@benrothke@infosec.exchange

Ben Rothke @benrothke@infosec.exchange · Aug 03, 2026

Considering buying an honorary doctorate? Imagine sitting in a job interview while hiring manager asks where you earned your doctorate. Explaining that you purchased an honorary PhD isn’t the conversation anyone wants to have. Just don’t do it, or buy it. https://brothke.medium.com/when-dr-comes-with-a-receipt-f98e74114313?sharedUserId=brothke

0

Ben Rothke @benrothke@infosec.exchange · Aug 03, 2026

Beware of the Baseboard Management Controller (BMC). A 20-year-old BMC vulnerability gave researchers access to bare-metal servers & a foothold in the no man’s land of data center infrastructure. https://api.cyfluencer.com/s/how-we-hacked-thousands-of-data-centers-in-minutes-using-a-20-year-old-vulnerability-28807

0

Ben Rothke @benrothke@infosec.exchange · Jul 31, 2026

For first time in 19 years, @Verizon @VZDBIR looked at what happens after attackers get in. Mapped routes taken to privilege escalation. Real exposures live in the permissions, configurations & trust relationships along those routes. HT @XMCyber_. https://api.cyfluencer.com/s/the-2026-verizon-dbir-stopped-asking-how-attackers-get-in-and-started-asking-where-they-go-b088ea44-28759 #DBIR

0

Ben Rothke @benrothke@infosec.exchange · Jul 28, 2026

Shai-Hulud is one of the most persistent supply-chain worms in recent years. It’s a self-replicating worm & actively compromising packages with 3M+ weekly downloads, hijacking tokens from CI/CD pipelines, bypassing trusted publishing protections. #Shai-Hulud https://cybersec.gitguardian.com/s/mini-shai-hulud-a-persistent-supply-chain-worm-28699

0

Ben Rothke @benrothke@infosec.exchange · Jul 27, 2026

Good @jbhall56@infosec.exchange piece: He notes YoY #PCI #27001 audit efficiencies are only in 2%-4 % range. The real problem is a consultancy sales exec who thinks it’s >25% & lowers the audit price to make clients happy. It’s then the consultants who have to deliver. https://pciguru.wordpress.com/2026/07/27/the-audit-efficiency-myth/

PCI Guru

The Audit Efficiency Myth

I have been guilty in the past of agreeing to this and have always regretted it. Clients think that an audit/assessment is like assembling a widget. The more times you do it the faster and more eff…

0

Ben Rothke @benrothke@infosec.exchange · Jul 27, 2026

Interesting post by @bigidsecure on #ExploitGym, a cybersecurity benchmark designed to evaluate whether #AI agents can turn software vulnerabilities into working, end-to-end attacks. #HuggingFace shows that AI risks have gotten quite real. https://api.cyfluencer.com/s/a-model-a-goal-and-an-unlocked-door-28679 #infosec

0

1

0

Ben Rothke @benrothke@infosec.exchange · Jul 24, 2026

In the rush to secure AI, many forget about the data center & AI infrastructure security risks. The #FORGE #AI framework from #Lava, coming out of stealth, is quite compelling. It is about hardening the metal beneath the model. Something many forgot to do.
https://api.cyfluencer.com/s/the-top-10-data-centre-and-ai-infrastructure-security-risks-28621

0

Ben Rothke @benrothke@infosec.exchange · Jul 24, 2026

Anyone can call themselves Dr. But what happens when someone literally buys an honorary doctorate & uses title to gain credibility? I dug into the surprising industry behind purchased honorary degrees, ethics & risks. Read before you're impressed by "Dr." https://medium.com/@brothke/when-dr-comes-with-a-receipt-f98e74114313?sharedUserId=brothke

0

Ben Rothke @benrothke@infosec.exchange · Jul 22, 2026

In the rush to secure AI, many forget about the data center & #AI infrastructure security risks. The #FORGE framework from #Lava, coming out of stealth, is quite compelling. It is about hardening the metal beneath the model. Something many forgot to do.
https://api.cyfluencer.com/s/the-top-10-data-centre-and-ai-infrastructure-security-risks-28621

0

Ben Rothke @benrothke@infosec.exchange · Jul 21, 2026

Anyone can call themselves Dr. But what happens when someone literally buys an honorary doctorate & uses title to gain credibility? I dug into the surprising industry behind purchased honorary degrees, ethics & risks. Read before you're impressed by "Dr." https://medium.com/@brothke/when-dr-comes-with-a-receipt-f98e74114313?sharedUserId=brothke

0

Ben Rothke @benrothke@infosec.exchange · Jul 21, 2026

Fun fact: Don’t pay thousands for #Gartner reports, vendors mentioned in them often provide them free. This @Gartner_inc report on ‘Reimagining Network Microsegmentation: Beyond the IP — Identity, Context & Agentless Innovation’ courtesy of @ZeroNetworks. https://api.cyfluencer.com/s/gartner-reimagining-network-microsegmentation-28603

