Tristan Weir

A colleague sent me a link to Bob Lord's Thanksgiving "I'm thankful for TLS" post, The Quiet HTTPS Revolution https://lnkd.in/gCx2uxdU Good article, and TLS is doing a ton of work for all of us. Lest we forget about the pitfalls of metadata, however, if you're trying to achieve reasonable (not over-the-top) security, other fundamentals like the DNS exhaust from browsing should be protected, as well. Otherwise, someone that would have been in position to view the unencrypted trafffic can still make accurate guesses on what you are up to. Also, let's not forget to give a heartfelt thanks to the Electronic Frontier Foundation (EFF) for creating Let's Encrypt and Certbot, without which, millions of sites would still be without trusted certificates.

13

Last night I spent some time talking to a few dear friends calming them down, helping them to sanity check, and navigate evacuating the fires in SOCAL. Though they don't work in our industry, several of you have met these friends over the years. It reminded me of the principles that I keep in working incident response. I leaned on: 1. Being the most calm. 2. Being empathetic. It's ok for people to feel negative emotions, especially during events, I lean on understanding and channeling those emotions. 3. Assist in making action-oriented decisions smaller and more numerous. People, including you, make mistakes in responding to events, making decisions smaller and incremental gives people the opportunity to make smaller mistakes. In this case this meant asking questions about their driving, their speed, their gas situation, their fog lights, etc. Each of these are small decisions that can help people calm down and focus, as well as keep them safe. 4. Helping them avoid pitfalls. 5. Being honest. If I didn't know things I told them. If I knew things, I told them why (experience, news article, whatever). I also follow a mantra of: 1. Manage safety first. 2. Manage convenience second. 3. Manage emotions third. Getting folks to a safe spot is obvious, managing convenience to reduce the immediate challenges is important, but people often confuse this for the first priority. Knowing that it comes second enhances the first priority. Having emotions come last allows people to feel but also let's them know that their feelings don't influence what keeps them safe and what is most convenient. Always remember to communicate, even over communicate, your thoughts and focus on a mantra, your underlying focus is on their long-term well-being. Be flexible for people, but stringent on your principles. I remind folks that this is what I do. For 20+ years now, helping folks in situations, at it's core, is what I do. In professional terms since Blaster and MyDoom. Over that time, it became ingrained in who I am. Let them know that you're honored you could be on the other end of the phone in that situation with them. You're there for it. And lastly, maybe the most important. When everything is all said and done, whether it's a week, a month, whatever. Ask if they're ok. Over the years I've played virtually every role in industry in events (interim CISO, response commander, responder, SME, whatever), as I reflect on that, I recognize that these principles and steps have helped from all of those angles. My heart goes out to everyone affected by the fires in SOCAL. Be safe and take care of each other.

43

I propose a new rule. If you're going to publish a "Predictions for 2025" thought/opinion piece, you should also publish an accuracy report of how your predictions for 2024 played out.

31

3 Comments

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

48

8 Comments

The Sunday after "CrowdStrike Day", I was flying from Minneapolis to home. We didn't have a copilot, so it looked like we were not getting out of town until the following Wednesday. That's right, all the flights home were cancelled/booked and the earliest was Wednesday. We sat from noon until 9:00PM, when a Delta Air Lines pilot, who was deadheading home on a flight at an adjacent gate, and after hearing what was going on, volunteered to copilot our flight. It took a couple of hours of their operations center to approve the move, but when they did, we got off the ground and home. I've thought about that a lot recently. How that pilot was engaged in Delta's mission. Things were bad, and he could help. So he chose to. Others might have taken the opportunity to just head home and get out of the craziness. Others might not have not have put two and two together to see how they could have made a difference in that situation. In the end, what Delta Air Lines and that pilot did not only got us home, but it changed my mind about the airline from neutral to positive. I have seen some behaviors and comments about younger generations being skeptical and jaundiced to working for organizations. Doing only the required work, and being vigilant that the organization they work for not overstep. To a degree, I am okay with that. I believe in the fair value exchange for labor. I do work, you gimme money. But there comes a point where you have to realize that stepping up is good for the well being of the organization and your rewards & future with it. If that pilot passes on the flight and tucks in at home, there's ~200 people and their families that might not choose that airline first anymore. Multiply that over 100 to 1000 pilots, and it starts to make a real difference to the fortunes of the organization that provides your income. Finding that balance, and being an organization that holds true to its values regarding work life balance will ensure that you have the reserve of commitment that Delta Air Lines had that night in Minneapolis. Many thanks to the crew and ground support staff in Minneapolis. Y'all were champs that day.

77

7 Comments

"The National Vulnerability Database is broken, and there isn't an easy fix." "At least 9,762 CVEs currently remain unanalyzed by the NVD, according to NIST data. The number is likely to increase. As of Monday, NIST has analyzed only two of the nearly 2,000 new CVEs received in May." ===> Scan is getting harder, zero-trust runtime protection is critical, SUSE NeuVector has both! https://lnkd.in/gg_fhEEC

10

1 Comment

Compromise a cloud service, and tens thousands of vehicles can be affected at once. Matt MacKinnon of Upstream Security walks us through the world of cloud security for connected vehicles, transport trucks, tractors, and other "stuff that moves." Hitting Tens of Thousands of Vehicles At Once | Listen to The Industrial Security Podcast Episode 131 ➡️ https://bit.ly/4eN2c7N

10

Some insights on anxiety in cybersecurity from the amazing Peter Coroneos. Your thoughts?

