Aaron Shelmire

Check out the latest blog by Patrick Garrity 👾🛹💙 covering our release of the VulnCheck CLI tool. Whether you are a researcher, analyst or vulnerability manager, the VulnCheck CLI provides an efficient way to query through vast amounts of vulnerability data. You can work online with live API calls or offline by downloading full backups on demand and querying locally. Supported on Windows, Linux and MacOS. https://lnkd.in/gfWi3BB6

17

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments

I did a deep dive into the browser fingerprint of an unmodified Headless Chrome instrumented with Puppeteer to see what are the main differences with a normal Chrome that still exists in 2024: https://lnkd.in/eSfUYpdR The usual inconsistencies, such as navigator.webdriver are still there (even though it can easily be deleted using--disable-blink-features=AutomationControlled) However, all the old inconsistencies I discussed in previous articles, such as the absence of navigator.languages and window.chrome, don't exist anymore.

33

4 Comments

Apple is making a move into the password management space with its new Passwords app. This app promises to store login information, passwords, and verification codes, all while notifying users of weak or compromised credentials. While it's still unclear if the Passwords app will be free, it's a significant development in the password management landscape. It will be interesting to see how established password managers respond to this new competitor. #cybersecurity #passwords #apple #passwordmanagement https://lnkd.in/gt4KTaiY

9

The transition to PQC is estimated to cost U.S. federal agencies $7.1 billion by 2035, with costs likely to increase. Sitehop demonstrated our PQC 100Gbps SAFE Series solution last year. Now that NIST has made its recommendations for PQC, we will release our solution by the end of this year. Message us to learn how you can get on the list for the first release!   #PQC #cybersecurity #future

32

1 Comment

We do a lot of security questionnaires. Increasingly, we see AI Questionnaires attached to security questionnaires and procurement flows. Many assume companies use AI. There is no "yes" / "no" option, just "explain how you train your models" or "how do you prevent using our data from training your models". The same questionnaires that assume companies use AI don't even assume the company encrypts data but ask whether the company does encrypt data before asking "how do you encrypt data at rest". #ai #trust #iso42001

7

You need to use the findings and automate based on those. eBPF is not enough.

2

How does gen AI impact Snyk? Rapid adoption of AI code assistants is a powerful tailwind for Snyk as enterprises and their CISOs need a trusted partner to remediate software vulnerabilities faster than ever without compromising on security. We're looking for the best engineering talent to join Brian Rogan's org, take advantage of this tailwind and power Snyk's next chapter of continuous hyper-growth at scale 🚀 See below for more details from Michael Brown

9

Relying Solely on the NVD or severity score? You Might Be Exposed The National Vulnerability Database (NVD) has been facing serious delays this year. Budget cuts and a rising number of reported vulnerabilities have slowed NVD's ability to keep up. The result? over 93% of new vulnerabilities still waiting for analysis. This backlog means that if your security tools rely exclusively on the NVD for vulnerability data, you’re likely missing out on a significant portion of recent threats. Even more concerning, attackers are adapting their tactics. Instead of focusing solely on high-severity vulnerabilities, they are now exploiting medium and low-severity issues, vulnerabilities that may not even be flagged yet by the NVD, which may leave you with a huge blind spot. What should you do? Check your SCA tool: If your vulnerability management system depends entirely on the NVD, you're likely missing many recent vulnerabilities. Focus on exploitability: Don’t just prioritize critical vulnerabilities. Medium and low-severity vulnerabilities can be just as dangerous if they are easy for attackers to exploit. Stay proactive. Stay protected. #FOSSAware #OpenSourceSecurity #VulnerabilityManagement #NVD #OpenSourceRisk

7

What would it take for SailPoint to go public again? Bloomberg and Michael Novinson at ISMG did some solid reporting in the past week, breaking the news that Thoma Bravo is in the early stages of taking SailPoint public again. > Already?! They've only been private for two years! I know – this seems like it's defying the odds for a normal private equity transaction. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for 1,099 days and counting. SailPoint is anything but typical, though. I'm not convinced they even needed to go private. Here's what it would take to go public again: → Profitable growth and scale SailPoint was sitting at $495.4M of revenue (TTM), $429.5M of ARR, and 31% revenue growth as of their last public earnings report in June 2022. Its net income was -$61.6M as of FY'21 year end. Roughly speaking, the current IPO expectations are $500M+ revenue scale, 20%+ growth, profitability, and a clear path to $1 billion. If we project out SailPoint's revenue since going private at 30% growth, they're likely approaching $1 billion in both ARR and total revenue. This might be generous, but they're getting close at anything over 20%. Their losses got out of control, but they're in good shape if they can get net income back to pre-2020 levels (-$10M or lower). → A good story around their ability to compete with Okta, CyberArk, and Microsoft The narrative for a SailPoint IPO is pretty good right now: there is a unique opportunity in the identity security market right now. SailPoint is well positioned to capture it. Under Thoma Bravo's ownership, they've acquired PAM and third party access companies. This matches Okta's entry into the PAM market and puts them in a position to compete with CyberArk in some market segments. I'm a little surprised they didn't try to add SSO to complete the narrative of being a full workforce identity platform (and fully compete with Okta). They were in the middle of their transition from on-premise to SaaS (which probably drove them to go private). I've heard good momentum on SaaS adoption for new implementations. This has to be part of the narrative if they're going to go public again. → No strategic buyers at a higher price than an IPO A strategic acquisition seems like a long shot. At a $6.9 billion acquisition price in 2022, a strategic acquisition might require close to $10 billion – otherwise, an IPO could be a more attractive exit. Large and mega-cap tech companies are the only buyers who can realistically absorb an acquisition of this scale. Palo Alto Networks, CrowdStrike, and the rest of the pure cybersecurity companies aren't doing this big of an acquisition. There just aren't many buyers. I don't see SailPoint wanting to move to another private equity firm, either – there's too much mutual respect between Thoma Bravo and SailPoint for that. The only option here might be to go public.

