mastodon
4.7.0-beta.1
CEO & Co-founder at Corridor.
Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
I told Congress the story of how I got into hacking: winning the Hack the Air Force competition at 17, and helping start Stanford's bug bounty program as a freshman.
While we've made progress, we need to do more to normalize security research. I called on Congress to reform the Computer Fraud and Abuse Act by exempting good-faith security research.
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
New from Jen Easterly and me: as threats to our critical infrastructure increase, U.S. policymakers need to defend + strengthen the role of security research. This is personal for me, having received legal threats for good-faith security research.
We call on Congress to protect security researchers by codifying the DMCA security research exemption, exempt good-faith security research from the CFAA, and require software vendors to operate a VDP and publish CVEs.
https://www.lawfaremedia.org/article/advancing-secure-by-design-through-security-research
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
After two incredible years, today is my last day at CISA. Immensely grateful to have been able to drive CISA's work on Secure by Design, spurring commitments from 250 software manufacturers and publishing guidance with over a dozen int'l partners.
My exit interview: https://cyberscoop.com/jack-cable-cisa-secure-by-design-exit-interview/
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Excited to share new research w/ Ian Gray and Damon McCoy, where we leverage novel heuristics to identify over $700 million in previously-unreported ransomware payments. We publish our set of payments, which when combined with the Ransomwhere dataset totals over $900 million in ransomware payments — several times larger than any existing public dataset.
Read here: https://arxiv.org/abs/2408.15420
Get the data: https://github.com/cablej/showing-the-receipts
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Extremely excited to launch CISA's Secure by Design Pledge today — where 68 of the world's leading software manufacturers are committing to demonstrating measurable progress around secure by design in seven specific areas over the next year. This is a major step forward in our efforts to increase adoption of secure by design principles.
Read our announcement: https://www.cisa.gov/news-events/news/cisa-announces-secure-design-commitments-leading-technology-providers
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Today, I published in the Harvard Business Review on how business leaders of software manufacturers can prevent ransomware attacks at scale with more secure by design software.
The vast majority of ransomware attacks are enabled by a software design defect or insecure default configuration. It's up to software manufacturers to raise the tide and help secure everyone.
Read here: https://hbr.org/2024/04/preventing-ransomware-attacks-at-scale
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Four years ago, as a computer science student at Stanford, I wrote what felt like a simple observation: I wasn’t required to take a security class, and neither were my peers.
It’s now 2024, and we’ve made little progress in educating developers. It is long overdue for academia to reconsider their role in producing a software developer workforce that writes defective software.
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Great joining @RosenzweigP@mastodon.social on the Lawfare Podcast! Tune in for some holiday listening to hear from Lauren Zabierek, Bob Lord and me on CISA's path forward on Secure by Design.
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Have thoughts on Secure by Design? Yesterday, we announced a Request for Information on Secure by Design.
Have thoughts on eliminating classes of vulns, security education for developers, economics, AI, OT, and more? Check it out and respond (by Feb 20): https://www.federalregister.gov/documents/2023/12/20/2023-27948/request-for-information-on-shifting-the-balance-of-cybersecurity-risk-principles-and-approaches-for
CEO & Co-founder at Corridor. Previously: Senior Technical Advisor at CISA, TechCongress in the Senate, Krebs Stamos Group, CISA, Defense Digital Service, and Stanford.
Memory safety vulnerabilities are the most common class of vulnerabilities, and have enabled some of the most damaging cyberattacks in recent years.
Fortunately, most memory safety vulnerabilities are preventable. CISA and our partners’ guidance on memory safe roadmaps gives companies a path forward to protect their customers by eliminating this class of vulnerabilities. We urge companies to develop and publish their memory safe roadmaps and lead by example.
Read more: https://go.dhs.gov/oyE