2026-09-23 20:36 UTC
If I have one more "security expert" tell me that all of my IOCs should have lifetime or expiration dates defined, I'm going to flip some tables.
Replies (3)
-
@cR0w@infosec.exchange 2026-09-23 20:37
I get that there's a shelf life on some but malware file hashes, certain domains, and even certain networks can stay blocked forever. Why the fuck should I have them expire and wait to be abused again before blocking again? It makes no sense.
-
@catsalad@infosec.exchange 2026-09-23 20:59
@cR0w@infosec.exchange Like milk?
-
@Spartan_1986@infosec.exchange 2026-09-23 21:23
@cR0w@infosec.exchange “IOCs valid until the bad guys change them. There, you have an expiration dumb ass.”