@scottalanmiller said in Hillary Rodham Clinton - Security Specialist:

@bnrstnr said in Hillary Rodham Clinton - Security Specialist:

@scottalanmiller said in Hillary Rodham Clinton - Security Specialist:

This would be like having someone who failed at being a hacker, like Kevin Mitnick, speak at a conference or represent you.

Shot at KnowBe4? People occasionally bring it up. It always seemed scammy to me.

They use him in some things. but I've not seen them have him speak at a conference. KnowBe4 puts his face on things, but AFAIK, that's it. But I've been to a conference that actually presented him as if he was an "expert speaker", which tells you volumes about what they think of their audience.

He is speaking at their conference this year

https://www.knowbe4.com/kb4-con

@Pete-S said in Compare Azure to Windows On Prem for Normal Business Workloads:

Hypervisor management
Monthly cost: $50
Yearly cost: 12 x 50 = $600
5 year cost: 5 x $600 = $3K

That's less than one hour of IT maintenance a month for 192 VMs.....

@scottalanmiller said in Are Security Careers Real?:

@IRJ said in Are Security Careers Real?:

@scottalanmiller said in Are Security Careers Real?:

@JaredBusch said in Are Security Careers Real?:

@scottalanmiller said in Are Security Careers Real?:

@VoIP_n00b said in Are Security Careers Real?:

I friend of mine just made the transition to security. He said his pay doubled.

What did he transition from?

And WTF is security?

Right? Everyone says it, but what exactly is that job?

Its a cross between IT and compliance. There are different security roles, but they all fall in between those two sides. Some closer to IT, some in the middle, and some that are almost strictly compliance.

The biggest problem is that often they are just called "security" and can mean almost anything.

Likewise, the IT jobs are often just labeled "administration" or something and equally mean almost anything.

Yeah so like with anything else specialization makes more... Cloud Security for example pays about 30% higher than standard Security roles.

Architecture roles tend to pay a bit more since you are building security architecture and consulting security practices to other teams.

@scottalanmiller said in Are Security Careers Real?:

@JaredBusch said in Are Security Careers Real?:

@scottalanmiller said in Are Security Careers Real?:

@VoIP_n00b said in Are Security Careers Real?:

I friend of mine just made the transition to security. He said his pay doubled.

What did he transition from?

And WTF is security?

Right? Everyone says it, but what exactly is that job?

Its a cross between IT and compliance. There are different security roles, but they all fall in between those two sides. Some closer to IT, some in the middle, and some that are almost strictly compliance.

@scottalanmiller said in Are Security Careers Real?:

@VoIP_n00b said in Are Security Careers Real?:

I friend of mine just made the transition to security. He said his pay doubled.

What did he transition from?

SMB IT makes a good transition to security, actually.

It's something I have preferred over security experience when hiring. You basically want someone to be well versed infrastructure and know how data communications work.

I work in a cloud only environment and there is so much. I've done 100 hours of so training and I'm still learning.

I would recommend taking a professional level AWS or Azure course when you get a chance. If it's not something you've done before, it can be eye opening for the multitude of options and capabilities that you get. Even if you've done a course more than 2 years ago, a bunch has changed.

@scottalanmiller said in Compare Azure to Windows On Prem for Normal Business Workloads:

**
Azure: $175.80 / year
Vultr: $60 / year
On Prem: $40 / year

Vultr and Azure are nowhere near the same. Vultr compares more to AWS lightsail. Which essentially gives you the same VPS functionality without the entire infrastructure benefits in the cloud.

You don't talk about autoscaling or building a multi tiered application so of course you would use something like Vultr or Lightsail.

@Jimmy9008 said in Microsoft plans on retiring the MCSA,MCSD,MCSE certifications in June 30,2020:

@Obsolesce said in Microsoft plans on retiring the MCSA,MCSD,MCSE certifications in June 30,2020:

The exams are following a career or job role based path.

Apparently, Microsoft sees a Windows Server administrator type of role as something the market is shifting away from. I see this in the enterprise completely, as anyone touching Windows Server services isn't spending most of their time there. It's all towards or in support of Cloud services. So it makes sense from that perspective. Someone who specializes in AD and associated services will, at least in the enterprise, spend most of their time with it in support of cloud services... making it work with Azure AD, other SaaS integrations, SSO, federation, MDM (LANless based), etc... you get the idea. That can basically be said regarding any traditional Windows Server based services.

However, I do see the point in that many SMBs only have a few Windows Servers and needs someone who specializes in basically what the old Server 2012-2016 server infrastructure MCSA/MCSEs covered because that's all they'll do there. But for how long? Who knows.... but what matters is that you realize what it is you want to do and how long you want to do it.

The market has been, and is, shifting. Embrace it now to stay ahead, move away completely from MS, or play catch up later. Up to you.

