JL Mitra

Audit readiness ≠ security readiness. They overlap — but they’re not the same thing. Audit readiness answers: “Can we prove we did the thing?” Security readiness answers: “Would the thing actually stop or detect the attack?” What audit readiness looks like: • Policies exist (and were reviewed). • Tickets show approvals happened. • Screenshots show a setting was enabled. • A sample of logs is attached. • A quarterly access review spreadsheet is signed. What security readiness looks like: • The control fails loudly when broken (alerts/tickets). • Coverage is continuous, not point-in-time. • Exceptions are time-boxed and tracked. • Owners have SLAs to remediate failures. • Incidents map back to scenarios (risk assumptions get updated). ⚠️ The common trap: We collect evidence that looks great… for controls that can still break silently. 💡 Practical move (do this with one control this week): Pick one “audit-ready” control and add one “security-ready” signal: • “Vulnerability scans completed” → Alert on critical vulns aging past SLA (e.g., >14/30 days). • “Backups exist” → Proof via restore test results (last restore date + time-to-restore). • “Security training completed” → Measure behavior: phishing failure rate trend + high-risk repeat. That’s how you satisfy audits and reduce real risk. Your leading question should be: “Would this control work on a bad day?”

7

Pricing pressure is real. So is scope creep. If your MDR includes EDR + SIEM + IR + ‘always‑on’—but your fees haven’t kept pace—you’re subsidizing client outcomes. 4 moves to rebalance value: 1) Convert to outcome SLAs (MTTD/MTTR) 2) Right‑tier your tasks (nearshore Tier 1/2) 3) Follow the sun (offshore nights) 4) Entitle IR hours instead of ‘unlimited’ promises Margin follows structure. Structure the work to win. 🔗 Link in the comments ⬇️👇 #MDR #Pricing #SLA #Margins #Cybersecurity

21

2 Comments

Rooting the Blackpearl Machine (TCM Security) In this step-by-step walkthrough, I demonstrate how a virtual host misconfiguration led to full system compromise — exploiting Navigate CMS v2.8 for RCE and escalating privileges via a misconfigured SUID binary. A solid reminder that small misconfigurations scale into total compromise. #CyberSecurity #PenetrationTesting #EthicalHacking #WebSecurity #RedTeam #CTF

5

1 Comment

With less than a month remaining to submit for the Seattle Bsides Security Conference, I'm hosting another AMA focused on CFPs. Feel free to ask any questions you've had about CFP submissions in the comments below. In the meantime, here are some quick tips to enhance your submission: 1. Read all the directions carefully. 2. Avoid generic submissions; a one-sentence description for your abstract won't suffice. Provide enough detail to give reviewers a detailed understanding of your topic. 3. Include outlines and learning objectives to clarify your message. While optional, they can significantly strengthen your submission. 4. If examples are provided, review them, but remember that simply mimicking them does not guarantee acceptance. 5. Seek feedback and be prepared to iterate on your submission. Looking forward to your questions! #bsidesseattle #cfp #ama

68

1 Comment

I still see “risk-based” programs operating like traditional VM with more scoring layered on top. Severity shows what exists. Risk suggests what might matter. Exposure shows what attackers can actually use. This checklist is a quick way to see where your decision model actually sits. Swipe through. Strobes Security, Inc. #ctem, #rbvm

21

3 Comments

Here’s a pattern I’m seeing more often: More sites. More assessments. More reporting expectations. Same headcount. Security teams are being asked to scale output without scaling structure. So what happens? Assessments become episodic. Reporting takes too long. Prioritization becomes subjective. And leaders spend more time translating risk than reducing it. This isn’t a capability issue. It’s an architecture issue. At some point, physical security has to operate with the same operational discipline as finance and IT. Otherwise it stays in permanent catch-up mode. For security people overseeing medium to large portfolios (20+ sites): What’s currently your biggest bottleneck volume, visibility, or validation? And why do you think this is?

5

1 Comment