Drew Schimmel

Your Responsible Disclosure is a Nightmare: A Security Researcher shares feedback on how frustrating it can be to report in-vehicle vulnerabilities to car manufacturers. Laughing through tears. 📪 👨‍🔧 🚘 Security researcher Thomas Sermpinis at Defcon 32 (2024) shared two vulnerabilities he discovered in Nissan. But the most important aspect, IMO, was his journey of reporting these vulnerabilities: from receiving no response to being accused of sharing them with hostile nations. Please share this presentation with the person responsible for your company's Vulnerability Disclosure Program. I am sure we can do better. More details: Presentation [PDF, very big!]: https://lnkd.in/d6PWfin4 X Thread unrolled: https://lnkd.in/d3gTWYjJ CVE-2024-6347: https://lnkd.in/d-9E7NHK CVE-2024-6348: https://lnkd.in/da3RfAb7 #automotive #cyber #security #cybersecurity #carhacking #defcon #vulnerability #disclosure #risk #bugbounty #cve #safety #research #technology

149

7 Kommentarer

#PatchTuesday for May of 2024 may only have 1 "Critical" rated #vulnerability (SharePoint), but we do have a separate vuln being actively exploited. 👀 CVE-2024-30051 - DWM (Desktop Window Manager) Core Library privilege escalation " #Microsoft credits four different groups for reporting the bug, which indicates the attacks are widespread. They also indicate the vulnerability is publicly known. Don’t wait to test and deploy this update as exploits are likely to increase now that a patch is available to reverse engineer." #infosec #cybersecurity #exploitation

5

The American Privacy Rights Act (APRA): Everything You Need to Know Maria Cantwell, the Chair of the Senate Commerce, Science, and Transportation Committee, and Cathy McMorris Rodgers, the Chair of the House Energy and Commerce Committee, both from Washington, crafted the American Privacy Rights Act (APRA), proposing a broad range of new regulations. These regulations would control how companies handle and protect personal information collected from consumers. It includes provisions for the secure storage, handling, and distribution of such data to safeguard individuals' privacy rights. For more detailed information about the American Privacy Rights Act (APRA), please visit our latest #blog today! https://lnkd.in/gHMG3fQt Ardent Privacy Sameer A. Shivraj Jadhav Sushil Raverkar Ben Gada Tejas Joshi #AmricanPrivacyRightAct #APRA #privacyrightact #dataprivacy #dataprotection #datasafeguard #privacyregulations #privacyrights #consumerdata

8

2 Kommentarer

California Privacy Protection Agency Issues Enforcement Advisory on Dark Patterns 🤔 : Businesses should carefully review their user interfaces, including those provided by service providers, to ensure they do not employ dark patterns. Ensure Symmetry in Choices: Design interfaces that offer symmetrical choices, making it equally easy for consumers to opt-in or opt-out. Use Clear Language: Ensure all communications are easy to read and understand, avoiding technical or legal jargon. Consult Legal Resources. https://lnkd.in/gmZM4PtN

1

Jay Jacobs and I have been working a lot this week on the inaugural study of EPSS performance. Thought I'd share a pretty chart that Jay churned out yesterday. It addresses the question "What’s the typical pattern of exploitation activity?" As you may suspect, the answer depends on the vulnerability in question. Some vulns are continuously exploited for long periods of time. Some are just a flash in the pan. Exploits of others come in fits and starts. Some real-world examples of these patterns are demonstrated in the chart below, which depicts observed exploitation activity for five CVEs over the course of 2023. #vulnerabilitymanagement #vulnerabilities #vulnerabilityexploitation #cyberattacks

148

30 Kommentarer

Tip for people interested in AD security! Read my colleague Andrea Pierini’s latest blog post on Group Policy security.

19

Incident reporting is really important at all levels. End user self reporting is crucial and often overlooked. https://lnkd.in/dgVj5hZa

5

Secure by design. Assume breach. Shift right. TDIR. Threat-informed defense. Anti-fragility. ...I'm liking the trends in defensive thinking that I'm seeing at the moment, fundamental truths of information entropy and the defenders dilemma starting to appear in forward planning. In many ways this harks all the way back to to v1.0 of antivirus, which taught us the fragility of deny-lists, and the resilience of allow-lists. The speed of technology combined with the speed of adversarial innovation necessitates flipping the script.