3

Palo Alto Networks #unit42 CDSS #securityresearch team have identified two vulnerabilities in #LangChain. These two #cve could have allowed attackers to execute arbitrary code and access sensitive data, respectively. LangChain has since issued patches to resolve these vulnerabilities. This article provides a comprehensive technical examination of these security issues and offers guidance on mitigating similar #genai #threats in the future. https://lnkd.in/gc7dP88v

43

Grateful to VMblog for the chance to share my insights on public safety cybersecurity predictions. Key topics include: - Emerging Threats - Cloud Adoption Trends - Funding Challenges - Framework Adoption Dive into the article for an in-depth look at these critical themes. Your thoughts and feedback are always welcome! #CyberSecurity #PublicSafety #CloudAdoption #Funding #FrameworkAdoption #CyberThreats

8

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

Reminder to stay vigilant for individuals exploiting those affected by the fires. In times of crisis, like the ongoing fires, it's crucial to be cautious of scammers. Reputable organizations like the American Red Cross and the Los Angeles Fire Department Foundation are reliable avenues for donations. Unfortunately, during disasters, malicious actors exploit the situation by launching phishing and fake donation schemes. Stay informed and safeguard yourself against these fraudulent activities. Stay safe.

25

2 Comments

SoCal CISO Community, please join me in welcoming your newest Governing Body member, Julie Harris, CISO at PulteGroup! Tomorrow at 2pm PST, you can find Julie and many other CISOs from your community convening for the final CISO Townhall of 2024. Join virtually tomorrow to discuss: -Enhancing cloud security and cost-effectiveness across diverse cloud environments through managed security services -Leveraging AI innovations while addressing global regulatory and data privacy standards to strengthen security strategy -Sharing best practices for implementing effective cloud security operations across a global footprint to ensure resilience and compliance Register now at My.Evanta.com! #socalciso #evantaciso #aisecurity #cloudsecurity

24

1 Comment

Palo Alto Networks #unit42 CDSS #securityresearch team recently figured out a simple yet effective way to #jailbreak #llm called Deceptive Delight. Deceptive Delight is a multi-turn technique that engages LLM in an interactive conversation, gradually bypassing their safety guardrails and eliciting them to generate unsafe or harmful content. We tested this method in 8,000 cases across eight models. We found that it achieves an average attack success rate of 65% within just three interaction turns with the target models. Deceptive Delight operates by embedding unsafe or restricted topics among benign #prompts, all presented in a positive and harmless context, leading LLMs to overlook the unsafe portion and generate responses containing unsafe content. https://lnkd.in/gdhafcxr

51

I've been wondering about the relationship between Kahneman's dual system view of the mind and GenAI. Specifically, I suspect that GenAI maps fairly well to System 1 thinking. Any thought process that you can train a human to perfrom instinctively/reflexively, you can also train GenAI to perform. But that's also its limit. Conscious thought and deliberate decisions are products of System 2 thinking, which GenAI is not capable of.

30

5 Comments

In all my trainings I always talk about restarting our phones weekly. In this article, the author reiterates how the NSA recommends this as well. As Neal Ziring, technical director for the NSA's Capabilities Directorate, told the AP a few years back, rebooting your phone isn't going to stop the more sophisticated schemes, but "since a lot of modern cyberattacks are [a] chain of two, three, or even more vulnerabilities in a row that have to be successfully exploited...you can reset the adversary back to the beginning of that chain and force them to go through the whole thing again" by rebooting your device. https://lnkd.in/evPD8Sbj

9

1 Comment

The SoCal CISO Summit is only 3 weeks away! Don't miss this all-star lineup with Emily O'Carroll, Jonathan Chow, and Arthur Lessard, discussing "The Imperatives of PAM" on May 21st. Organizations have suffered relentlessly from cyberattacks, each week it seems there are new headlines highlighting ransomware attacks or data breaches. With the sensitivity of privileged accounts, unpatched vulnerabilities, and an extensive remote workforce, privileged access management (PAM) is essential to securing your most critical systems and data. Join this panel session to discuss: -Why PAM plays a crucial role in mitigating cyberattacks -Gaining executive buy-in on effective solutions -Having a proactive approach to implementation and configuration Qualified InfoSec leaders, register below! #evantaciso #socalciso #informationsecurity

59

4 Comments

The riskiest project for most security teams is insider risk management. In my experience, most of these initiatives will drag on as a science project for a few years before being scrapped by new leadership. That’s reflected in industry stats like 88% of insider threats taking over a month to detect. The problem? We’ve mixed up insider threat detection, user behavior analytics, and machine learning. By now, we should recognize that catching malicious insiders is hard and that anyone counting on an AI/ML magic solution is dangerously optimistic. That’s why this week’s post channels one of the 20th century’s most famous pessimists. It presents an approach to insider risk detection that is much more likely to succeed and has applications beyond insider risk. Introducing “Mencken’s Law of Threat Detection”: Never rely on machine learning to detect a threat you haven’t modeled. Read on at the link below.

48

3 Comments