Phil Kasiecki

https://lnkd.in/e_izxBRk A reminder that misconfigurations are one of the leading causes for cyberattacks and risks. Cyber hygiene is often overlooked and risk is accumulated over time 🦠 👾 #infosec #partner #cyber #risk

19

2 Comments

If you want to earn people’s trust (and there are myriad reasons you should) the #1 thing you can do is demonstrate to them that you actually care. Full article here 👇🏼 https://lnkd.in/gMQ-puHB #CareFactorProgram #FromComplianceToCare #SafetyLeadership #SafetyCulture

71

3 Comments

I'm disappointed in all the testers simply chalking the CrowdStrike incident as "you can't find every bug" and acting as if this kind of major incident is just inevitable. As the CrowdStrike Preliminary Post Incident Review admits, there were _plenty_ of opportunities for improvement in their processes and testing that _could have_ either prevented this defect from escaping, or made the impact much less severe. Over-reliance on any one form of defect detection or prevention is a good way to set yourself up for this kind of failure. In this case, it seems they over-relied on their automated "Content Validator" tool. Guess what? Sometimes your automation tooling itself has bugs. This is one reason I take issue with the CICD concept of "the [automated] pipeline decides the releasability of changes"--sometimes having a human in the loop will catch things that even a good and reasonably thorough automation suite won't. I think it's a positive that their report lists a variety of countermeasures, including: * Having developers test more on their local machines * Rollback testing * Staggered deployments * Better monitoring * Actually giving customers more control of how and when this kind of content is deployed to their systems * Providing release notes so customers can better understand what's changing Again, relying on any one of these countermeasures would likely be insufficient, but these kinds of "diverse half measures" make it much more likely that defects can be found and fixed before they cause such a global outage. And I suspect that if CrowdStrike had put more thought into a diverse quality strategy, they absolutely could have prevented this problem, which itself seems to have been a bit of a cascade of multiple problems. How's your test strategy? Are you over-relying on any one approach? Now would be a good time to evaluate and branch out, before your company also makes the news for the wrong reasons. #criticalthinking #softwaretesting https://lnkd.in/gJRZnJ2b

64

16 Comments

Cybersecurity education clearly doesn't have it's priorities straight. I've just now learned about Armitage, which helps visualize many parts of the scanning/exploit/post-exploit process in pen-testing through the msfconsole, but in a window. Why is this not the basis for EVERY beginner level red-teaming course? This is incredibly helpful and informative for visualizing the process, and should be as fundamental to pentesting as Scratch or HTML is to teaching about programming concepts. Picture related: searching for a keyword, selecting an attack, and adjusting the options are all clearly laid out, and instead of having a notepad in another tab, I can have my active hosts (and info associated with them) represented in the window itself.

1

 Miss a link among the 398 comments shared in the chat during last Wednesday's Wee Dram? Well, you are in luck! Here they are: D-Link won’t fix critical bug in 60,000 exposed EoL modems https://lnkd.in/eYiYChQA Chinese hackers hijacked thousands of TP-Link WiFi routers for covert cyberattacks https://lnkd.in/egKUqtzR 10 Key Cyber Policy Questions as Trump Preps for Presidency https://lnkd.in/eehyuJGz FBI Warns Gmail, Outlook, AOL And Yahoo Users—Hackers Gain Access To Accounts https://lnkd.in/eQm2fy9W The formation of a PLI insurance for CISOs is now being created by Professional Association of CISOs (PAC) https://lnkd.in/e_2V8gsf Google Cloud to Assign CVEs to Critical Vulnerabilities https://lnkd.in/eC3K7cf8 TOWARD RESILIENCY IN U.S. CRITICAL SUPPLY CHAINS https://lnkd.in/euYyYcaA Computer-Related Risks in Healthcare [10-minute summary] https://lnkd.in/eRzuWaec Illegal land grab? Chinese wind farms in Bosnia-Herzegovina https://lnkd.in/enpfc_hC

