested in cybersecurity, check out this info-graphic. Find that swim-lane you’re after and go get it. https://pauljerimy.com/security-certification-roadmap/
On Tuesday, I’ll be discussing securing internal DNS infrastructure and some tips and tricks to effective monitoring of Windows Server DNS. It can be surprisingly challenging to get right. #conferences http://www.theitsummit.com/event/seattle-fall-2018/
A few times each year, a thread pops up bashing the certification industry, mocking organizations requiring certifications for job applicants or contract opportunities, or using brain-dump test takers as the barometer for those with industry certs. Many, if not most of the arguments are valid in their specific contexts. Hiring or contract awards should not rely on certifications to prove a prominent level of competence. However, certifications do provide value in several areas that are often dismissed or ignored and can bring immense value to the IT and InfoSec industries.
I had a great time in Portland sharing personal and small business security tips and tricks with the Springwater Group at Morgan Stanley. The Multnomah Athletic Club has quite the view. Thanks to Doug Moshofsky and his team for the opportunity.
This is a strong article on learning and deliberate practice with many takeaways. Great book recommendation too: Deep Work: Rules for Focused Success in a Distracted World
Some of my favorite reminders:
The Law of Productivity: High-Quality Work Produced = (Time Spent) x (Intensity of Focus) Don’t make the mistake of confusing productivity with busyness. Doing lots of stuff in a visible manner does not mean you’re being productive. The rule of thumb is that it takes approximately 25 minutes of focus without distraction to reach a state of flow. If you’re checking your Twitter notifications every 20 minutes, which seems harmless, you prevent your brain from reaching that state and therefore prolong the time required to complete your task. Deliberate practice cannot exist alongside distraction. Too often, we assume we are getting better simply because we are gaining experience. In reality, we are merely reinforcing our current habits — not improving them. Our culture loves the story line of the prodigy and the notion that experts possess an inherent talent that separates them from everyone else. But in reality, to master a cognitively demanding task requires this specific form of practice. https://azeria-labs.com/the-importance-of-deep-work-the-30-hour-method-for-learning-a-new-skill/
Over the weekend, I updated my wireless router to the latest revision of ASUSWRT-Merlin. I also decided to update my DietPi Pi-hole to their latest builds. Due to a full code rewrite of Dietpi, it meant a complete rebuild for that system. The release of ASUSWRT-Merlin also suggested resetting to factory defaults due to some major changes. Everything was about to be new again.
Once I got everything rebuilt and running, I noticed requests coming from my firewall to my dietpi every 10 seconds or so for dns.msftncsi.com. I immediately assumed this was some Microsoft telemetry noise on my network from MS NLA. However, the queries were coming directly from my firewall which seemed odd. Another search led me to a post on the Pi-hole discourse. After I ran nvram show | grep dns_probe, it was clear I found the culprit.
This afternoon, I’m attending the funeral for a coworker we lost last weekend. Over the course of the next week or two, we’ll be assisting his family gain access to the many online services he had managed. Each time I’ve experienced a tragedy like this, I’ve seen the families struggle with the digital footprint and account access of their lost loved one. Like life insurance, emergency access to online services is too often an item on our to-do list, rarely ever getting completed. Password managers help families in these situations. They act as a consolidated list of the accounts making up one’s digital footprint. However, if emergency access has not been set up, they provide no help and access becomes a major hurdle to overcome for a grieving family.
Tired of seeing What’s happening now? in the Lync client. Sick of seeing the same old status update because you or your colleagues never pulled down that holiday message or #GoHawks update? Well, I was sick of it. I wanted a quick and dirty way to automate updating the Lync status message (aka ProfileNote).
After hours of scouring the internet and messing with multiple twitter libraries and outdated twitter code, I ran across this gem by Github: MyTwitter.psm1. While it was meant to post to twitter, a bit of hacking and this was born. Coupled with some other Lync Client work I’ve done, I had a workable solution.
A couple tweaks I found necessary for the new 9926 build of Windows 10.
1. Windows Update failed with error 0x80070057 preventing the install of update KB3034229. The Fix:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX] "IsConvergedUpdateStackEnabled"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings] "UxOption"=dword:00000000 2. Only two size options for the updated start menu. Regular or maximized. This fix allows resizing of start menu to a custom size. However, it reverts the start menu back to the pre-9926 build style. Wish there was a compromise. I ended up just setting this to 1 and living with the lack of resize options.
I regularly bounce around on different networks and vpn connections. I got tired of manually setting the location in Lync and found myself just ignoring it altogether. After doing some poking around, I decided to throw a powershell script together to just do the dirty work for me.
The script uses Telize for geoip data and DNSOMatic Telize for the external IP. The script requires the Microsoft.Lync.Model.dll from the Lync 2013 SDK (15.0.4603.1000 as of this post). You can find the Lync Client 2013 SDK here.