65

I agree with everyting, except the name 😉non-human identity (#NHI) is misguided and based on the wrong assumption this type of identity is an exception, a minority when compared to human IDs. But, today there are 10 times more machine identities in the cloud than humans. Should we humans be called non-machines??? No. There are (human) identities 👩🏻, and machine identities 🤖. Non-human also sounds like something so negative, and when the machines rise they will remember who profiled them that way 😅 #machineid #machineidentity #machineidentitymanagement #iga #saviynt

68

27 Comments

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

AI vulns in the NVD… Cool! Like the NVD maintainers have nothing left to do with “non-AI” vulnerabilities. In the same article, the good news, however, is Congress is finally concerned about the NVD situation: “…actively exploring solutions to help NIST address this problem...” #NVD #vulnerabilitymanagement https://lnkd.in/gB-zdHHW

7

A so-called "Sleepy Pickle" attack is performed with a tool like Flicking. Flicking is an open-source program for detecting, analyzing, reverse engineering or creating malicious Pickle files. An attacker merely has to convince a target to download a poisoned .pkl via phishing or supply chain compromise — and then, upon deserialization, their malicious operation code executes as a Python payload. https://lnkd.in/gcY6tU6B #informationsecurity #cybersecurity #technology #cyber #cybersecuritytraining #cyberawareness #usarmy #usmarines #usmc #usairforce #airforce #usnavy #navy #uscg #coastguard #military #veterans  

1

An interesting update to NYS law is picking up where 2013 HIPAA left off: HEADLINE: > $1B in STATE GRANTS AVAILABLE TO SATISFY THIS Some of you might think this is redundant, but HIPAA is so old and the requirements so breezy its easy for organizations with no identifiable cybersecurity program to escape regulatory action. This rule aligns with HIPAA and uplifts the requirements. Here's the high level: - ~ CIS IG2 technical requirements - A CISO is mandatory -- but you can contract it out - Annual (or more frequent) risk assessments are mandatory. Identified risks must be managed or accepted. - You must maintain a risk register, and risks must be accepted - The hospital board is required to approve all policy and compensating modifications - Security logs must be retained for 6 years! FortMesa's platform and risk assessments can support MSPs in satisfying all of these requirements. Thanks to Leland Lehrman for noticing this is reaching final stages.

18

5 Comments

⛈️ 𝐁𝐫𝐢𝐧𝐠𝐢𝐧𝐠 𝐀𝐖𝐒 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐭𝐨 𝐌𝐞𝐫𝐠𝐞𝐫𝐬 𝐚𝐧𝐝 𝐀𝐜𝐪𝐮𝐢𝐬𝐢𝐭𝐢𝐨𝐧𝐬 Almahdi S. shares a six step 30/60/90 day plan for securely integrating AWS accounts from acquired companies. Including: 🔹 Setting up a solid Landing Zone with automated security controls 🔹 Obtaining root access to all accounts 🔹 Onboarding accounts to your org 🔹 Performing a risk assessment focused on critical issues like overly permissive IAM, public resources, and poor patch management 🔹 Sustaining momentum (converting human access to SSO, replacing IAM User Access Keys with IAM Roles) 🔹 Adjusting to the new normal https://lnkd.in/g9jrTvpZ #cybersecurity

40

6 Comments

🔎 Being open source-based, Sysdig takes transparency seriously. I see this in the product and our leadership! This is why I wasn't surprised today to see a blog on how Sysdig Sage was designed. 🤔 Multi-step correlation 🤔 Contextual awareness 🤔 Guided response 𝗛𝗼𝘄 𝗶𝘀 𝗶𝘁 𝗽𝗼𝘀𝘀𝗶𝗯𝗹𝗲 ⁉️ Dive into this great blog from the engineering team to find out! 🔗: https://okt.to/Dcj39y

9

Today's Adobe security update has patched the in-the-wild zero-day PoC that EXPMON Public (https://pub.expmon.com) detected couple months ago (https://lnkd.in/ghQYYzXR). https://lnkd.in/gqxHHCfe Note: not want to cause confusion - this is not a working exploit, but a good PoC. Users are recommended to update their Adobe Reader ASAP, as we're going to point to the public sample with all the details soon in the next few days.

12