Infosec quotes - RODCs

“... Don’t add ‘Authenticated Users’ or ‘Domain Users’ to have their passwords cached on RODCs. If this is truly required, these RODCs should be viewed and protected in a similar manner to writable Domain Controllers...”

https://adsecurity.org/?p=3592

Infosec quotes - army philosophy

“... This philosophy will allow the Army to do iterative development within the technology space ... where solutions and capabilities are continuously changing...”

https://www.c4isrnet.com/it-networks/2017/12/18/armys-new-cyber-requirements-will-be-based-on-battlefield-needs/?utm_content=buffera25ae&utm_medium=social&utm_source=linkedin.com&utm_campaign=buffer

Infosec quotes - fake software updates

Let your IT staff install & update your software. If you get a popup or website that tells you to perform an update, don’t do it without first contacting your IT support. You may install malware instead.

“... fake update screens that appear  during the infection chain, inviting the user to open the downloaded file...”

https://www.proofpoint.com/us/threat-insight/post/kovter-group-malvertising-campaign-exposes-millions-potential-malware-and-fraud

Infosec quotes - web dev OWASP

If you are working with a web developer on a project and they are not familiar with the OWASP Top 10 and how to prevent them, then you should consider pausing your project and not coding any more until proper security training has been completed.

https://www.tripwire.com/state-of-security/security-data-protection/owasp-top-10-critical-web-application-security-risks-2017/?utm_source=dlvr.it&utm_medium=linkedin

Infosec quotes - weakest link

Remember your network is only as secure as your weakest link. For example don’t ignore the security hardening of printers or it could end up costing you. 

“... printer was configured to scan and save documents to the single WORKGROUP computer on the network... captured a hash from the printer for my target host... able to crack it and access the machine...”

https://www.doyler.net/security-not-included/stealing-hashes-printers-compromise-systems

Infosec quotes - Russia phishing

Like it or not attackers still choose the sending emails as the way to hack into your company. Think before you click.

“... techniques have remained largely unchanged ... still relies heavily on the use of ... phishing emails to try and get targets to click on links that lead to malicious domains or to download malware...”

https://www.darkreading.com/attacks-breaches/russias-fancy-bear-apt-group-gets-more-dangerous/d/d-id/1330702

Infosec quotes - Oracle web logic

If you support Oracle Weblogic you should’ve already patched this one in October.

@hkashfi says “... Oracle WebLogic ... CVE-2017-10271 & CVE-2017-3506…It's already being exploited in the wild....”

https://mobile.twitter.com/hkashfi/status/944665602911801347