Sev1Day1
A short story about working at a cybersecurity worker's cooperative.
The steam had only hints of tea notes when the sea of red appeared on Celine's screen. Cel had color vision deficiency but even her own eyes could tell there isn't supposed to be this many inbound connections and error messages in the logs.
Years of working at enterprise security made her heart race to an uncomfortable pace. A voice in her head began to scream:
Disconnect. Isolate. Escalate.
Before she could say anything, Gem's voice startled her from the feed.
"Oh hoo hoo, you get a fun first day" Gem's voice hooted like an owl as they said it. "Let's take a look at this sev1".
Gem had just started showing her the cooperative's monitoring systems when the alert went off on their shared workspace.
"Alright we'll click on this client ID to see who needs our help today. Hm, thought I recognized this hash. This is 406 Media again. Oh zang, they are going after them hard this time. We are blocking the inbound connections, but tabernak they are spinning up new IPs faster than last time. Looks they are trying to exfiltrate, probably looking for the whistleblowers. I take it the administration did not love that exposé." They said the last part with a trace of humor, despite the gravity of the situation.
Cel finally managed speak up. "I, uh, haven't read it yet, but it sounds pretty scathing from the #void comments."
Great job Cel, let them know you didn't bother reading the newsletter.
"Oh I don't blame you, it's a long, heavy read. You gotta look after your mental health and limit your news intake sometimes." Gem reassured her.
Fuck they are awesome. Work life balance is a real thing here, not just propaganda.
"I'll for sure read it, I just wanted to prioritize my onboarding today. Thanks for the eReader by the way. I've never had a company do that for me. I'm pretty used to just getting a ThinkPad and a templated email."
Cel could hear Gem stop typing and laugh far from the mic. "Hey don't you dare disrespecc the ThinkPad!" Gem said with a raised voice, but Cel could still hear the smile in their voice.
Cel laughed to ease her tension, when her smiled turned suddenly, "Hey so, what's going on with this incident? Do we need to fill out anything?"
"Oh, pffft." Gem's mic blew out a little. "They managed to got into the tarpit we made for them. Right now these bots are crawling through some of their own regurgitated AI shlop. Our guy Foz from the Kyoto branch added kilobyte-to-petabyte zipbombs in the latest recipe, so they should stop annny second now."
With impeccable timing, a green bar appeared on the edge of the graph, a shore of safety in the sea of red. She could see the line showing the number of inbound connections dropping like a rock. The client status updated to Resolving.
Woah, a client sev1 was resolve with no paperwork. Is this real life?
"We'll watch it for a sec, the new tarpit is still baking in the pipeline, it should be live soon. We'll need to follow up with #synthetics later. These new models are getting better at avoiding our narsty stuff." Gem snorted a little, "Sorry, I'm not sure why I said it like that."
Cel's tea timer went off. She sat there basking in the warm, grassy scent of the tea leaves. It was nice for a moment, but she began to feel uneasy in the silence. The timer going off reminded her that she was on the clock. This made Cel hold her breath. She was waiting for the barking of orders from someone above her having a meltdown on Slack. At her old $job, this type of incident would triggered a dozen alerts, an eight hour war room where she said maybe five words if anything at all, despite her decades of experience in cybersecurity. These meetings always ended the same way: an external forensics firm would bill them six figures to "advise" what they already knew about the situation and they'd get their external audit box checked. Nothing would change.
After what felt like a small eternity she was relieved to hear Gem's voice again. "Sorry about the delay, had to use the facilities. Looks like that sev1 is resolved now, so let's get back to your onboarding. Commonscale governance doesn't give us too much downtime in your first couple months but you'll get there. Let's just go ahead and open up a terminal so I can show you how we use Incus to rebuild this client's defense assets."
Cel had enough time this morning to configure her terminal exactly how she liked it. While going through the documentation she was pleasantly surprised to see how in only a few keystrokes she could completely rebuild the client's assets. The auto-complete that came bundled with the cooperatives governance code was more powerful than she expected.
ccc_workspace/cel: deprovision client NDA2IE1lZGlh --helpThe output from her command showed her exactly what would happen if she tried to delete the client's environment. Cel was only beginning to grasp that working at the Commonscale Cyberdefense Centre wasn't only about access control, it was about consent and contribution. She was working with competent coworkers that used their talents to eliminate toil. It was clear to her that the coop invested heavily in governance & tooling to make it a place that people would want to work.
Cel took a sip of her tea as hit the perfect drinking temperature. She was lost in thought, running through the most pragmatic ways she could bolster the defenses of the Commons when a notification gong disrupted her train of thought.
Nyx: "how's day1 going? i hear Gemini is putting you through the ringer"
Cel: "not terribad; we handled our first sev1 like it was nothing"
Nyx: "i need to ask you something about that when you're off the clock"
Nyx (ephemeral): "what do you know about the kaiju protocol?"
System: Message deleting in 5... 4... 3... 
