Avi Shua

Our first #cybersecfarmers calf was born on the farm this week. Say hello to Sugar 🐮 NGL, it was a big milestone for us. (kinda like an MSP hitting that first $1M ARR in their vCISO practice 😉) This was the culmination of about 1.5 years of work and learning. And we've been fortunate to have a farmer as our neighbor who's been a guide along the way. - Repairing and selling us his old chute - Assisting with the AI breeding process - Planting, cutting, and baling hay for feed - And more helpful advice than I can count Point is, we did most of the work, but would have never gotten here without a guide to: - Give us mechanisms we didn't have - Keep us from critical mistakes - Provide a path to success And we were happy to pay him for his expertise to get it off the ground. But more than that, he truly wants to see us do well - has given encouragement, checks up on us, and is personally invested in our journey. It got me thinking. This is similar to way the PowerGRYD is set up for MSPs. If you're willing to put in the work, you get systems, a guide, and mechanisms to put you on the path to profit. And if I'm being honest... I'm personally invested in your success. So if you want to build something to support scaling your vCISO services to $1,000,000+ Drop me a comment or DM with the word "Scale" and let's have a convo about your goals... or head here next: https://lnkd.in/dV2xyx9j

81

39 Comments

We know how important it is to get quick context when you’re in the heat of an investigation. This can be especially frustrating for junior security practitioners who haven’t become fast yet at research. At Turngate, we focus on taking the pain out of complicated audit records for all security practitioners. If you’ve found yourself saying “Help, what do all of these logs mean?” or “How will I find the relevant data I need in all of this mess...” then this introduction to Okta logs was written for you. See how Senior Data Scientist Leah Z. breaks it down in Part 1 of our series on Okta logs: https://lnkd.in/gixzZpZz #securityanalyst #cybersecurity #securityoperations #soc #noc #incidentresponse #sysadmin #securityengineer #researcher #okta

9

You need to use the findings and automate based on those. eBPF is not enough.

2

Relying Solely on the NVD or severity score? You Might Be Exposed The National Vulnerability Database (NVD) has been facing serious delays this year. Budget cuts and a rising number of reported vulnerabilities have slowed NVD's ability to keep up. The result? over 93% of new vulnerabilities still waiting for analysis. This backlog means that if your security tools rely exclusively on the NVD for vulnerability data, you’re likely missing out on a significant portion of recent threats. Even more concerning, attackers are adapting their tactics. Instead of focusing solely on high-severity vulnerabilities, they are now exploiting medium and low-severity issues, vulnerabilities that may not even be flagged yet by the NVD, which may leave you with a huge blind spot. What should you do? Check your SCA tool: If your vulnerability management system depends entirely on the NVD, you're likely missing many recent vulnerabilities. Focus on exploitability: Don’t just prioritize critical vulnerabilities. Medium and low-severity vulnerabilities can be just as dangerous if they are easy for attackers to exploit. Stay proactive. Stay protected. #FOSSAware #OpenSourceSecurity #VulnerabilityManagement #NVD #OpenSourceRisk

7

Software Supply Chain Security has exploded in the past 3 years or so. Mostly due to the increasing number of attacks and vulnerabilities (and I guess Biden’s executive order has its share as well). I like what OSIM (Open Supply Chain Information Modeling framework) is trying to do - create a unified format/information model that will include all of the needed EXISTING data into one format/model. This seems similar to the OpenTelemetry world, working to unify Logs, Metrics, and traces into one singular format. This would allow you to work with any “client” you want and migrate your valuable telemetry information around. Weirdly, I just hope that we won’t see more of these (separately). I would love to see the different organizations working together (CISA, OpenSSF, OWASP, etc…) - otherwise, we will need a new unifying model again in a year.

