Non-compete clauses

Recently the FTC has proposed a ban on most non-compete clauses. This is a great idea, if this ban gets enacted the US stands to benefits in multiple ways including, increased worker mobility, increased innovation, increased growth, and increased market competition.

Silicon Valley

The lack of enforcement of non-complete causes in California is one of the factors that have helped to create a vibrant technology sector in that state. Non-compete clauses are a method for employers to reduce the competition by making it hard to poach and recruit talent. Without non-competes start-ups in California are able to grow and thrive in the shadow of giant technology companies because they are able to better execute on their roadmaps and strategy. Organizations such as Zoom have been able to thrive in California by identifying a need in the market not met by larger technology companies. Large technology companies have been sued by the Federal government for illegally preventing employees from getting offers from competing firms. For example, Steve Jobs was sued by the Feds for a gentlemen's agreement with one of the founders at Google to stop the organization from poaching talent away from Apple.

Abuses of Non-complete clauses

Non-compete clauses have also been abused by employees by using overly broad language that prevents employees from leaving the firm, or going to the competition. For example, in healthcare non-complete clauses often will dictate a geographical radius. In dense metropolitans, such as New York or LA, a non-complete clause of 25 miles means you'll essentially need to find another job in another city. 25 miles can mean a 2 hour commuting radius in large crowded cities with traffic.

Non-complete clauses are un-American

Non-complete clauses go against the ideas of America. The US should be a nation that encourages competition, entrepreneurship, free markets, and the ability for employees to freely move if they find better opportunities elsewhere. The rise of non-complete clauses is allowing for many larger well-resourced organizations to reduce competition and continue their rent-seeking behavior. The continuation of this will reduce the economic growth of the country, and the limit opportunities of employees. 

References: 

https://money.cnn.com/2014/08/11/technology/silicon-valley-poaching-case/

Experience taking SANS SEC560 Network Penetration Testing and Ethical Hacking

 This is the first time I have taken an online SANS course. For motivated students, online learning can be just as effective as in-person courses. 

Overall, I enjoyed taking SEC560, the material was current and relevant to my job. Although I work blue team, there is a lot of value that could be gained by taking a pen testing course. There is tremendous overlap between the course material and the TTP's used by ransomware attackers. These include the following techniques I have read or observed attackers using. I particularly enjoyed the emphasis on targeting the NTDS.dit file. 

- Password attacks (password spraying, brute-force)

- NTDS.dit

- Domain attacks

    - Domain enumeration (bloodhound) 

    - Kerberos attacks (kerbroasting) 

Improvements to the course

I thought that the labs could have been more comprehensive. I would have enjoyed a bonus section that included more advanced topics in the course, including attacks against the domain such as kerbroasting, silver ticket, golden ticket attacks, AS-REP roasting, and AD CS attacks.

Remnux and VirtualBox Window Sizes

When importing the Remnux ova into VirtualBox you may notice that the window sizes are inappropriate in order to fix this you will need to install the VBox Guest additions.

In order to do this. Add an optical drive in VBox to the virtual machine. Then in the menu insert Vbox guest additions and install the software. 

Then you will need to follow the instructions on the website.

sudo mount /dev/sr0 /mnt/cdrom sudo /mnt/cdrom/VBoxLinuxAdditions.*

The TSP a magical unicorn

Thrift Savings Plan (TSP) is the defined contribution plan offered to Federal employees. It is very similar but slightly different to the 401(k) offered to non-federal employees. (The TSP is technically not a 401(k) since it was created under a different law)

