Página del sector Ciberseguridad dentro de Tecnologia e informatica con preguntas públicas, salario, beneficios, desarrollo profesional, flujos de trabajo y experiencias reales para profesionales que trabajan en Estados Unidos.
tech-security
我碰到过一次销售同事连续收到 MFA push，SIEM 同时提示异地登录失败。刚看到告警时很容易直接禁用账号，但那天他正在外州出差，用的是酒店网络，不能只按地理位置下结论。我的做法是先从 IdP 登录日志看 device id、ASN、失败次数和 conditional access 规则，再联系本人确认是不是自己触发。 确认风险后，我没有一刀切锁账号，而是先撤销 refresh token，要求重新登录并改密码，同时检查 OAut…
tech-security
Last month I got an EDR alert on a finance laptop for an encoded PowerShell command launched from Outlook. The first reaction in the ticket was to wipe the machine. I understand why: PowerShell plus Outlook sounds bad…
tech-security
公司域名上了 DMARC 后，安全邮箱每天收到一堆 XML 报告，刚开始没人看。后来财务同事收到仿冒邮件，我们才发现有一部分第三方系统发信没进 SPF，报告里早就有迹象。 我的做法是先把 rua 报告导入表格或解析脚本，只看 source IP、header_from、SPF result、DKIM result、disposition 这几列。内部系统和授权供应商单独列白名单，未知 IP 先查反向解析和发信量。确认是合法供应商后，让…
tech-security
I recently handled an email security alert that looked serious enough to wake up our security channel. The message had a vendor-looking domain, an invoice-related subject line, and a link that our email gateway scored…
tech-security
MFA rollout looks like a security project, but most of the pain is people and operations. Turning it on for a small engineering team is one thing. Turning it on for sales, warehouse tablets, shared front desk machines…
tech-security
今天下午做季度 access review，几个部门经理看到导出的权限表都说看不懂，里面只有 app code、role id 和一堆缩写。以前这种复核很容易被他们全部点通过，实际没有达到 least privilege 的目的。我先把权限按系统、业务动作和风险等级重新整理，把"能导出客户资料""能审批退款""只读报表"这些动作翻译成普通业务语言，再把长期未使用的账号单独标出来。处理过程没有直接替经理决定，而是让他们按岗位确认是否还需…
tech-security
OAuth approvals can look harmless because the screen says connect, allow, and continue. In a company account, that button can grant more access than people realize. I have reviewed apps that only needed calendar read…
tech-security
上周有同事把公司笔记本落在机场，信息安全处理不能只让他改密码。设备上有浏览器会话、本地同步文件和 VPN 配置，流程要快，也要留记录。 我的做法是先在 MDM 里把设备标记 lost mode，确认最近一次在线时间和 FileVault 状态；如果设备还能连网，就下发 remote wipe。第二步查 IdP 登录记录，重点看丢失时间后的异常登录、地理位置变化和 MFA 结果。第三步让 IT 轮换本机证书和 VPN profile，避…
tech-security
I ran into an access review problem that started with one vendor portal. The portal used SSO, but the app role was mapped to a broad identity group that had been reused for a different project. Nobody meant to…
tech-security
Me paso en un turno normal, dentro de seguridad operativa en una empresa chica con Google Workspace y varias apps SaaS: un vendedor aprobo una app OAuth desconocida porque parecia una extension de calendario. El…
tech-security
One review I worked on found a long list of outdated packages across several services. The first ticket basically said update everything, which sounded responsible but gave the engineering team no way to plan the work…
tech-security
Application audit logs are one of those things every product says it has, but many of them are almost impossible to use when a real review starts. I learned this the hard way on a SaaS admin tool where the log only…
tech-security
Finance asked to connect a new contract tool to our workspace, and the business case was real. They needed templates, approval comments, and signed PDF storage in one place. The problem was permission scope. The app…
tech-security
A finance team wanted to connect a document automation tool to the company workspace. The demo looked useful, but the permission screen asked for broad file access. In the past we had approved apps too quickly and…
tech-security
A routine offboarding review turned up a former employee who could still read a shared sales mailbox. The main account was disabled, so the normal checklist looked complete. The gap was delegated access through a…
tech-security
我之前在一次 SaaS 公司安全巡检里踩过这个坑：DLP 告警显示有人把客户名单放到了公开分享链接里，但告警只给了文件名和操作者。当时如果只按最明显的表象处理，短期好像能过，后面一定会反复。 后来我把问题拆成"哪里出错、谁受影响、还能不能回滚"三块。我先冻结链接权限，没有直接删文件；随后查 audit log、下载记录和共享范围，确认只有内部 IP 访问后再要求 owner 改成组权限。真正的经验是，安全事件最怕一上来把证据清掉，先止…
tech-security
I ran into this in a security review after our SIEM flagged a service account for requesting a broader OAuth scope. The issue was the alert named a production integration, but the actual token activity did not match…
El ingreso en Ciberseguridad depende de la ciudad, experiencia, tipo de puesto, empresa, habilidades y certificaciones. Conviene comparar sueldo base, horas extra, bonos, beneficios, estabilidad y crecimiento.
Para entrar en Ciberseguridad, empieza por entender puestos de entrada, habilidades comunes, requisitos de certificacion y trabajo real. Luego crea experiencia verificable con proyectos, practicas, trabajos iniciales o casos concretos.
El futuro de Ciberseguridad depende de la demanda regional, cambios tecnologicos, ciclos del mercado y profundidad de habilidades. Es mejor revisar puestos reales, experiencias de colegas y habilidades transferibles.
Ciberseguridad suele requerir habilidades tecnicas del puesto, comunicacion, colaboracion y criterio de seguridad o cumplimiento. Algunos trabajos tambien piden licencias, certificaciones, experiencia con equipos o casos de proyecto.
Un principiante puede empezar con terminos basicos, procesos tipicos, problemas comunes y herramientas de entrada. Despues, los casos reales, preguntas de colegas y proyectos pequenos ayudan a construir criterio.