Seth Spergel

Thanks Michael Bishop, @Marius Kleidl and Rich Salz for documenting #HTTP API #antipattern with HTTP API Keys and Privacy I-D https://lnkd.in/gt4f5iwa and providing guidance. Redirecting HTTP requests to HTTPS, a common pattern for human-facing web resources, can be an anti-pattern for authenticated API traffic. This document discusses the pitfalls and makes deployment recommendations for authenticated HTTP APIs. It does not specify a protocol....This document describes actions API servers and clients should take in order to safeguard credentials.

21

1 Comment

Read about automating your cybersecurity compliance, safeguarding customer data with ownership, and bulletproof documentation with the latest from Deadbolt Security https://lnkd.in/epVahtXD

7

The Forbes 2024 Cloud 100 List is live ☁ Congrats to all the honorees – the world's top 100 private cloud companies –including the 3 healthcare and life sciences companies featured this year: • Benchling - biotech R&D platform • Komodo Health - healthcare data analytics • Abridge - AI for clinical documentation For more on how AI is colliding with cloud computing, check out Bessemer Venture Partners's 2024 Cloud 100 report. Personally I'm focused on advancements in multi-modal AI, as applied to biomedical applications (Trend 3!): https://lnkd.in/euzurvQV

36

1 Comment

Hey vCISOs, looking to add new services without adding headcount? Imagine this scenario. You’re a small but growing vCISO firm, and your clients are asking for more tactical help - MDM, cloud architecture, engineering, etc. It feels like a business case for expanding, but there’s one problem: you don’t have the headcount. Hiring specialists for each service is risky and expensive. Contractors are a pain to manage. And let’s be honest... You're not sure you’ll have the consistent client volume to justify it yet. But what if you could offer more services without needing to hire? With Zip Security, you can. Instead of adding full-time staff, you can plug in best-practice workflows for MDM cloud posture and security management... Instantly. Now you can offer additional value, boost revenue, and meet client demand without expanding your team. • Pre-built configs and workflows • Real-time insights to manage and optimize • Automated reporting that gives you full visibility You get to expand your service offering, grow your revenue, and keep your overhead lean. Stop waiting for the perfect moment to grow. Start expanding your footprint today, without the risk. 👇 Link to a live dashboard in comments.

16

5 Comments

Ready to speed up the process of obtaining certs like NIST 800-53, FedRAMP, PCI DSS, NYDFS, SEC, FFIEC, and DORA? RegScale's brief on rapid certification outlines how RegScale's automation and expert-designed processes accelerate the certification process. Check it out here: https://loom.ly/WSysQZ4

8

1 Comment

Data poisoning and backdoor attacks on LLMs used for code completion currently go undetected if malicious payloads are directly integrated into code with minimal transformation / indirection (see code examples): https://lnkd.in/gz_HyWMu

3

My whole career has been at companies whose biggest competitor is business as usual. Cloud Virtualization Deduplicated back up Direct attached storage Automated resource allocation Hyperconverged infrastructure These were crazy ideas initially. Now they are industry standards. Not because they are cool. But because the business outcomes they drove were powerful. Powerful enough to cut through the political and organizational debt that exists in every large company. Powerful enough to CREATE budget for. Powerful enough to change the way people thought about solving a problem they’ve dealt with for a long time. Shift Group is different in that we don’t solve a technical problem, but the problem we solve is a function of business as usual. Posting jobs online, going through resumes, spending time screening candidates that aren’t a fit, hiring people that are not committed to success and then realizing it too late. High attrition. Slow ramp time. Onboarding risk. Every single company in the world deals with these problems. Our brains are so broken through years of conditioning companies actually brag about the problem!!! “We get 1000 applicants for every job post” Sick bud - then what happens? Wasted time, money, and energy - that’s what. I’ve seen this movie for 2 decades and I know how it ends. We will change this. We will be the industry standard. #AllGasNoBrakes #DialedIn

123

5 Comments

Ransomware can put SMB and critical infrastructure at risk. Kymberlee is taking the stage at Labscon to talk about the work we’re doing in this space

3

Implementing phishing-resistant multi-factor authentication (MFA) is crucial in today's threat landscape. Axiad Cloud FedRAMP: - Turnkey Solution: Combines PKI and FIDO2 authentication. - Compliance Made Easy: Meets federal mandates efficiently. - Unified Platform: Simplifies management across users and devices. Enhance your security posture and accelerate Zero Trust adoption with Axiad.

