February 2022 Summaries

In the second installment of a series exploring cybersecurity roadmaps for 2022, an anonymous Chief Information Security Officer (CISO) from a global data and technology provider outlines automation, hiring, and cloud tooling as top priorities to enhance their cybersecurity program. The CISO emphasizes the importance of automation to eliminate routine manual tasks, effectively monitor for threats, and maintain agility against adversaries, citing the 1/10/60 Minute Challenge as a benchmark for rapid response. Despite the competitive landscape for recruiting skilled security professionals, the company focuses on meaningful work to attract talent, highlighting its red team-first approach to simulate real-world attacks. Additionally, the CISO plans to replace legacy software with flexible, API-driven cloud tools to stay ahead of evolving cyber threats, preferring best-of-breed solutions over comprehensive suites and prioritizing technical functionality and expertise over marketing allure.

Phish.ly is a free service launched in July 2020, developed in collaboration with Tines and urlscan, aimed at combating phishing by allowing users to forward suspicious emails for quick evaluation. The service exemplifies the effectiveness of no-code solutions in a production environment, integrating Tines automation with the urlscan API through minimal effort, and proving reliable 18 months later. Phish.ly, alongside other tools like TinesBot, contributes to a wider ecosystem of information security resources that the community is encouraged to engage with and utilize. Users can learn more about these technologies through a recorded webinar featuring Tines, urlscan, and Box.

Maria Dillon, the Head of People at Tines, plays a crucial role in fostering an inclusive company culture and ensuring effective communication and support across all teams as the company grows. Her responsibilities encompass recruitment, HR, and administration, alongside additional tasks typical of a startup environment. Dillon's workdays are dynamic, involving activities such as developing employee handbooks, refining hiring processes, and participating in diversity initiatives. She finds inspiration from her hardworking single mother, who instilled in her the importance of self-belief and continuous improvement. Dillon's highlights include organizing Tines' first international offsite event and enjoying the pet-centric Slack channel that brightens her day.

Connecting Tines to a Google Workspace (G Suite) mailbox can be achieved through various authentication methods, with OAuth and JWT being the primary options, each offering distinct benefits depending on the desired outcome. The process begins with setting up a project in the Google Cloud Console, enabling necessary APIs, and configuring the OAuth Consent Screen with appropriate scopes. For OAuth, credentials are created by setting the application type to 'Web Application' and securing the Client ID and Secret for integration with Tines. JWT, on the other hand, involves creating a Service Account, generating a JSON key file, and optionally using Domain Wide Delegation (DWD) to grant the Service Account broader access across the organization. While DWD provides extensive capabilities, it poses significant security risks, making OAuth the preferred method for most use cases. Tines facilitates these integrations with templates to streamline the process, allowing security teams to automate email reading from mailboxes efficiently.

The author reflects on a career-long journey towards automation, sparked by an early mentor who introduced them to macros to avoid repetitive tasks. Over the years, they explored various scripting languages like Perl and Python, and tools such as Yahoo Pipes and Google App Inventor, to streamline processes and enhance productivity. The author values tools that simplify tasks without extensive coding, like the now-defunct Yahoo Pipes and Node-RED for IoT. They share experiences with different platforms, including IFTTT and FeedHenry, for integrating services and creating applications without deep technical involvement. Most recently, they discovered Tines, a tool that efficiently replaces cumbersome scripts and integrations, offering a streamlined, cloud-hosted solution that aligns perfectly with their long-standing automation goals. Tines has reinvigorated their passion for automation by significantly simplifying tasks that previously required complex coding, ultimately allowing them to focus on creative solutions without the burden of writing code.

The text highlights the ongoing commitment to sponsoring open-source projects, particularly those that enhance the cybersecurity ecosystem. Notable projects include Hetty, an HTTP toolkit for security research; Phishing Database, which offers a repository for phishing-related threats; and Eric Zimmerman's tools, known for their foundational role in Windows security. Other projects like Scrummage, an OSINT tool, S3Scanner for identifying open S3 buckets, Gitleaks for detecting hardcoded secrets, AzureHunter for cloud forensics, OSSEM for standardizing security event logs, and Dockle, a container image linter, are also supported. The text emphasizes the importance of sustainable open-source tools and invites suggestions for further sponsorship opportunities.