Matt Raible

If you or your company don't do any business selling software or hardware with embedded software to the federal government, you can be forgiven for not knowing about this. With that said, you should because, like all major regulations, they tend to get adopted elsewhere. What I am talking about is the SSDAF. This is the Secure Software Development Attestation Form put out by Cybersecurity and Infrastructure Security Agency last month. This is a sea change in how Cybersecurity is handled with the business, in the form of the CEO (or delegate), must sign the form attesting that the software developed followed secure coding practices. Check out my article that goes in-depth on the SSDAF. #wwt #wwtatc #globalcyber #appsecurity #appsec #apisecurity #aisecurity #devsecops https://lnkd.in/gZ-6MD6U

14

Dev agencies, if you don’t want to be treated as a commodity, stop acting like one. - Learn the business context for engineering needs - Stop squeezing your clients every opportunity you get - Prioritize transparency, communication, and accountability In short, position yourself as a partner that uses tech to solve business problems. You really can’t complain about being seen as a commodity if you treat everything as a transaction.

1

1 Comment

The future of engineering design and coding is about here. Imagine simple text prompts that assist your software engineers in designing and coding complex systems, saving thousands of hours and months of work. Getting a smart code base and avoiding the dreaded Tech debt. I see Pledgecircle using AI engineer to assist with our 5 zero-to-one components system designs. It's a new world to build.

3

I've seen a lot of bugs. (No, not another cicada post). Software here. Egregious, immediately noticeable bugs. The opposite - those that require 6 concurrent conditions and 6 hairs from your nextdoor neighbor and it still only triggers once a month. (Okay, 7 conditions, 6 hairs...don't split those hairs). A continuum of buggage. Those complicated ones, sans the hyperbole - those are your Zero day issues. Regression testing doesn't find them. A super wily code-reviewing look-at-it-all software QA professional (I know the best one)...might...but probably not. How do we even engineer testing all of the complicated conditions? The interrelationships at runtime? I don't see a lot of talk about "how could we have caught this?" in public for disclosed issues. Most of the fixes for Zero days (those security holes best known because they're patched with updates to software like Google Chrome browser, Apple's ioS, Microsoft Windows) are downplayed. You get "Hey, user, look at these new features you're getting, and in whispered voice, "and security updates." Not familiar with the term? Zero day means a security issue without a patch. When the patch arrives, there's a remedy for the problem. Users often don't APPLY the remedy until much later...its own problem...prolonging the risk of the Zero day issue. Back to my kinda silly example. That's a wicked hard problem to test for. A bunch of concurrent situations that then trigger the problem. But, when the problem's a known issue, it's not hard to re-trigger. And therefore exploit. So what do we do? Other than fixing/patching, and communicating? What else is there to add to this conversation? Sunday thoughts. Sunday thoughts.

13

7 Comments

Hey all. Anyone have any recommendations for a product/service that can help identify/remove private information that’s exposed on the Internet? For example name and address, DoB etc. Obviously we’re a bit screwed when it comes to the dark web, as most people’s details have been hacked at least several times, if we are to believe the figures of 40bn plus hacked/exposed records, but tackling the obvious attack surfaces first would be good. In one place.

3

4 Comments

#sobering data for 2025. Think about your corporate data as well as your personal. Maybe think about getting some DNS and NGFW white-labeling. Remember, you can do both things at the house for #free (free as in free-beer, not free as in free-puppies). Cheers!

29

9 Comments

A Call to Action for Cybersecurity Accountability This incident is a sobering reminder of the serious responsibilities held by those in positions of public trust. Protecting sensitive information requires more than good intentions—it demands rigorous oversight, commitment, and a culture that values security as a shared responsibility. For agencies and organizations with public-facing data, this is a wake-up call. Let’s demand accountability, enforce strong security practices, and work to create a future where these preventable mistakes are no longer headlines. Do you agree with Colorado Secretary of State Griswold's statement, "This is not a security threat”? Cyber CEO Tech Entrepreneur and Dad to a dozen helping business leaders, secure, and scale their organizations and GSD.  #CyberCEO #GSD #GetSuccessDelivered

3

How to knock veteran programmers down a peg. Test them on this: What if a meeting scheduled on the exact minute a leap second is added needs to be rescheduled to the next available "normal" minute? Tests that asses someones skill as a human compiler or quiz them about obscure language features are a poor way to find out whether they can actually deliver value to a company.

3

Articles like these are why I use Brian Krebs articles in my workshops. If you want to learn how follow investigative thread to track down miscreants, see if you can copy one of Brian’s step by step investigative paths. https://lnkd.in/gbZDiH6Z

8

1 Comment

Agents are getting really really good at programming, try this agent out: https://buff.ly/4cY7vRk I use this agent every single day multiple times a day to build functions with documentation, error handling, and type validation. It's overpowered.

