/posts/ Recent content in Posts on Grep On Security Hugo -- gohugo.io en-us Sat, 10 May 2025 13:23:00 +0200 /posts/how-i-passed-the-comptia-security+-certification/ Sat, 10 May 2025 13:23:00 +0200 /posts/how-i-passed-the-comptia-security+-certification/ This might sound like clickbait or just another post about Security+, and maybe it is. I know I’m neither the first nor the last person to share their experience with this certification. Honestly, I don’t know if I’ll bring anything new to the table. But I figured I’d still share my take. If you’re interested, read on. If not, feel free to check out my other articles. This article will not tell you how to pass the certification. /posts/offline-upgrade-from-rhel8-to-rhel9-using-an-iso/ Sat, 03 May 2025 01:13:29 +0200 /posts/offline-upgrade-from-rhel8-to-rhel9-using-an-iso/ Upgrading from Red Hat Enterprise Linux (RHEL) 8 to RHEL 9 in an offline environment requires two main stages: first, upgrading to the latest RHEL 8 version (8.10), followed by upgrading from RHEL 8 to RHEL 9. This guide will walk you through the necessary steps for each part of the process, addressing potential issues along the way, and is specifically designed for an offline upgrade using local ISO images. /posts/doras-tlpt-mandate-is-your-bank-ready/ Thu, 16 Jan 2025 08:00:00 +0200 /posts/doras-tlpt-mandate-is-your-bank-ready/ Yesterday, I had a meeting with an international consulting firm about the Digital Operational Resilience Act (DORA), which officially comes into effect tomorrow on January 17, 2025. This new regulation will significantly impact banks worldwide that have branches in Europe. Among its many requirements, it introduces something that caught my attention: Threat-Led Penetration Testing (TLPT). But what is TLPT, and who needs It? Simply put, TLPT is a type of red teaming . /posts/threat-modeling-hands-on/ Mon, 30 Dec 2024 08:00:00 +0200 /posts/threat-modeling-hands-on/ Introduction Threat modeling can feel intimidating, especially if you’re unsure where to begin, don’t know the right tools, or are unfamiliar with the methodologies. In this article, I want to present the concept and apply it to a real-world scenario to demonstrate its value. But before we dive into the example, it’s important to address some questions why threat modeling is essential and why it often gets neglected despite the benefits. /posts/deploying-sysmon-via-gpo/ Thu, 26 Dec 2024 06:00:00 +0200 /posts/deploying-sysmon-via-gpo/ While I explained in my previous article how to collect Windows Event Logs which already provide some valuable insights, it is fair to say that they often lack the depth needed for effective threat detection and analysis. This is why deploying Sysmon is the next step in advanced threat hunting. Sysmon Overview Sysmon is both a Windows system service and a driver from Microsoft SysInternals that monitors and logs detailed system activity, such as process creation, network connections, and file creation time changes, even across reboots. /posts/using-nist-csf-2-0-for-smes/ Fri, 15 Nov 2024 19:20:00 +0200 /posts/using-nist-csf-2-0-for-smes/ As a security engineer with some experience in GRC, even though it is not my primary focus in my day to day work, I believe that some cybersecurity frameworks knowledge helps security engineers take a step back and better prioritize their efforts. Today, I would like to present the NIST Cybersecurity Framework (CSF) 2.0 as one of the most widely used frameworks. Whether you’re new to the CSF or have been using it for years, this overview will walk you through what it encompasses, its recent update, and how you can leverage it to enhance your organization’s cybersecurity. /posts/siem-guide-to-windows-event-forwarding/ Mon, 21 Oct 2024 06:00:00 +0200 /posts/siem-guide-to-windows-event-forwarding/ Introduction Collecting Windows Event logs is crucial for maintaining a secure and well-monitored IT environment. Whether it’s tracking user logins, monitoring changes to critical systems, or detecting potential security threats, Windows event logs provide the detailed visibility you need to understand what’s happening across your network—especially on critical machines like Domain Controllers (DCs). Without these logs, you’re basically flying blind when it comes to identifying issues or investigating incidents. In this guide, I’ll walk you through how to properly set up Windows event logging so you can capture and forward these logs to your SIEM, it can be Splunk, ELK, or any other platform of your choice. /posts/reclaiming-disk-space-on-root-volume-by-shrinking-home-in-rhel-with-xfs/ Sun, 06 Oct 2024 16:12:00 +0200 /posts/reclaiming-disk-space-on-root-volume-by-shrinking-home-in-rhel-with-xfs/ Introduction Lately, I found myself called on an incident where a critical security application was running on a Red Hat Enterprise Linux (RHEL) server. The disk had become fully saturated, causing the application’s unavailability. This was a cool, refreshing session of Linux commands for disk and partition manipulation. The / root partition was full, but the /home partition had plenty of unused space. In this scenario, I needed to reduce the size of the /home partition and reallocate some of that space to the root partition. /posts/learning-about-cloud-security-for-swiss-private-banks/ Sun, 18 Aug 2024 19:53:00 +0200 /posts/learning-about-cloud-security-for-swiss-private-banks/ It has been 3 months since I moved from the tech industry to the banking sector, and here is my take on Swiss private banking cloud security. This article