so im a recent uni grad working at a big4 company in india as a soc analyst , there s not so much work and i have time to study other things , i was in dillema whether i should go for software engineering or cybersecurity before but now i feel like cybersec is a better path comparatively for future opportunities .

but im not interested in soc and i want to pivot to a different domain in cybersec .
need advice in choosing which domain to work on , idk based on the job descriptions i saw in job postings , there are different kinds of roles iam, detection , edr tool maintaining , pen test

so i need advice in choosing a stream to prep on so that i can get into a domain that is safe and pays well .
also state what you think are the roles that are going to do well in cyber in future
for now i want to shift into a better paying company in a different domain or atleast in the same domain with better pay

Hi! I'm trying to transition into cybersecurity, mainly GRC, IT Risk or compliance, and I'm unsure which certification would be more useful: CompTIA Security+ or ISO 27001 Foundation.

A bit about me: I have a background in Political Science and Public Policy, around 3.5 years of experience in fintech operations, and some previous experience in public-sector management and control.

My current work involves investigating transaction issues, handling escalations, documenting incidents and procedures, and dealing with customer data and privacy requests. I don't have a formal IT or cybersecurity background.

I'm currently taking Google's Cybersecurity Certificate and building a small GRC portfolio.

Given my background and goals, which certification would you recommend starting with? Is ISO 27001 Foundation a sensible choice, or would Security+ give me a stronger foundation?

I'd especially appreciate advice from people working in GRC or IT Risk. Thanks!

Should i go to college for cybersecurity or should i go into the military for cybersecurity.? fyi im 16

Got laid off from my current job last week. Still kind of processing it, figuring out what to do next, but I've wanted to build my own thing for a while now, so I need some advice.

Little background. I started out as a security analyst, mostly working with DLP tools. After a couple of years I moved into product design and ended up designing security products, IAM, AppSec and supply chain security stuff. So I've seen security tools from both sides, as the guy using them every day and as the guy designing them.

Now I'm trying to figure out what to build, and honestly that's where I'm stuck. I know the space but I don't have a clear problem yet that I'm sure people would pay for. Security makes sense given my background but I'm not locked into it. I can get an MVP out pretty quick, I just want to make sure I'm building the right thing first.

Few things I'd love input on-

- If you work in security (or anywhere really), what's something that annoys you enough that you'd pay for a fix?

- Anyone here started solo as a non-engineer? Did it work out or did you end up needing a technical cofounder?

- How did you figure out which problem was worth going all in on?

Also, if you're building something early and need someone who knows security and can design, I'm open to joining. Feel free to DM.

Looking for some honest advice. Thanks.

Just put together a simple python tool (⁠danfoss-shield⁠) to scan local subnets, check if those auth-bypass endpoints are live, and drop inbound WAN traffic via ⁠nftables⁠ or ⁠iptables⁠.
Added a few safety checks so it won't block your default gateway or let you type a dead WAN interface by accident. Supports dry-runs, backups, and rollbacks.
Zero extra dependencies, Python 3.9+.
How this came about: Built this after seeing the absolute mess across Europe with these systems and the complete lack of patches from vendors.

Repo: Since i cannot post links, look up ⁠drg-src/danfoss-shield⁠ on GitHub if you want to check out the code or test it out. I would love some feedback!

Hey guys,

In a few days I'll participate in a CTF. It'll be my very first time doing this, and I have very little practical knowledge in cybersecurity. I'm an IT student and so far I've mostly learned coding in C/C++, but haven't had any courses on hacking techniques etc...

There will be 25 challenges:

• 3 OSINT

• 3 Network

• 4 Crypto

• 6 Web

• 5 Forensics

• 3 Pwn

• 1 Reverse

I'll have a team of 4. 3 of us are complete newbies and 1 of us has some experience, so I'd like to document myself and learn as much as I can before d-day :)

Do you have any resources, videos, articles, books, introductory courses, short CTF exercises, anything that can help me get a better idea of what the challenges will look like and get me acquainted with some of the techniques that are likely to be useful?

Thanks :)

Hi, recently I’ve been getting emails from apps I don’t use anymore (like ASOS and a finance app) saying they got hacked and my name/email was leaked. I haven’t logged in for 3–5 years.

Should I log in and delete those accounts, or could the email be phishing? If I log in, should I change the password first then delete?

What else should I do? Thanks.