0

Ben Rothke @benrothke@infosec.exchange · Jul 20, 2026

#Argon2 is a key derivation function (KDF) designed to make brute-force attacks more computationally expensive by limiting advantages attackers gain from GPUs & other high-performance cracking hardware. Passwords getting close to being almost uncrackable. https://api.cyfluencer.com/s/new-research-does-argon2-mean-your-password-is-uncrackable-28589

0

Ben Rothke @benrothke@infosec.exchange · Jul 17, 2026

The thing about AI is that while it has massive potential & current value, too many are drinking the #AI Kool-Aid. Lots of firms are spending massive amounts on AI w/o a clue what they are trying to solve. They think AI is an IT pixie dust. https://medium.com/@brothke/the-ai-big-crunch-is-starting-c50612ee3a02?sharedUserId=brothke

0

Ben Rothke @benrothke@infosec.exchange · Jul 16, 2026

You know when ransomware is called ‘Everest’, it has to be bad. #Everest is a Russia-based Windows #ransomware & data-extortion operation. It encrypts files with the .everest extension & is linked to the #BlackByte ransomware. https://cybersec.picussecurity.com/s/everest-ransomware-triple-threat-of-encryption-access-and-insiders-28562

0

Ben Rothke @benrothke@infosec.exchange · Jul 14, 2026

#Gamaredon is a Russia-aligned APT, widely attributed to Russia's Federal Security Service. @mfa_russia attempted to infect over 1,500 Ukrainian government systems & ran 5,000 attacks by late 2021. They’re still quite active & dangerous. HT @PicusSecurity. https://cybersec.picussecurity.com/s/gamaredon-primitive-bear-apt-profile-and-mitre-att-ck-breakdown-28533

0

Ben Rothke @benrothke@infosec.exchange · Jul 14, 2026

Hear about the person who got a great board spot via #Boardsi? Neither did I, as that’s not how boards recruit. Many paid services promise to get people on corporate boards & lucrative advisory roles. I challenge you to find anyone who’s been successful. https://brothke.medium.com/get-on-a-board-but-maybe-not-with-boardsi-e05a0b56f7d2?sk=6e749be7f4b642f1ae4f6b6e273edfb5

0

Ben Rothke @benrothke@infosec.exchange · Jul 09, 2026

Many people are victims of identity theft but don’t have a clue how to recover from it. What does one do if they’re hacked? #Psono has a practical step-by-step guide to containing damage, recovering accounts and reducing the risk of being hacked again. https://api.cyfluencer.com/s/what-to-do-if-you-get-hacked-28447

0

Ben Rothke @benrothke@infosec.exchange · Jul 08, 2026

Securing the modern onboarding process is challenging. Employee onboarding always relied on the service desk. Now service desk is the target. AI-powered attacks & remote/hybrid work are 2 of many trends making this a very risky area. HT @specopssoftware https://api.cyfluencer.com/s/a-guide-to-secure-employee-onboarding-in-2026-28418

0

Ben Rothke @benrothke@infosec.exchange · Jul 08, 2026

The irrational exuberance that AI was a cure-all is starting to crack. Starting to see massive pushback on #AI projects that have failed miserably. Everyone hates dealing with #HR & customer service AI agents, & now firms are paying dearly for the mistake. https://brothke.medium.com/the-ai-big-crunch-is-starting-c50612ee3a02

0

Ben Rothke @benrothke@infosec.exchange · Jul 08, 2026

Great Dr. @RanigaVinay of @UniofOxford @BlavatnikSchool video details how utterly corrupt @FIFAcom @FIFAWorldCup is. #FIFA has zero oversight & is a cash cow. The work of Chuck Blazer, former @CONCACAF General Secretary, has sadly done little to change FIFA. @drvinayraniga@www.youtube.com

0

Ben Rothke @benrothke@infosec.exchange · Jul 06, 2026

For the first time, @VerizonBusiness @VZDBIR ran attack graph analysis on real environments, mapping users, groups & permissions to model what happens after an attacker gets in. #DBIR found that 16% of organizations had about 80% exposure. HT @XMCyber_. https://api.cyfluencer.com/s/the-2026-verizon-dbir-stopped-asking-how-attackers-get-in-and-started-asking-where-they-go-28369

0

Ben Rothke @benrothke@infosec.exchange · Jul 06, 2026

It’s not that #AI emperor has no clothes, just it’s radically less than it's made out to be. Many firms experiencing AI regret, bringing back employees prematurely laid off & trying to recover from devastation caused by AI. My take on the AI big crunch. https://brothke.medium.com/the-ai-big-crunch-is-starting-c50612ee3a02

0

Ben Rothke @benrothke@infosec.exchange · Jul 02, 2026

My @OneRSAC book review of: How AI and Quantum Impact Cyber Threats and Defenses: Reshaping Your Cyber Defense Strategies. Another great book by @rogeragrimes@infosec.exchange. Details the coalescence of #AI & #quantum. A really good #infosec read. #RSAC https://www.rsaconference.com/library/blog/bens-book-of-the-month-how-ai-and-quantum-impact-cyberthreats-and-defenses

0

Ben Rothke

Posts

The Audit Efficiency Myth

Remote instance