66

17 Kommentarer

DORA + NIS2 + GDPR = Regulatory Nightmares Supplier Risk Could Cost You More Than You Think: All 3 regulations can devastate your business.  But ignoring supplier risk makes it worse. ↳ Regulatory Nightmares: Non-compliance under DORA, NIS2, and GDPR isn't just about fines. It involves massive financial penalties, regulatory scrutiny, and reputational damage. A single cyber breach or data mishap from a third-party supplier can cripple your business. ↳ Unseen Disasters: Suppliers often fly under the radar until disaster strikes. A poorly managed supplier with subpar cybersecurity measures could lead to operational shutdowns or data breaches, dragging your brand into the mud overnight. ↳ Operational Chaos: Supplier delays, quality failures, and poor service create bottlenecks and customer dissatisfaction. The hidden cost? Missed opportunities and long-term damage to your bottom line. ↳ Reputation Risks: When your supplier's scandal hits, so does your name. In the age of social media and rapid news cycles, public perception can shift quickly. Your reputation is at risk if you don’t ensure your suppliers uphold high standards. ↳ Innovation Stagnation: Focusing solely on cost-saving measures can cause you to miss out on innovative, high-performing suppliers. Taking risks on cheaper options could cost you more in the long run by limiting access to new technologies and ideas. So it's crucial to support all 5 parts of this formula: 1) Regulatory Compliance: Ensure your suppliers comply with DORA, NIS2, and GDPR. Regular audits and assessments can help identify and mitigate risks early. 2) Cybersecurity Measures: Choose suppliers with robust cybersecurity protocols. This safeguards your operations and protects sensitive data from breaches. 3) Operational Efficiency: Select suppliers known for reliability and quality service. This minimizes disruptions and maintains smooth business operations. 4) Reputation Management: Partner with suppliers who uphold high ethical standards. This protects your brand's reputation and builds trust with customers. 5) Innovation Focus: Invest in suppliers who bring new technologies and ideas to the table. This keeps your business competitive and forward-thinking. Develop these 5 strategies and watch how they make a difference. Protect your future by ensuring your suppliers aren’t just the cheapest but the most secure, reliable, and innovative.

19

Interesting article that discusses a unique property of certain digital signature schemes that allows the public key to be reconstructed from just the signature and the original message. It is well-known that the widely-used ECDSA can recover the public key used to generate a signature with just one valid signature. Reason being, there is a mathematical relationship between the two integers that make up the ECDSA signature and the positions of the public key on the elliptic curve. It is not possible to deduce the public key from a single signature in lattice-based signature schemes such as Dilithium. But if there are more than two message-signature pairs, the public key can be solved using the signature components as a system of linear equations. This is due to the algebraic structure of lattice-based cryptography. Public key recovery attacks utilizing a small number of message-signature pairs are very effective against signature schemes that do not use randomness, such as the UOV scheme. Since there is no randomness in the signature, linear relationships between the public key and its components can be efficiently reconstructed. For systems that only use digital signatures for authentication, being able to get public keys from signatures raises privacy and anonymity concerns. It also shows how important it is to carefully look at cryptographic schemes for non-standard properties beyond common security ideas like not being able to be faked. While public keys are meant to be public, their recoverability from signatures can be an unintended capability with consequences for system design. https://lnkd.in/gMubVWCt #crytography #pqc

18

1 Kommentar

Security related datasets are very hard to come by in the wild. The really good ones like the IP reputation ones are locked behind paywalls of Maxmind or Digital Element of IPInfo. But they also have decent free datasets that have immense value. And this is a very interesting niche. The entire industry should be called "blocklist industry". The goal of all these providers is to supply you with metadata of an IP address so that you can decide who to block. And not only are there providers to supply you with metadata of IP addresses, but for cookies (Adtech industry DMPs), user-agents (IAB dataset), OS/device IDs (Meta/Android) and so on. And large companies need these datasets to build a layer of fine-tuning on top of their internal datasets. These datasets are like pre-trained models. You have to fine-tune on your use-case. Like the final classification head of a ResNet or a BERT. And the best part is, you cannot rely on just one. So when you embark on solving Cybersecurity problems in any domain of your choosing - registration/sign-up, login, commerce, download, usage - ensure you are building systems that allows plug-n-play for many different pre-trained "models". And ensure your data access patterns from raw data ETLs, to feature engineering pipelines to model training runs are all decoupled and interact via standard data interfaces and catalogs. This doesn't mean you go run to a vendor solution for data catalog or feature stores. The first order of business is to define data schemas of signal sources, model output schema and versioning, API contracts and p* charts of latency and throughput. Cybersecurity with ML is an MLOps problem and forces a domain to contend with a lot more Software Engineering than it traditionally has had to deal with (atleast in comparison to modern MLOps and certainly so from my specific experience). Large companies can never just buy or purely just build. They have to build with what is bought. In their large scale systems there is a place for vendors who provide components, but there is a large space for the systems and architecture to be built with a lot of reflection, awareness and care. I have only seen such systems in two places. The first was at LinkedIn. We built ML models into Cybersecurity workflows to thwart adversarial behaviour across registration, login, scraping and a large number of complex surfaces. And this was done more than a decade ago. The second place I see this is at Adobe. It takes very storied companies to invest in large scale cybersecurity systems that leverage data signals from myriad sources, stitch systems together to build training datasets for ML models to train on and then to deploy them in critical workflows at scale with sub ms latency and throughputs that are counted in very large rpms. I'm glad to see discourse on these topics which even in Cybersecurity can be esoteric topics.