What makes the TSP a magical unicorn

1. Ability to roll funds into TSP even after leaving Federal service. 401k plans usually only allow participants to roll funds in while they are active participants. The TSP is different because it allows participants to roll 401(k) and traditional IRA funds in after leaving the federal service. (TSP does not take Roth IRA rollovers) 
2. G fund. "Participants who invest in the G Fund are rewarded with a long-term rate on what is essentially a short-term security." In other words a free lunch, long-term rate with only short-term risk. Unlike the typical bond fund offered in 401k plans, the Federal Government is assuming much of the interest rate risk. 
3. TSP is considered part of the FERS pension plan. In New York State, public pension withdrawals such as TSP are exempt from taxes up to $20,000. It may be beneficial to contribute to a traditional plan since contributions are not taxed by the state and withdrawals might not be taxed on the way out. 
4. Extremely low fees in all funds including Target Date Funds. Funds charge approximately 4 basis points or 0.043%. This is partly because expenses are covered by those who leave the Federal service before their 1% agency automatic contributions vest. 

Cons of the TSP plan 

1. Decisions are made slowly. So modern features and changes to private sector plans slowly make their way into the TSP. 
2. Politics. Members of congress occasionally interfere with the TSP. However, the TSP board does a good job at fulfilling their fiduciary duty to participants.

Note: I am not an attorney or financial professional. So you may want to consult counsel or a financial professional for your specific circumstances. 

Experience taking SANS FOR508

FOR508 Advanced Incident Response and Threat Hunting

This is a review for a course I took back in 2018 so the materials may have changed since I took the class. The course is good for individuals that are involved in incident response and threat hunting within Windows environments. I have found many of the topics of discussion useful for those that regularly use EDR and/or memory analysis (ie volatility) in their daily roles. The course was centered around intrusions into Windows infrastructure. Those that are desire to learn more about Linux / Mac forensics would learn the fundamentals but many of the exercises won't apply.

The course structure starts by going into topics that are most useful and applicable then going into events that are rarer and more indicative of an advanced adversary such as timestomping, kernel device drivers, and attacks on the mbr.


Topics covered by FOR508

• Windows event IDs

• Volatility events
• Malware characteristics 
• Majority of malware is unsigned 

• Suspicious Processes
• legit svchost is launched by service
• system32 directory should be signed by microsoft

• Programs making unusual connections

Sonos speaker Incorrect wifi password

When setting up a Sonos One it kept displaying "Incorrect wifi password" despite having the correct password.

After reading through forums, I finally found out the issue. It turns out Sonos does not work with 802.11n on 2.4 Ghz. Sonos will only work with 802.11 b/g. So I had to change my wifi settings to allow for 802.11 b/g. Sure enough once the wifi settings change it worked!

SIEM, Splunk, ELK and ulimits

Logging software including Splunk and ELK typically require resources in excess of typical Unix system defaults set in ulimits.conf (user limits). These Unix system defaults are designed to prevent a program from taking over the resources of a server. However, in the case of SIEM software you want it to maximize the resources on the system for performance.

A proper Splunk install will require customizing and changing ulimits so the Splunk daemon can have open file handles in excess of the system defaults.

In a distributed Splunk environment, the easiest way to check your ulimits is by utilizing the Health Check in the Monitoring Console.




If the Monitoring Console comes back with a finding on improper ulimits. Please see the following reference guide by Elastic on setting proper ulimits.

https://www.elastic.co/guide/en/elasticsearch/reference/master/setting-system-settings.html#ulimit

ulimits can be adjusted in the following places in 

- /etc/security/limits.conf 

- /etc/init.d/functions

In Ubuntu you also need to uncomment (please see elastic documentation for further details)

# session    required   pam_limits.so

You will need to restart the Splunk daemon under the user that you modified the ulimits. If the modified ulimits were set in the limits.conf for the Splunk user and the init.d scripts were modified for the Splunk user, then you will need to switch into the Splunk user with sudo and restart Splunk.
(If you restart as root but the higher ulimits were set for another user then the ulimits for Splunk user will not get picked up)

References:
https://www.elastic.co/guide/en/elasticsearch/reference/master/setting-system-settings.html#ulimit
http://www.georgestarcher.com/splunk-ulimits-and-you/
https://www.splunk.com/blog/2011/11/21/whats-your-ulimit.html