7

The Missing Links of System Safety - Part 2 - The Hazard Tracking System (HTS) The next "link" isn't missing so much as I feel it is currently not given enough industry focus.  Maybe more of a weak link. I consider the HTS, as defined in MIL-STD-882 Task 106, as the heart of the system safety effort. The Working Group (Task 105) provides the heartbeat (to maintain the analogy) and is the subject of a future post. My observation is that the HTS is primarily implemented for its role in facilitating closed loop lifecycle tracking of safety data. Besides making sure identified safety issues are run through the process to closure, it can provide assurance that nothing "falls through the cracks", particularly during the potentially chaotic run-up to regulator approval. It can be as simple as a spreadsheet but if done right, can provide a leveraging point for integrating with other processes (see below) as well as facilitating statusing and reporting of the safety effort throughout the product development team (including leadership). Full disclosure is that my previous IT career experience as an Oracle DBA allowed me to design and develop a customized relational database version of a HTS during my system safety tenure. It's not the greatest since I was busy understanding MIL-STD-882 and running multiple complex product development safety programs at the same time. But it worked and is still being used to run a number of advanced product development efforts. I know it can be done right. The COTS tools I examined before creating the custom solution were directed at supporting sustainment safety efforts. Primarily field reporting and corrective action system (or FRACAS for short) which were focused on managing incident response and fleet risk. These tools do well for managing risk after finding what has gone wrong, but are not suited for the development environment where the effort is around what can potentially go wrong. The emergence of the model based systems engineering (MBSE) approach is highlighting the need not only for the existence of a common HTS tool functionality, but also a level of integration with other development processes and software tools. The HTS is the key link to the safety requirements in the MBSE paradigm. If properly implemented, the HTS is the key to an efficient and focused safety effort and a "force multiplier" for the product safety team. Trying to conduct the safety data management and reporting task during development manually is an exercise in tedium and inefficiencies with many opportunities for "drops" and oversights. In order to face the many safety challenges facing the industry today, safety process needs the right tools in place with the HTS at it's heart. I welcome any comments or information on existing COTS HTS tools you know about which support the product development safety process. #safety #safetyprofessionals #safetyculture #safetytraining #safetyfirst #systemsafety #aerospaceengineering #safetyword

10

2 Comments

Here's an article I wrote recently that discussed how to work with boring compliance training. In this case it was one of those 2-hour mandatory courses. https://lnkd.in/guW7-QvY #elearning #training #instructionaldesign

103

15 Comments

Fatal question about Software Bills of Materials (#SBOM): Are they antithetical to software security? Consider: An important security strategy is obfuscation, misdirection, and opacity. Does not an SBOM mean to disclose sensitive information about software components?

2

10 Comments

IClean is a medium rated, retired hack the box machine has a very interesting web application penetration testing component showcasing Server-Side Template Injection (SSTI) and Cross-Site scripting (XSS) on a Flask application that leads to initial access. On the target, enumerating for hard coded credentials in a web application’s configuration files allows for access to a SQL database running internally. Cracking hashes of user accounts through that database allows for greater access to then leverage a privilege escalation vector through an overly permissive QPDF binary, allowing SUDO to be ran against it. https://lnkd.in/e8EBKx2q #cybersecurity #hackthebox #penetrationtesting #hacking

6

"If you write a book about feedback, you're bound to get a lot of it." Kim Scott, author of the bestseller RADICAL CANDOR, joined me on Firewall this week to discuss her newest 'radical' book, her techniques learned over years in the tech industry on how to work better on teams, and how she is going up against Spotify to make sure authors are paid fairly for their audiobooks. FULL EPISODE: https://lnkd.in/dqEBm9B3

9

Accessibility Tip of the Day 269: Writing as clearly as possible is called using "plain language". Plain language makes it easier for people to read, understand, and follow information online. This is particularly helpful for any sort of government communication. People need to be able to understand how to do things like apply for a passport, renew their driver's license, or vote. There's even a whole website dedicated to this concept! You can learn more here: https://lnkd.in/gw9H-zBC #accessibility #a11y #accessibilityTipOfTheDay

32

1 Comment

Do you ever use Win + C as a shortcut on your PC. It’s had a few uses over the years, but not any more… it’s being switched off in an upcoming update. Think back… do you remember the Windows 8 Charms Bar? Win + C was its shortcut. Then came Cortana in Windows 10, and the shortcut opened her instead. With Windows 11, Win + C was updated to open Copilot. Now Microsoft is decoupling Copilot from the taskbar and offering it as a standalone app, making the shortcut unnecessary. This move makes me wonder, is the Win + C shortcut cursed? Every feature it’s been tied to has eventually been removed. Microsoft's decision to disable it raises questions about Copilot's future… but don’t worry, it's not going away. Copilot will still be available as an app on the taskbar, just not linked to Win + C. While Copilot is now a web app you can open from the taskbar, the shortcut’s removal hints at bigger changes. Microsoft is shifting focus, especially towards enterprise customers. What do you think? Is the Win + C shortcut cursed, or is it just coincidence? #Windows11 #Microsoft #CursedShortcut