3

For the last 6 months or so, I have been struggling with market definitions in identity and access management. I used to understand markets such as identity governance and administration and access management; I understood what the feature boundaries were; I could map vendors to those markets. But honestly, lately, I feel like those maps and those boundaries aren’t as accurate as they once were. So, in some regards, this post is my attempt to work through ways of defining what IAM looks like in the modern era, what parts should enterprises be willing to pay for, which are table stakes, and where is this all going. There is change in the air; people are willing to consider new solutions and new architectures. What follows is a reframing of the enterprise identity space, one not based on "classical" market definitions, instead one based on capabilities, and it starts with identifying the four major components to new world of identity: * Policy * Orchestration * Execution * Data Read the rest at Weave Identity https://lnkd.in/eu78FS5d

130

48 Kommentarer

As you've probably heard by now, Verizon's 2024 Data Breach Investigations Report (DBIR) just dropped. I'm proud to say that Cyentia Institute was a contributor again this year. I should say "one of the many, many data contributors." I know most people focus on the findings from the DBIR - and they should. But to me, this is the most remarkable and important aspect of the DBIR. I can't think of any other report/project in the #cybersecurity field that can unite all these logos in a common effort of data sharing and analysis. And do it for 15 years! Yes - I know the DBIR first published more than 15 years ago (I was there). But 2010 was the first time we included non-Verizon data from the U.S. Secret Service. That initial step took quite a bit of effort, but then they introduced us to the Dutch High Tech Crime Unit, the Australian Federal Police, London Metropolitan Police...and the dominos kept going. I clearly remember when I got a "yes" from the first private sector IR service provider that was a competitor of Verizon at the time. The execs HATED the idea of sharing the spotlight, but they eventually conceded. And their participation paved the way for all the others you see here. And though I'm no longer leading the DBIR production effort, I'm honored to be one of those logos I started adding so long ago. Also - it's not easy managing all those contributors and datasets. As you review and apply all the insights from this year's DBIR, raise a toast of appreciation to the DBIR team that is dedicated to what they do for the community. Many thanks David Hylender Suzanne Widup Philippe Langlois Alex Pinto #databreaches #cyberrisk

259

15 Kommentarer

Great example of the incredible engineers and experts on our team, Rolando Torres. The experience of working with many of the leading #SIEM, #XDR and #EDR platforms have added real value to clients and partners. If your organization is exploring any of these solutions, give Rolando or someone on our team a call. Abacode Cybersecurity & Compliance #cybersecurity #managedsecurity #compliance #managedcompliance #securityoperations #SOC

14

An excerpt from my book, " Stop The Cyber Bleeding " Ch. 6: As C-suite and board members, your role is to lead your organization through the three steps of ECRM: identifying cyber risks, determining risk tolerance, and managing risks. To prepare for this, focus on building strategic objectives around governance, people, processes, technology, and engagement. This lays the foundation for a strong cyber-risk-aware culture, essential for successful ECRM implementation. Purchase here https://a.co/d/jhvtDAt #ECRM #CyberRisks #StopTheCyberBleeding

3

Too often, security teams get late invites to product launches. Here’s our guide for how to secure surprise projects so you can quickly swap emergency fire hoses for confetti cannons.

36

1 Kommentar

That is not looking good ... New EU debate about chat control called Backdo-- uh sorry i mean, "Upload Moderation" is out 🙃 Here is the statement from Meredith Whittaker, Signal President if you are interested : https://lnkd.in/e7rDcehW "So let’s be very clear, again: mandating mass scanning of private communications fundamentally undermines encryption. Full stop. Whether this happens via tampering with, for instance, an encryption algorithm’s random number generation, or by implementing a key escrow system, or by forcing communications to pass through a surveillance system before they’re encrypted." #EU #encryption #privacy #debate #moderation

9

2 Kommentarer

Vermont passes a data privacy law allowing consumers to sue companies. Vermont has passed a robust data privacy law, granting individuals the right to sue companies for privacy violations—an unprecedented provision. The law - imposes data minimization requirements, - bans the sale of sensitive data, and - includes a two-year limited private right of action against large data brokers. This law not only establishes civil rights safeguards to prevent discrimination but also aligns with the ongoing federal efforts to implement comprehensive data privacy laws. While there's a debate over whether federal laws should supersede state regulations, this legislation is a significant step towards a unified approach to data privacy. Given these new developments, it's crucial to ask yourself: How do your data privacy practices measure up? Is it time for a privacy checkup? The responsibility lies with each one of us to ensure our data is protected. Source link: https://lnkd.in/df94JngQ Ardent Privacy Sameer A. Shivraj Jadhav Sushil Raverkar Ben Gada Tejas Joshi #vermont #privacy #sensitivedata #dataprivacylaw #privacymatters #dataminimization #databrokers #dataprivacypractice #civilrights #dataprivacy #ardentprivacy #dataprotection #datasecurity #privacylaw

10

My two cents: This model is unethical. A kickback to CISOs, regardless of how it's dressed up. The CISO is an officer of the company and has a fiduciary duty to represent the interests of the company. Ethics and common sense dictate that if you have a financial interest in a potential vendor, you need to disclose that and to recuse yourself! If a CISO has financial interests in LOTS of potential vendors, I'd question whether they're in the right role. Thoughts?

3

2 Kommentarer