44

2 Comments

In the past couple of weeks, th4ts3cur1ty company have seen 2 unconnected cases where separate DFIR providers have retrospectively slapped endpoint agents on to evidence laptops, running aggressive automated scans....on the evidence 🤦🏻‍♀️ For context, these are not our DFIR customers! In both cases, the company has come to us to see if we could rectify the damage 🚑 If you have a widespread incident and need visibility you previously didn't have, yes absolutely increase visibility. If you have a laptop, with a workplace suspect and the potential for court proceedings are something as a business your customer either expects, desires or anticipates may occur due to the seriousness of the situation...please don't compromise the evidence! If someone could potentially lose their career as a result of the investigation...please don't compromise the evidence! 🫨 Image the drive and work on the copy, not on the laptop itself. The first step in the process shouldn't be, "Step 1: compromise the evidence". ⚖️ Even a weak solicitor can not only challenge that, but can make sure it's not even admissible as evidence. I spoke to an industry colleague about this, who works for a DFIR competitor. He has affirmed that this is rife, as is a lack of chain of custody. WHAT IS HAPPENING?🫣 #DFIR #DontCompromiseTheEvidence #seriously

139

49 Comments

If you're still not actively patching and relying on the absence of public exploits or proof of concept (PoC) code to feel secure after vulnerability disclosures, it's time to reconsider. The recent Cloudflare Application Security Report 2024 highlights the rapid weaponisation of disclosed CVEs. There was a 15% increase in disclosed CVEs between 2022 and 2023, and a staggering 97 zero-days were exploited in the wild last year. In one instance, Cloudflare detected exploitation attempts for the JetBrains TeamCity authentication bypass just 22 minutes after PoC code was published online! Threat actors are increasingly targeting particular CVEs to compromise as many systems as possible. Apache, Adobe installations, and Citrix have been significant targets recently, with notable attacks into 2024. It's crucial to stay on top of your patch and vulnerability management programs. Don't delay system updates simply because no PoC or exploit is currently available. The absence of a PoC at the time of your last scan or penetration test doesn't guarantee there won't be one available soon after. Stay proactive! 😀 David Morrison #vulnerabilityManagement #riskManagement #cybersecurity

10

1 Comment

Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard, typically covertly, so that a person using the keyboard is unaware that their actions are being monitored. Data can then be retrieved by the person operating the logging program. While the programs themselves are legal with many designed to allow employers to oversee the use of their computers, keyloggers are most often used for stealing passwords and other confidential company information leading to ransomware demands. Traditional cybersecurity software does not protect your business from keyloggers and 4 out of the top 10 malware threats have keylogging and screen capture threats embedded. As soon as you click the malware the cybercriminals can monitor your systems. So it may be an idea to talk with your cybersecurity team to understand what they are doing to defend your business from keyloggers, or you can just contact SentryBay and we will show you the risks to your business. #LinkedInTips #Cybersecurity #malware #Aviation #Healthcare #GovernmentIT #Securitybreach https://lnkd.in/eVSTBVYb

1

Defining cyber risk has historically been like trying to describe the weather using only the word ‘bad’. It tells you something is wrong, but it doesn’t explain if you’re facing a drizzle, a thunderstorm, or a hurricane—or how to prepare for it. Just as we need specific terms like ‘wind speed’ or ‘precipitation levels’ to understand and respond to the weather, we need clear, measurable definitions for cyber risk to address it effectively.

Microsoft reveals four OpenVPN flaws leading to potential RCE and LPE - these flaws require credentials which are very common in Infostealer infections. It’s time to deal with the fact that “but you need credentials to do x” is no longer an argument when you just need one employee’s openVPN access to get RCE, especially when in big companies you have hundreds of employees infected by Infostealers. Just for the keyword “openvpn” I’m seeing 10,000,000 occurrences in Hudson Rock’s database (https://lnkd.in/deU59cgZ) Long story short - hackers will have a field day with this one. Article via BleepingComputer - https://lnkd.in/dK73rasA

106

2 Comments

As a former Engineering Director, I can attest that most engineering leaders want to equip their teams with the best security tooling, especially for urgent and easily exploitable attack surfaces. However, many vendor partnerships do not go through due to poor architecture choices, compliance issues, or a high TCO. These experiences taught me that an effective security tool must solve problems efficiently and affordably. It's not just about whether the product solves a problem but how it goes about solving it. Go through the below carousel to understand why API Security is challenging to solve efficiently. #apis #apisec #cybersecurity #enterprisesecurity #tech

25

1 Comment

May's about more than just #RSAC. May is also RMM Awareness Month™ ☠ To celebrate, here are some risk mitigations and a free tool you can use to understand your attack surface. 🔗 Surveyor, a free and open source tool you can use to baseline RMM tools (and lots of other software and activities) in your environment: https://lnkd.in/g_cEKVqq 🔗 You can find a roundup of RMM-related intelligence, threat hunting, and detection resources here: https://lnkd.in/g96qkBqG Would love to hear about intelligence, strategies, and tools that others are using to keep on top of this risk.

