• 6 Posts
  • 37 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle
  • Do a search for you server OS + STIG

    Then, for each service you’re hosting on that server, do a search for:

    Service/Program name + STIG/Benchmark

    There’s tons of work already done by the vendors in conjunction with the DoD (and CIS) to create lists of potential vulnerable settings that can be corrected before deploying the server.

    Along with this, you can usually find scripts and/or Ansible playbooks that will do most of the hardening for you. Though it’s a good Idea to understand what you do and do not need done.



  • So the ones I’ve seen were a combination of social skills/ emotional intelligence tests and the same type of questions you’d find in an IQ test.

    So having a degree shows you have the dedication to see your education through. Having a high GPA can indicate you delivered a consistent and honest effort. But the extra test (especially if it’s timed) can show how good you are at quick thinking. One test I took for a job, you would have about 20 seconds to answer each question if you wanted to get through them all.

    It can also gauge if you’re lazy (you guess your way through most questions just to get through them) or dedicated (take your time to answer each question correctly even if that means you won’t get through all 60 or so questions before the 20 minutes are up).

    The social skills/emotional intelligence tests (if that’s the right name for them) I’ve seen were basically matching faces to emotions and trying to gauge reactions to events.

    So for the “IQ” tests, they want people who are not only educated but swift thinkers (more PC way to say it).

    For the social/emotion tests, I’ve seen where otherwise smart and educated candidates can be grating to other employees and even drive other talent away.

    I ran into that situation. I’ve even personally blacklisted jobs that might be in the same “team” with a specific person at a very big contractor because even if they’re brilliant, they’re frustrating to work with and have no gauge on how to treat fellow professionals.

    I use “team” in quotes because despite there being enough work for 3-4 full time developers, I’ve only ever seen that one person on that team. After having worked with them, I have a really good idea why.




















  • True on the digit by digit code decryption. That I can forgive in the name of building tension and “counting down” in a visible way for the movie viewer. “When will it have the launch code?!” “In either 7 nano seconds or 12 years…”

    If they had been more accurate, it would have looked like the Bender xmas execution scene from Futurama:

    https://www.youtube.com/v/aRdRZ6TKo4s?t=25s

    I did like the fact that they showed war-dialing and doing research to find a way into the system. It’s also interesting that they showed some secure practices, like the fact there was no banner identifying the system or OS, giving less info to a would be hacker. Granted, now a days it would have the official DoD banner identifying it as a DoD system.

    I remember with Windows 95, LAN Manager passwords were hashed in two 7 digit sections which made extracting user password from the password hash file trivial:

    https://techgenix.com/how-cracked-windows-password-part1/

    Looks like it was worse than I remember. The passwords were first converted to all upper case first!