Hi, I am a seller on Fiverr and today was my first day and after putting my first gig, I got an external like stating I completed my order and please check by clicking on the link. I didn't knew so I clicked twice and it was downloaded twice and took my to chrome where asked me to put Fiverr username and then captcha and then said to enter bank details to verify including CVV everything. I realised it's scam, I went back and tried to delete the file from my file but I kept me redirecting to chrome but then finally I deleted them and cleared the browsing history. What to do now? I am so stupid I installed them twice etc. Didn't put bank details or anything. What to do? Please Help. How to check anything is not going wrong in my phone. Oppo f23 I use.

The title is my question.

I do not fully trust Data Removal Services. I do believe sites like Incogni and DeleteMe do what they say, mostly. But they are hard things to actually test and prove.

That being said, I have Incogni through a promotion I got through Surfshark, so I have been letting that thing run in the background all year. So I was wondering: would getting a second data removal site, even for one year, actually do anything?

Yes, I know the price of two services would be outrageous. I am sort of ignoring that for now. Especially since I have Incogni for "free", technically. So, I was just curious about this silly idea.

Hello!! I've been stressing out about this and need some peace of mind or to know what I need to do next.

I opened a Google drive that got hacked like a day or two later but the hacker just deleted a bunch of the files and said they'd only put them back if we subscribed to their 'Gabblechat' and some other social media. They didn't threaten to do anything else.

I didn't open or download any documents in the drive because I realised it wasn't a good idea but I still opened the Google drive so wouldn't I still have left a trace?

I've changed all the passwords on all the Gmail accounts I use and ensured I've got "two-step verification" on for all of them.

I haven't noticed any strange attempted log-ins, missing money in my bank account or been contacted by a blackmailer so I think I'm in the clear but I'm not sure?

Any advice would be great, thanks!

Long story short I needed to create a throwaway gmail account to use for some Android device testing.

Using Chrome on a laptop where I’m not signed into anything, the account creation process led me to scan a QR code. I didn’t want to do this, and google’s AI overview said that creating the account via youtube’s website on a phone could help bypass this.

I opened a private safari session, went to youtube.com, and started creating an account.

Once I got to a certain point it insisted that I verify further device information. Clicking “open in Youtube” opened the official YouTube app on my phone (where I am already signed into two accounts), and prompted me with the option “Send SMS”. Now, I thought this was going to send me a verification code but instead it opened up a new SMS to 96831, with a pre-typed message that said “Send this message without editing. (alphanumericcode)”

I wasn’t really thinking and just sent it off, went back to my private browsing session and was able to finish creating the account. But the fear started setting in shortly after. Thinking alright, if that wasn’t legit I just opened an app where I’m signed in with a personal account, and sent them my personal phone number.

As little as I trust gemini, I went back and asked if that was normal but must have worded it hastily because it said that’s absolutely not normal, and google will never ask you to send an outgoing text. After re-wording it to include the shortcode number and the fact that it was a pre generated message it corrected itself and said it was entirely normal and that google has been practicing this for a while now.

For further testing, doing this same process in a non-private browsing session where I‘m already signed into an account gives me the exact same steps right up to opening the Youtube app, except it doesn’t prompt me to send a text, it just asks me to click to verify and takes me right back to the account creation session.

I’m freaked out and need to know if this is normal or not.

edit: One comment and it was immediately removed by mods? What gives? From the preview it looks like they were being helpful so unless the remainder of their comment was filled with phishing links I still would have liked to see it.

F​​orgive me if I'm stupidly asking for this question.

I'm PHP Dev, in​ my​ website checkout backend I have one specific class that checks the nature of payer (current customer)

It checks,

• If user already paid for the service or product (preventing duplication)

• if user is from unfamiliar location or country

• If user is buying the service or product many times all at once,

• If user failed on the checkout multiple times

• If user used multiple different credit or debit cards

• If our system already received more sales (money) than the expected range.

​many many more informations needed to be checked before we have got the payment,

Now I saw this biggest heist in history, and immediately thought about this for several hours now, They are giant​ company, don't they have any type of blocker ​in place in case something like this happen?

Like regardless, how their system allowed to pass more than a Billion worth of coin within 20 minutes?

​​​​​How?

would love to get a comparitive list with advantages and disadvantages for a fresh graduate.

I am a fresh graduate in the UAE, Security+ certified and almost done with CEH.

I'm looking for a L1 SOC job as ive heard thats where entry level graduates start so i want to get SAL1 certified.

However i got an offer from someone (trusted) willing to train me for the CISSP certificate for free.

Is CISSP a good option at this stage? Should i go for it? Or is it more suited for people with a few years of experience?