The Security Construct @thesecconstruct

NotPetya wiped Maersk: 4,000 servers + 45,000 PCs rebuilt in 10 days. One domain controller survived, offline in Ghana after a power cut. SLE × ARO = ALE. $300M once in 10 years ≈ $30M/yr (example). Board says offline backups cost too much. Your move? #cybersecurity #CISSP

Feb 2016: hackers sent fake SWIFT orders from Bangladesh's central bank to the NY Fed. ~$81M gone; a "fandation" typo helped stop the rest. You're responsible for payment security. The overnight report is blank. How would you handle it? #cybersecurity #CISSP #infosec

Feb 2016: hackers sent fake SWIFT orders from Bangladesh's central bank to the NY Fed. ~$81M gone; a "fandation" typo helped stop the rest. You're responsible for payment security. The overnight report is blank. How would you handle it? #cybersecurity #CISSP #infosec

A hidden implant in Ledger wallets from reseller CryptoBilis read the 24 seed words at setup and sent them out over LTE. ~$102M drained from 324 wallets (Bitquery est.). Your new wallets came from a reseller. How would you handle it? #cybersecurity #infosec #crypto

Oct 2026: Daiichi Kosho said malware on one contractor PC put ~8.6M karaoke customer records at risk. Names, emails, phones. No passwords. You're responsible for vendor risk. A contractor keeps your customer list. How would you handle it? #cybersecurity #CISSP #infosec

May 2021: Colonial Pipeline paid ~$4.4M and shut America's largest fuel pipeline for days. Way in: a legacy single-factor VPN nobody meant to use. You're responsible for remote access. An old VPN still works. How would you handle it? #cybersecurity #CISSP #infosec

skyticket admin tools misused 2–4 Oct → ~14.64M customer records (hashed pw ~4.13M). Passports/cards not taken. You're responsible for the back office. Your admin panel can reach every customer record. How would you handle it? #cybersecurity #infosec

Late 2013: ~40M Target cards exposed via a contractor's stolen login and an ignored malware alarm. Due diligence is checking. Due care is acting. You're responsible for the alerts. A high-severity malware alarm fires at midnight. How would you handle it? #cybersecurity #infosec

July 2020: hackers phoned Twitter staff posing as IT. No malware. 130 accounts hit in about a day. You're responsible for the help desk. A caller knows an employee's name and role, and asks for a login. How would you handle it? #cybersecurity

Ransomware hit SoftBank's IDC Frontier cloud, affecting 495 customers. JR East says up to ~6.09M records may have leaked. You're responsible for recovery. Your provider just told you to rebuild it yourself. How would you handle it? #cybersecurity

Uber's security chief paid hackers $100,000 through the bug bounty and called it research, during a federal probe. A jury convicted him. You're responsible for the breach response. Your boss says keep it quiet. How would you handle it? #cybersecurity

2007: the UK child benefit database, 25 million people's data, went on two unencrypted CDs by unrecorded courier. Never arrived. You're responsible for data leaving the building. Which layer would actually stop a full export today? #cybersecurity

Southern Company says an unauthorised party reached limited data on ~400,000 utility customers via its online portal. Entry method not disclosed. You own the customer portal. How would you know if someone was reading 400,000 accounts? #cybersecurity

Equifax emailed the patch alert to 400+ people with a 48-hour rule. The portal was never patched and the traffic monitor had been blind for 19 months. Rule = due care. Proof = due diligence. You're the CISO. The patch email went out. How do you prove it landed? #cybersecurity

@SecurityWeek For a critical NetScaler flaw, patching is step one. Also check for unexpected sessions and config changes from before the fix, and rotate any credentials or signing keys the gateway held. Gateways are where a patch and a compromise often overlap.

@cyb3rshi3ld Agree, and the strongest walk-throughs include one thing that broke and how the candidate found it in the logs. Showing your detection and your mistake beats a perfect diagram.

@BleepinComputer Until AhsayCBS is patched, keep the console off the internet and watch the web root for new script files and the service account spawning shells. A miner is often the noisy first tenant on a box someone quieter already owns.

@TheHackersNews Worth alerting on any new or changed file under the workflows folder that reads secrets or makes outbound calls, with CODEOWNERS review on that path. If one landed, rotate every secret the repo could reach, not just the obvious ones.

Would your team have noticed a push campaign going out through your messaging vendor that nobody on your side approved?

ASOS app users got a push alert: "ASOS HACKED". ASOS cites unauthorised activity on third-party messaging platforms. Snowflake says its platform was not compromised. You own your company's customer push tool. How would you lock it down? #cybersecurity

Would your offboarding have revoked his cloud access on his last day, or would a forgotten admin key still have deleted 456 machines?

Months after he quit Cisco, 456 virtual machines vanished. 16,000 Webex Teams accounts went dark for up to 2 weeks. Cisco knew who did it, but couldn't stop him. You're responsible for his offboarding. How would you handle it? #cybersecurity #IAM