this post was submitted on 18 Dec 2023
14 points (100.0% liked)
cybersecurity
3030 readers
2 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I am currently transitioning into a Security role at work. One question would be: what are the must-have tools for every blue team?
Here are some platitudes for you without knowing your life:
Learn concepts and not tools. Email links are your number one threat. Unpatched software is your number two threat.
You cannot defeat them, just slow them down.
Consider:
Go download NIST cyber security frameworks, read it. It's boring as hell, but tells you what the security program should do and checklists of things to cover.
Go Google DISA STIGs. You can download free GPOs and checklists that lock down about everything you have. Some are not public, most are. There's a CIS equivalent, also.
Implement system tiers, it's well documented, but hugely painful. No domain admins (DA) on anything but tier 0, no DAs or SAs on workstations.
Tenable Nessus is an example of vulnerability scanner.
Security Onion is an example of IDS.
Also: https://www.mitre.org/sites/default/files/2022-04/11-strategies-of-a-world-class-cybersecurity-operations-center.pdf