32

1 Comment

So I reviewed the Trust Center of Perplexity which is trying to raise at 9 Billion Valuation and I have nine observations https://lnkd.in/g8J3tMCc 1. They were founded on August 2022 and still have not gotten their SOC 2 Type 2 report which validates the effectiveness of controls over a period of time. 2. The penetration testing firm they used is decent but given how that firm operates not sure if people who were used, had advanced knowledge of AI system security testing . Would love to see the scope of testing and if it considered all the architectural considerations of AI systems or it was just general WebApp/API testing. 3. The Audit firm they have used for their SOC 2 is decent (they have the same auditor as OpenAI) but when we are talking Billions with a B, I would have loved to see a Big 4 firm doing the audit (same observation for OpenAI) 4. I would have liked them to already have or working towards ISO/IEC 42001:2023 (Information technology — Artificial intelligence — Management system). Maybe they are already working on it. 5. They are using models from OpenAI and Anthropic. I don't see any language on independent model safety testing from them. It seems they are relying on model safety testing from the underlying model providers. 6. They say that they use Claude from Anthropic but Anthropic is not listed in the list of sub processors so most probably they are using Amazon Bedrock which makes Frontier Models available via an API. 7. All their sub-processors including AWS and OpenAI, list US-East 1 as their data location so geo-redundancy might be a concern. 8. They don't seem to have a responsible disclosure or a bug bounty program. 9. They have no one working there, with security in their title. One person started there last week to do GRC.

102

14 Comments

Here is the fundamental problem with the #cybersecurity industry. We are complacent because the solution is better. The goal is not better. The goal is prevention. Until we focus on prevention, we will never ever be able to stop breaches. Over the last six years Verizon’s #DBIR report shows that more than 80% of all breaches are a result of credentials compromise or theft. If you continue to use vulnerable solutions, you are guaranteeing that this trend will never stop. Now it is your choice. I disagree entirely with Thomas Le Coz.

1

1 Comment

Good personal security tips here ⬇️ For #superannuation, #accounting or other such companies not using #MFA, now's the time to hit up Ping Identity ASAP. Like, yesterday. Ashley Diffey Robert Cipriani

5

2 Comments

Fully-Specified Algorithms Specification Addressing Working Group Last Call Comments Orie Steele and I have updated the “Fully-Specified Algorithms for JOSE and COSE” specification to incorporate working group last call (WGLC) feedback. Thanks to all who took the time to comment on the draft. Your feedback was exceptionally actionable and helped to substantially improve the specification. Responses to each WGLC comment thread were sent on the IETF JOSE working group mailing list. The updated draft attempts to discuss the full range of the problems created by polymorphic algorithm identifiers. Guided by working group feedback, it strikes an engineering balance between which of these problems to fix immediately in the specification and which to describe how future specifications can fix later as the need arises. I look forward to discussing next steps for the specification at IETF 120 in Vancouver. For more, see https://lnkd.in/gJ9rk9kq #IETF #JOSE #COSE.

19

1 Comment

The faster we are compliant, the less trustworthy certifications and attestations seem to be. It looks like they are becoming a marketing badge/a sales enabler more than assurance of an adequate security posture. If you are fighting it, I empathise with you but don't get the bigger picture. Good auditors exist. Good SOC 2 Type 2 Reports exist. Companies with good security exist. Good ISO 27001 scopes exist. The only issue is none of these are related. Getting a thorough auditor can help but doesn't go as far anyway. Either the standard is prescriptive but broad (ISO) or you can craft your controls to a significant extent (SOC). If you care about security, it most likely won't be enough. Anything that can allow a company to sell more, they'll find the most cost-effective way to get it. Caring about security for its own sake is a luxury. For most, it's a necessary survival step to sell to enterprises. If compliant companies are just as likely to be breached, then everyone knows the assurance provided is barebones/shallow. If everyone has to be compliant, then it is not something that highlights a security posture that much higher. That's why I'm excited about the disruptions happening in this space. Trust built upon a complete overview of security, not based on a shallow and/or modulable set of controls. My take is that the Trust space will displace Compliance in non-regulated industries to let GRC focus on Risk instead.

37

14 Comments