condenses what I have learned so far about the various regulations that apply to the Swiss private banking sector and its challenges around data confidentiality. Transitioning from a software company, where the main risk was supply chain attack, to a private bank, where client data confidentiality is the main concern, has been an eye-opening experience. /posts/mitre-attack-gap-assessment-analysis-and-threat-profiling/ Mon, 17 Jun 2024 20:13:00 +0200 /posts/mitre-attack-gap-assessment-analysis-and-threat-profiling/ Introduction: Understanding MITRE ATT&CK Navigator The MITRE ATT&CK Navigator is a powerful tool that helps cyber security professionals visualize and navigate the extensive ATT&CK matrices. It provides a customizable interface to map out and understand the tactics, techniques, and procedures (TTPs) used by threat actors, making it essential for threat profiling, defensive coverage analysis, and strategic planning. Users can create layers either interactively or programmatically and manipulate cells in the matrix with color coding, adding comments, assigning numerical values to techniques (scoring), etc. /posts/mastering-cyberark-epm-your-implementation-guide/ Tue, 21 May 2024 06:00:00 +0200 /posts/mastering-cyberark-epm-your-implementation-guide/ When looking for Endpoint Privilege Management (EPM) solutions, there are not a lot of options out there. The main market players are CyberArk, BeyondTrust, Delinea (previously Thycotic) and the Microsoft Intune Endpoint Privilege Management. The best solution may differ based on the operating systems, organization size, industry, and whether the company has many developers needing admin access. These factors can also affect the implementation difficulty. What is an EPM software? An EPM software allows you to remove local admin rights on end-user devices and control which applications can be run as standard user, with elevated privileges/as admin or should be blocked. /posts/writing-security-policies-for-soc2/ Wed, 08 May 2024 21:36:00 +0200 /posts/writing-security-policies-for-soc2/ Transitioning from ISO27001 certification to SOC2 compliance is a natural progression for many organizations. Whether you’ve already obtained ISO27001 or have it in your sights, SOC2 is likely on the horizon, being one of the most coveted certifications for demonstrating robust security controls. Chances are, your organization is already fielding inquiries from customers’ security compliance teams about SOC2 readiness. And if crafting comprehensive security policies poses a challenge due to limited security governance staff in your security department, I present here a solid base to kickstart your journey towards SOC2 compliance. /posts/streamline-macos-security-compliance-with-jamf-compliance-editor/ Wed, 08 May 2024 21:30:00 +0200 /posts/streamline-macos-security-compliance-with-jamf-compliance-editor/ Introducing the MacOS Security Compliance Project The MacOS Security Compliance Project (mSCP) is an open source framework for programmatically generating security guidance. This project contains security baselines of technical security controls such as CIS Benchmark, NIST-800-171, NIST-800-53, DISA STIG which can be adapted to the specific needs of any organization. The workflow is quite simple: Where tailoring is used to select which rules to include in a benchmark, customizing is modifying the rules themselves. /posts/automate-compliance-and-security-hardening-using-openscap-and-ubuntu-security-guide/ Wed, 01 May 2024 15:06:00 +0200 /posts/automate-compliance-and-security-hardening-using-openscap-and-ubuntu-security-guide/ Compliance as Code Compliance as Code (CaC) can be simply put as IT security compliance policies written as code. Systems configuration can be audited by these CaC policies to demonstrate your infrastructure’s compliance against regulations and industry standards such as CIS Benchmarks, DISA STIG, PCI DSS, HIPAA, and more. Organizations can automate assessment, monitoring and remediation of these compliance controls on various systems with the Security Content Automation Protocol (SCAP) developed by Red Hat and the National Institute of Standards and Technology (NIST). /posts/how-to-build-a-good-resume-for-free/ Sun, 14 Apr 2024 22:00:00 +0200 /posts/how-to-build-a-good-resume-for-free/ In today’s competitive job market, a well-crafted resume is the key to getting that first interview. A resume isn’t everything, but it’s what gets you from the screening stage to the first interview with the recruiter. There are plenty of resume builders available online, however most of them are not free or just have a free trial period of 14 days, and today I want to prove that there are excellent free alternatives out there. /posts/vulnerability-scanning-of-docker-images-vendors-customers/ Sun, 24 Mar 2024 16:28:00 +0200 /posts/vulnerability-scanning-of-docker-images-vendors-customers/ Containers are ubiquitous in modern production environments within Kubernetes clusters hosted on various cloud platforms such as AWS EKS, Azure AKS, or GCP GKE. By consequence securing Docker images is a necessity for all companies. Both customers and vendors must ensure that the images they use are free from vulnerabilities that could compromise their systems and their data or, respectively, tarnish their reputation if they ship vulnerable images. Nowadays, it’s well known that there are vulnerabilities in Docker images that can be exploited to escape the Docker environment and achieve privilege escalation on the host or just leak confidential data.