Sean Mason @SeanAMason

I lead Cyber Defense for @United. Angel Investor. Philanthropist. World Traveler. Founder of IR business for @Cisco. Former @GE CIRT Leader. seanmason.com Florida Joined December 2010

Tweets

8K
Followers

2K
Following

71
Likes

1K

Sean Mason @SeanAMason

2 years ago

@anton_chuvakin @bettersafetynet It's not even that... Cyber is a community working together for the common good. I'll point to the ISACs which exist for a reason, to share ideas and information, to include amongst competitors. Ignoring and/or not asking what others are doing is foolish.

1 0 1 40 0

View Details

David J. Bianco @DavidJBianco

2 years ago

Yes, it is the "if you're going to be at RSA..." time of year again! If you're going to be at RSA, I'd love to see you at my talk: "How I Screwed Up #ThreatHunting a Decade Ago, and How We're Fixing it Now with #PEAK" buff.ly/3TMOngF

0 4 9 1K 3

View Details

Sean Mason @SeanAMason

2 years ago

@Garin_Pace Interesting comments... any more insight into which insurers are buying/forming IR teams?

0 0 0 14 0

View Details

Sean Mason @SeanAMason

2 years ago

@pchobbit @anton_chuvakin As long as the IC is only performing urgent work, they make sense (as the author states). And let's not forget about non-traditional incidents, like critical vulnerabilities that are reported to you. And in down time, ICs should focus on continual improvement, TTXs, Comms, etc...

0 0 1 19 0

View Details

David J. Bianco @DavidJBianco

3 years ago

Hospital #ransomware have a huge impact on patient mortality, it turns out. WHO KNEW?? 42-67 deaths in just patients covered by Medicare in the US, not those covered by other insurance or those in other parts of the world. Cybersecurity is healthcare. buff.ly/3RgZAoO

1 3 9 1K 2

View Details

Heather Adkins - Ꜻ - Spes consilium non est @argvee

3 years ago

No, we aren’t turning the internet off @google. We experiment continuously to raise the cost of attacks for bad guys and are running a short test on a small # of very specific machines; testers have full internet access on other devices, and can also opt out of the test!

Techmeme @Techmeme

3 years ago

Sources: Google is internally piloting an opt-in program where some employees will be restricted to internet-free PCs to reduce the risk of cyberattacks (@jenn_elias / CNBC) cnbc.com/2023/07/18/goo… techmeme.com/230718/p38#a23…

0 9 30 122K 12

14 29 139 64K 12

View Details

Sean Mason @SeanAMason

3 years ago

This is one of the reasons why I struggle when it comes to trusting Microsoft. They created a target rich environment that helped incubate the cybersecurity problem, sat by and did next to nothing while it's been rampant, and now are profiting from it.

Steven Adair @stevenadair

3 years ago

@Volexity @Microsoft365 @Microsoft @CISAgov Spoiler: the first recommendation is "Enable Purview Audit (Premium) logging. This logging requires licensing at the G5/E5 level." That is a tough pill to swallow for most organizations due to the cost. IMHO, this log data should be available at all M365 license levels. 6/7

4 12 53 10K 4

1 0 1 350 0

View Details

Brad Garnett @brgarnett

3 years ago

Talos IR has repeatedly observed adversaries abusing VCAs in different ways during incident response engagements. These accounts are frequently leveraged for initial access and then used to move laterally through the organization’s network, especially when the victim hasn’t deployed multi-factor authentication (MFA). Since VCAs are usually given elevated permissions, theft of these credentials will often result in widespread damage to victim assets and could even be used to move along the initial victim’s supply chain. blog.talosintelligence.com/vendor-contrac…

0 1 1 319 0

View Details

Dustin Volz @dnvolz

3 years ago

North Korean hackers have stolen more than $3 billion in crypto over the last 5 years, and their heists are now funding fully half of its ballistic missile program, alarming U.S. officials. Here's how they did it. w/ @bobmcmillan wsj.com/articles/how-n…

17 316 650 758K 128

View Details

Sean Mason @SeanAMason

3 years ago

YES!!! This is awesome!