5

need to read this one

1

If it’s true that Thoma Bravo is once again exploring a SailPoint IPO, a few things need to happen for the exit to succeed. On the surface, this move seems like it's defying the odds for a normal four-to-seven year private equity holding period. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for over 1,000 days (and counting). Current market conditions are anything but favorable, at least for anyone other than the crème de la crème of the IPO pipeline. SailPoint is anything but typical, though. I'm not convinced they even needed to go private in the first place, but here we are. News of an impending IPO is exciting to anyone who (a) likes SailPoint, and (b) wants this IPO drought for our industry to end. This is far from a done deal, but it's credible enough to do some educated speculation about what it might take for SailPoint to go public again and stay there this time. My latest article is about the metrics, narrative, and alternatives that could lead to a second SailPoint IPO. You can read more by following the link on my profile.

37

4 Comments

‘How much work does it take to switch to a 3rd party software licensing solution?’ I spoke with a software vendor this week, who had recognized the value of 3rd party software licensing solutions. He was tired of the hassle of in-house licensing systems, the complexity, integration issues, and maintenance burdens. He wanted to make the switch to a software licensing solution provider, but was worried about the workload. So he asked me, candidly: ‘How much work are we talking?’. After many years working in the software licensing space, we've streamlined integration through readily available resources. 10Duke offers SDKs and sample applications, providing a simple and familiar way to access our APIs using your preferred programming language or framework. These SDKs handle user authentication (OIDC) and obtaining access tokens for authorized API calls. Some even manage license consumption and other functionalities. We offer SDKs for C++, C#, Java, .NET, Angular, and React. Transitioning to a third-party licensing system is a strategic decision, which requires a level of short-term commitment, but with our robust SDKs, the heavy lifting is already done. This significantly reduces the time and effort required from your development team.

13

🚀 Justin McCarthy has the answers! Tune in for a short overview on: ✅ Managing Resource and Role Explosion in Complex Enterprises ✅ Scaling Authorization for Dynamic Workloads ✅ Tools for Auditing and Improving PAM Systems ✅ Balancing Complexity in Authorization with Ease of Management ✅ Addressing User Lifecycles in a PAM Environment

3

Feds: Critical Software Must Drop C/C++ by 2026 or Face Risk >> Great piece by @darrylktaft on how #TechDebt is piling up and creates security risks. #NextGenApps

4

1 Comment

Is your MapReduce system of analysis aging out? Anomali has reinvented how the world is approaching Observability and Security. Let me show you what the next decade will be like. https://lnkd.in/g3dX9HRc

15

Learn more about Decentralized Web Nodes from Andor Kesselman!

25

1 Comment

Forrester couldn’t have put it more clearly. "Simply put, it’s the right moment for businesses to build an API security landscape that addresses the modern challenges head on." "According to Forrester’s research, API security software is no longer a “nice to have” but a necessity." I would add: It’s time to shift from reactive to proactive API security - anticipate those business logic related threats before they escalate. Time to grab a Pynt! #apisecurity #apisecuritytesting #proactiveapisecurity

39

This is good news. And I know, I've heard all the arguments. We hate "eavy-handed regulation" and "regulation impedes innovation" and "we don't like governments telling us what to do." Whatever. Opponents of the move trotted out the same old canards from 10 years ago: net neutrality equals heavy-handed regulation, rate control, the smothering of innovation — general arguments that never really had much weight. As Chairwoman Jessica Rosenworcel points out, the FCC already exerts rules with this authority (like with Title II, for those of you who’ve been with us from the start) in other areas, and they aren’t overcome with Draconian rules and limits. And lest you think it doesn't matter to you personally, here's a snippet from the article: "The FCC recently redefined broadband as being 100 megabits up and 25 down. I got an email from Xfinity the morning that change took effect, telling me my speeds had been magically updated at no cost to me. Generous, right? Of course, if the FCC hadn’t done that, I would have just paid more and more for the lowest speed it felt it could get away with." The least they can get away with is often what broadband providers will do. That's how it works. Leveling the playing field, especially for SMBs and for those in traditionally underserved areas is important. And sometimes, protecting the interests of many requires regulations. #netneutrality #fcc #broadband

8

1 Comment