Thank you Jerry!

No worries! Thank you for your work Jerry

I am currently transitioning into a Security role at work. One question would be: what are the must-have tools for every blue team?

• Vuln-Scanner
• Logging/ SIEM-Server
• ...

I am currently trying to organize my notes. The old 'system' is a pain, and getting everything centralized makes it easier to find things. Notes, snippets, bookmarks, and so on.

Thank you for the AMA.

Do you regularly feel overwhelmed? - Keeping up with the sec news and patch accordingly, firewall/ips and endpoint alarms, logs, meetings, and more. It shouldn't be the case, but it seems that everything in security is prio 1.

EDIT: and being the party pooper and saying no to everything, bc people do not think about security.

I am certain that we block ICMP on multiple FW in between. I could allow it temporary and check. Good suggestion.

Same here

Just ordered the Catalyst 26. Thanks again

Those bags are looking great! Having enough space for tools and a big water bottle. Cheers

It seems that I have to drive more often to the office again. Any bag recommendations? What is your favorite brand/ model?

Valid question. We've checked it multiple times, on the client and via monitoring that it is 10 Mbits. Thank you.

Learning things about Wireguard and implement it to secure my internet facing servers.

Testing a few CTF platforms to learn more about pentesting. It is interesting, but the learning curve is quite steep.

Fairly new too - why wouldn't you be able to answer if the post is set to 'Undetermined'. Haven't had any issues yet.

Ping - Update 2 @Avian_Carrier@infosec.pub @jharrison@infosec.pub @SgtKetchup@infosec.pub

I hope it is ok to ping you.

Small follow up - asked about bag recommendations like a month ago and went with the recommendation from Nasan@sopuli.xyz - Mystery Ranch Catalyst 26l - been really happy so far.

Not sure on the logging. I’m a data center guy and would rather see firewalls in the trash lol. They usually just cause problems.

Haha - I'd like to disagree, but you are right.

For the WAN, surely there is some way you can reach those sites over the general internet. You have ISP connections.

I for sure could do it, but it is not that easy to expose a server to the internet. There would be multiple departments involved and I need to get permission. And yeah, even with IP whitelisting. I guess that will be my last resort.

Still waiting for the test clients. Probably going to shift some hours into the weekend so I don't disturb daily business.

No worries, thank you for your input!

1. what logging/debugging would you activate for that case? - Not too familiar with Fortigate yet and would appreciate some tipps, IF you are familiar with those.
2. the IPSec tunnel is the only connection between these locations so it is rather difficult. But I get what you mean and check if there is another option.

Good points!

Not yet. Wouldn't expect it tbh, but you'll never know. How would you utilize Wirehuard for it? I'd like to hear more about it.

Exactly what I do if it does not work. Create post, go back, block.