i have to put this out here.

my company was involved in a huge exercise in implementing SIEM (google that) in sensitive government agency to circumvent hacks, breeches, compromising third party apps/system/, etc etc. problem was, after dah built the war room and everything - sure can start seeing where were the holes was, mana network components yang tak hardened, the govt it self has no SOP or how-to to fix these holes. the easiest was to tutup the server yg compromised but nobody knows how to fix server without formatting the whole damn thing. itu senang, kalau network yg dah kena hack, jadi watering hole, they damn blur dont know what to do. so every night we can see la, like a bunch of data sampai 1GB keluar from the network to god knows where to god knows who. ada report but they themselves damn blur dont know what to do.

the new govt lagi champion, they suruh take down the SIEM. habis.

belum lagi targeted spoofing attack. but thats a story for another day.

This post has been edited by tareh: Feb 7 2019, 10:47 AM