mastodon 4.8.0-alpha.3+glitch#SBOM Champion. Paranoid about supply chains of all kinds. Former full-service technocrat at CISA, NTIA. Lapsed{engineer, academic, author}. Now wandering the world doing acts of infosec-goodness, and occasionally getting paid for it. Poster of food pics.
Friends: in light of recent news, may I encourage you to get the Shingles Vaccine if you are eligible (over 50 or have immune system issues) and encourage others in your life to get it.
Shingles took me out for two whole months last year and was incredibly painful. I still have intermittent nerve pain in my face that wakes me up in the middle of the night.
I'm embarrassed that we still need to say this, but:
Trans rights are human rights.
I have trans friends, and they are every bit as annoying and wonderful as all my other friends. Many of them are way better hackers.
And we should all be annoyed that, in the US, even just flying through a major transit airport could be a real threat to their lives and wellbeing.
Amazing opening keynote at @bsidessf@infosec.exchange by my old con buddy @bubblewire@infosec.exchange making the case for *optimism* in a very tumultuous time for the security community.
Why to be optimistic?
1. “The Room where it happens” Security is now increasingly part of strategic institutional decision making. Beyond just tech to real influence. 10 years ago, who wanted hackers in the room?
2. We have learned to design for humans, not against them.
3. Started to focus on what actually moves risk. Real skepticism of rote vendor solutions. Better at calling bullshit and focusing on what solves real problem
4. Barrier of entry are lower. Abstractions allow more people to engage in security. Everyone can be a builder. We depend on creativity and experimentation. Security practitioners are becoming builders.
5. Legacy risk might finally be tractable! AI tools can read, understand, and transform the legacy cold bases. We can imagine burning down technical debt.
6. We can pave things from the start - new providers are thinking about security “with a heightened awareness” New AI leaders have invested in security. Not a first priority, but maybe second or third, rather than bolt-on.
We have managed massive transitions in the security space before (cloud native!).
She also reminds us that the entire security community is built on just that: community. We share, we build collaboratively, we rely on alliances and nonprofits and standards orgs.
Table next to me at the coffee shop are senior firefighter policy folks talking about CERTs (community emergency response teams) and the language is similar enough to infosec that my ears won't stop firing cyber interrupts into my conscious brain.
A nice moment in the McRary Institute Cyber Summit. Army Cyber Advisor Brett Pugh acknowledges that CISA and its hardworking expert staff are carrying on with their critical mission without getting paid.
My former teammates are doing damn good work in a very rough time.
A very happy birthday to everyone who spent time to pick something other than Jan 1 for their fake birthday!
Many happy returns, and I hope you get a free ice cream cone somewhere. (Do they still do that?)
Impressed by the new ZeroDayClock effort/collective/call highlighting that the window between vuln and exploit now must be assumed as t=0.
The call to action is solid, though sadly nothing terribly new. Secure by design, adapt policies and practices. Liability, eridacate classes of vulns.
Hi Friends! You have one week to submit to The Diana Initiative, an amazing infosec conference aimed at fostering more inclusive information security industry. I understand that they are particularly interested in Red Team talks, so please circulate to those who would be interested.
Tired: the meeting could have been an email.
Wired: This email could have been both written and read by an LLM.
Anyone know of research on how people “discover” new open source that they want to use? Does one search GitHub for strings relevant to what they are looking for? See code used in other projects? Are there other registries?
“Shadow AI is like regular AI, but with cooler hair and music.”
@k8em0@infosec.exchange blows away @bsidessf@infosec.exchange by singing a very sarcastic “You’ll Adapt” to the tune of Hamilton’s “You’ll be back.”
Her talk did not shy away from the potential human impact of a massive shift to automation, and the need to think about politics in this context.
Heading off to @bsidessf@infosec.exchange ! (And the other conf) Hope to see you there.
A gorgeous 2 mile walk across DC and the National Mall to make it to Day 2 of @DistrictCon@infosec.exchange and the entertaining keynote by Daniel Ridge.
Feels pretty special… “hackers now a-bed Shall think themselves accursed they were not here,”
If anyone is making the hard choice not to attend #DistrictCon because of the weather, I will happily buy your badge.
Last day of RSAC conference. Once more into the breach [response and recovery AI tooling sales talks]!
@risottobias@toot.risottobias.org ha! Glad I wasn’t the only one.