The new Azure role based certs have these levels:

Fundamentals
Associate
Expert
Specialty

And what they cover reflect the job roles in the markets Microsoft obviously makes the most money from, future thinking in mind. Could they update the Server Infrastructure MCSA/MCSE path to 2019? Sure. (but what you are thinking of in those BARELY changes... most that stuff is the same as it was since 2008R2!) Even with 2012 R2, in those cert paths were starting to get a little "Cloud-y" back then. ESPECIALLY with 2016. At some point, you need to draw the line and cut them away. And in Microsoft's eyes, that time has come, I see it too, as well as many others.

Maybe Jim-Bob working at Kathy's Suburban Dentistry who keeps their 15-device Windows environment running on the single Windows Server they have in the closet may never see anything for awhile. But at some point, he may need to configure their new Dentistry SaaS app authentication via AzureAD from AADSync or some other means. Maybe not, but just trying to make a simple point. Or better yet, he may not even want to be there long enough and wants to move on to greener pastures.

But really, that's not what MS is creating their Certifications for. There's a much bigger market than that, and it totally makes sense to do what they are doing.

I have always found cloud services to be extremely costly. Seems like a bad news for us IT folk IMHO.

Cloud services have been proven cheaper for companies for a long time.

The more skilled the IT professional is the more efficient they can design a cloud environment. It's actually better for IT professionals that are plugged in because they become more valuable to their company or customers.

@scottalanmiller said in Microsoft plans on retiring the MCSA,MCSD,MCSE certifications in June 30,2020:

@IRJ said in Microsoft plans on retiring the MCSA,MCSD,MCSE certifications in June 30,2020:

@scottalanmiller said in Microsoft plans on retiring the MCSA,MCSD,MCSE certifications in June 30,2020:

From the looks of it, Microsoft isn't seeing their career path as being very serious anymore. Replacing an MCSE with "learning Teams"? WTF

Everything is cloud on Microsoft's certification tracts now. You can't be Windows Server certified anymore
. It's been a phase out, that's been happening for a couple of years and is no surprise

Not a surprise. But doesn't change what a statement it is.

I don't know. I see windows server having an update strategy like Windows 10. We aren't expecting a Windows 11 anytime soon.

Plus Microsoft has been pushing for Linux really hard for a couple years now. Right around the time of phasing out of these certs.

They've been really SQL for Linux especially. Since SQL is a very profitable product line, this is interesting and shows that they believe linux is a better platform to run their database.

Certifications by Microsoft are just a way of having getting professionals to push their products. Subscription based products are much more profitable then Windows Server.

@scottalanmiller said in Microsoft plans on retiring the MCSA,MCSD,MCSE certifications in June 30,2020:

From the looks of it, Microsoft isn't seeing their career path as being very serious anymore. Replacing an MCSE with "learning Teams"? WTF

Everything is cloud on Microsoft's certification tracts now. You can't be Windows Server certified anymore
. It's been a phase out, that's been happening for a couple of years and is no surprise

@dbeato said in Choosing a WAF:

I use AWS WAF with Cloudfront, Terraform, Cognito and any functions for the applications so it is very powerful.

@dbeato said in Choosing a WAF:

I use AWS WAF with Cloudfront, Terraform, Cognito and any functions for the applications so it is very powerful.

Are you using owasp top 10 rules?

@stacksofplates said in Choosing a WAF:

Ah, man compiling that from source will be annoying for your patching cycles.

That is definitely an initial CON I need to add to my list.

@bnrstnr said in Time Clock Software?:

@IRJ said in Time Clock Software?:

@bnrstnr said in Time Clock Software?:

Whenever I hit management with the cost for the SaaS ones, I always get cringes lol

Wait till they figure out they have to pay their internal IT to write a timeclock app

I already spend about an hour a week keeping the damn thing working... they pay me either way, might as well add more shit to my plate lol

You could be doing stuff that actually needs to be done, though.

@stacksofplates said in Choosing a WAF:

@IRJ said in Choosing a WAF:

@stacksofplates said in Choosing a WAF:

Another option is to use Cloudflare. You can use Terraform to define your WAF rules with them also.

I hadn't thought about that. It would be interesting to compare cost with AWS.

Yeah and it would probably be easier to use if you switched providers. The Terraform provider stays the same so no config changes.

The other downside to modsecurity is you would probably have to get another ATO right?

Cloudflare doesnt have an ATO so that's not an option...

I dont think modsecurity would be considered a big enough change to trigger the process, but I could be wrong. Since we are already using NGINX in our application, it would just be recompiling it from source that would be needed. Even if it is considered a major change, we would just implement it when doing our yearly audit and kill two birds with one stone.

@stacksofplates said in Choosing a WAF:

Another option is to use Cloudflare. You can use Terraform to define your WAF rules with them also.

I hadn't thought about that. It would be interesting to compare cost with AWS.

@bnrstnr said in Time Clock Software?:

Whenever I hit management with the cost for the SaaS ones, I always get cringes lol

Wait till they figure out they have to pay their internal IT to write a timeclock app

@bnrstnr said in Time Clock Software?:

We're currently working with a piece of s*&# that hasn't been updated since 2003 and only runs on Windows XP :man_facepalming:

Use a SaaS of course. As someone recently posted on here, you can restrict IPs of your timeclock SaaS to just your office location(s) so people cannot use it from home.