Ryan Reynolds @VancityReynolds

3 years ago

As someone who has extensive experience with airplane puns, SHIPS AHOY. Welcome @united to the @Wrexham_AFC team as front of shirt sponsor.

231 690 15K 6.2M 133

1 0 2 308 0

View Details

Sean Mason @SeanAMason

3 years ago

Some really great insights: The airlines’ cyber chief believes storytelling, facilitation, and a marketing mindset are vital for moving IT and cybersecurity up the organizational value chain to the benefit of the business overall. cio.com/article/480461

0 0 4 229 0

View Details

Sean Mason @SeanAMason

3 years ago

@anton_chuvakin Well said. I'd state that even the basic hygiene needs to be threat informed these days. Nobody has enough resources to do everything and your threats should prioritize what you go after.

1 0 1 74 0

View Details

Sean Mason @SeanAMason

3 years ago

@colinbraun @CrowdStrike @GeorgeKurtz You guys were an absolute pleasure to watch race. Can’t wait for the next event!

1 0 2 64 0

View Details

Sean Mason @SeanAMason

3 years ago

@security_craig Sadly a lot of developers don't use their own product and/or features.

0 0 0 58 0

View Details

Grant Milstead @grantmillie

3 years ago

@lillysharples If anyone wants to work on software at United Airlines, send me a DM. We have front end, mobile and Full stack dev roles as well as cloud ops jobs open. Come where you can have an impact and help 500K people a day get to the events in their lives that matter most! #beingunited

0 2 7 335 0

View Details

Sean Mason @SeanAMason

3 years ago

Ransomware actors aren't necessarily going after the big pay day anymore- most ransoms are running ~$200k. What this article is missing, is once inside and prior to deploying ransomware, actors are using BEC techniques to ensure they take home some money darkreading.com/attacks-breach…

0 0 0 167 0

View Details

Sean Mason @SeanAMason

3 years ago

It's almost as if storing all your secrets in one place and entrusting that knowledge to a company that prioritizes revenue first and foremost is a bad thing...

TechCrunch @TechCrunch

3 years ago

Norton LifeLock warned thousands of customers that intruders may have accessed their stored passwords. tcrn.ch/3w3Kuse

7 21 27 53K 2

0 0 0 227 0

View Details

Sean Mason @SeanAMason

3 years ago

Great meeting with @mubix & our Red Team earlier. We hit our highest payout month ever in December for our Vulnerability Disclosure Program! Thank you to all of our researchers out there. If you want to get involved, check out our program on @Bugcrowd - bugcrowd.com/united-vdp

0 0 0 151 0

View Details

Sean Mason @SeanAMason

3 years ago

Great talk on ASO and CD/CR that's worth a watch if you're in the Defense/SecOps/IR space. youtu.be/62dNxb5bals?t=…

Iman Ghanizada @ImanGhanizada

3 years ago

SOC modernization 101: Watch our in-depth discussion on Autonomic Security Operations (ASO) and Continuous Detection, Continuous Response (CD/CR) at Mandiant mWISE. @Anton_Chuvakin #ASO #CDCR #SOC #CISO youtube.com/watch?v=62dNxb…

1 6 35 5K 10

0 2 2 1K 0

View Details

Sean Mason @SeanAMason

3 years ago

Some level of paranoia is healthy in the security space, but jumping to conclusions isn't. I'd recommend every team have a set of security checks they perform every time there is some level of IT disruption- knowing full well that 99.9% of the time it's not a security issue.

Karine Jean-Pierre Archived @PressSec46

3 years ago

The President has been briefed by the Secretary of Transportation this morning on the FAA system outage. There is no evidence of a cyberattack at this point, but the President directed DOT to conduct a full investigation into the causes. The FAA will provide regular updates.