2

2 Comments

FAST FACTS: Did you know? One of the most important security design considerations for systems engineers is “Minimize Detectability.” A system that is not discoverable, observable, or trackable by an adversarial threat or exposed to such a threat is less prone to a targeted attack. Such a targeted attack can result in system failure that results in adversity including severe or catastrophic widespread loss of assets or services. Principle: The design of the system minimizes the detectability of the system as much as practicable. https://lnkd.in/e5j5d2vm Minimizing detectability guides and informs engineering design decisions to eliminate or reduce exposures such as unnecessary interfaces, access points, footprints, and emanations, thereby reducing susceptibility to adversarial threat actions. Interfaces and access points have the effect of exposing the system to intentional adversity (i.e., attacks) and unintentional adversity (i.e., faults, errors, incidents, and accidents). Yet interfaces and access points are necessary to deliver required capabilities, and duplicating interfaces and access points is needed to avoid single points of failure. System design must balance the need for interfaces with the susceptibility that results from the interface being exposed, discovered, and observed. Every interface, whether internal or external, constitutes an exposure that must be considered. Minimizing detectability reduces the ability of an adversary to observe and discover information about the system to craft and execute attacks. This includes detecting a system’s location, presence, and movement (e.g., due to emissions, signatures, or footprints). We are well beyond the need to protect systems with just “basic cyber hygiene.” The modern world of digital computing technology and interconnected systems is too powerful and impactful to ignore. I summarized this problem in a LinkedIn article in 2020. https://lnkd.in/ew2VisTy Security will always be an emergent property of a system. Security must be addressed “below the waterline” by the engineering community. The application of security design principles cannot solve all of our problems, but it can help infuse security into the DNA of our systems. And that my friends, is the best way to turn the tide and get a handle on these never-ending mass cyber events. #NIST800160 #SystemsEngineering #SSE #Assurance #SecurityDesignPrinciples #MinimizeDetectability #APT #SystemResilience #ComplexSystems #AttackSurface #SystemsThinking

41

https://lnkd.in/eDnTHnH8 Well not really, but hey its Friday and we wnated a meme didn’t we? Read on: Detangling a Confusing Threat Detection for SaaS Landscape #infosec #cyber #partner #threat

19

I recently earned my Open-Source Certification (OSC) from the OSMOSIS Institute. The OSC certification recognizes my proficiency in several key areas: - Investigating Businesses: I have a proven ability to collect, analyze, and report on organizational information using publicly available data and breach data to identify and mitigate risks. - Investigating People: I excel in collecting, analyzing, and reporting on personally identifiable information using publicly available data and social media platforms. - Network Data and Infrastructure Analysis: I am skilled at discovering and analyzing information about domains, IP addresses, certificates, and networks. - OSINT Methodology: My work demonstrates a thorough understanding of the common goals and applications of Open Source Intelligence, with the ability to execute fact-based investigations supported by detailed documentation. - Privacy and Operational Security Fundamentals: I am adept at identifying confidentiality and integrity risks during OSINT investigations and implementing best practices to minimize exposure and vulnerability. - Searching, Collecting, and Processing Data: I effectively use search engines and simple automation to collect, process, and analyze data and metadata of varying sizes and formats. This certification not only confirms my capabilities but also enhances my ability to provide comprehensive and accurate insights to clients. I look forward to continuing to leverage these skills to deliver exceptional results in my investigative work. https://lnkd.in/gddN7qp3 Southwest Louisiana Process Service Louisiana Private Investigations and Intelligence Agency #privateinvestigator #processserver #skiptrace

29

6 Comments

I'm looking at the world, the web and watching how everyone blames CrowdStrike for a faulty update, when in fact, I think they're the least to blame. Corrupt files happen. You can have the best build tools, CI, QA, between there and another machine out in the wild, a lot can and does happen, so why exactly aren't we pointing the finger at the shaky foundations of our IT infrastructures? What happened to redundancy, defensive programming and graceful degradation? One corrupt file takes down vital services across the globe?!? Gimme a break. From Microsoft to every single organisation affected, it's everyone's fault this happened. #programming #CrowdStrike #Microsoft https://lnkd.in/eU6jGCRp

24

5 Comments

The post Michele Sollecito wrote today about technical books authors reminded me of a thing I wish I knew when I started my own journey as an author. There is a concept of "minimal qualified reader". This is one of the most important (and often neglected) concepts. This is what can make your book succeed or fail. A minimal qualified reader is a person with sufficient knowledge to be able to understand your book. You have to think about what kind of person that is. It helps if you outline the skills and knowledge they have to have. You have to be fairly specific. For example, "knowing JavaScript" is too vague. You have to think about specific areas of JavaScript such a person should be competent in. This will help you to avoid a situation where your book isn't really suitable for anyone. Without it, you may end up with a book that a novice won't be able to understand because some key material is way too advanced and an expert won't want to buy because most of it is what they already know. In any software engineering discipline, there is a long scale of skill levels. You have to tailor your book to readers whose skill level resides within a specific and a relatively narrow range on this scale. If you try to cast your net too wide, your book will guarantee to fail.

15

1 Comment