1

Shift Everywhere to take advantage of the right testing activity at the right time. This topic was also discussed at length on the In-Secure-Ity Podcast: https://lnkd.in/e2ACeKdC

1

When there is great uncertainty, there can't be predictability to any useful level. We have to reduce uncertainty to where it can be managed effectively, and we do this by running experiments... trying things. Does the stakeholder like what we've done? Does the customer like what we've done? Are we solving the problem that customers have? This puts us in the 'complex' quadrant of the Cynefin Model, where we have to try and (perhaps) fail, perhaps repeatedly, until we know enough. Yet, we still have a goal in mind and we at least know the first few things that need to get done... or the first thing we need to test to determine feasibility. Apple knew that unless it could source a ruggedized hard drive that would withstand being carried and occasionally dropped, the iPod would not be successful... so getting a commitment from Western Digital (who had been working on such a drive and was almost ready to ship) was the key decision point. The Wright Brothers knew that unless they could figure out a way to turn their airplane without 'skidding' and stalling a wing (a problem that had killed many of their inventive contemporaries) they couldn't build a safe airplane... oh, and find a lightweight, powerful-enough motor while you're at it. It all comes down to reaching decision points: do we know enough to know whether to continue, or whether to cancel our effort? In the example below (waterproofing a below-ground basement), we are going to have to continue. Therefore, we want to continue only at the pace at which we are certain of the decisions we're making. Is what we're doing working? If so, do more! If not, do something else. That is exactly what the contractor did in the post below, making 'MVP' experiments until the path to success was clear, until they had the 'Aha!' moment. So, when do we get predictability with useful accuracy? At the 'Aha!' moment. Figure out what 'Aha!' moments are needed, devise experiments to reach those moments and drive enough uncertainty out (you'll never get to zero) to where the range of uncertainty is acceptable. #predictability #forecasting #estimation #commitment #agile #planning #riskmanagement #projectmanagement

3

3 Comments

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

There is no one DevRel. This is clear when you look at the variety of Job Titles from those who practice Developer Relations from the recently released 2024 State of DevRel Report. What is important is that the teams work together to support developers in their journey of discovering, adopting, and scaling with your tool. It has been nice to see the trend over the last 11 years of the report that the term "Developer Relations" is showing up in the job titles. Find out more at: https://lnkd.in/gFenwJit

48

Move on over HIPAA, there is a new bill working its way through the Washington red tape machine called "Health Infrastructure Security and Accountability Act". Since pretty much all of our health and personal data has already been leaked by inadequate data collectors, some lawmakers decided it was time to act. They are 20 years too late but it's election season so they need to pull out all the stops. HISAA (sounds 'gangsta' doesn't it) has civil penalties for all those health data grabbers out there who don't comply (and get caught) with HISAA requirements. These include: No knowledge – Minimum of $500 Reasonable cause – Minimum of $5,000 Willful neglect (Corrected) – Minimum of $50,000 Willful neglect (Uncorrected) – Minimum of $250,000 Yes, one "reasonable cause" will cost them a month's mortgage payment (4 bedroom, 2 bath, detached garage), which will be passed down to you, the patient, in one form or another. You can compare this bill to the ole SOX Act but for health care. The bill includes checklists, audits, stress test (pen test sorta) and someplace where the CEO has to sign off on the compliance thingy. Health care organizations have 3 years to figure out ways around the bill before they need to worry, once this bill is passed (if it is passed). $800 million of taxpayer cash will be given to Medicare safe providers to help them figure out how data security works. Then there is another $500 million of TaxO'Cash to " incentivize all hospitals" to adopt data security. I've attached a two page summary of HISAA so you too can gasp in horror at how our government thinks. Happy Halloween https://lnkd.in/gmyyCxhe

9

1 Comment

Imagine losing a multi-million-dollar DoD contract because of overlooked compliance gaps. It's not just a theoretical risk—it's the reality many contractors will face in 2025. A single weak point in your supply chain or outdated cybersecurity measures can trigger an audit failure. Non-compliance doesn't just cost money; it costs trust and a lot of headache. The businesses that fail to act now will be scrambling to recover in a market that rewards preparedness. Can your business afford to be caught off guard?

2

I encourage everyone to follow Joel Krooswyk GitLab. He has been writing code for decades and has a lens that sees deeper than most people I've encountered in the tech space. This article highlights the federal governments efforts to promote Secure by Design as the standard for creating a secure software ecosystem. As the private sector prioritizes security in software development, government developers will have to adapt. The future is not bleak. A more secure software development process and leveraging AI tools to enhance development can give the good guys an edge against the bad guys who never seem to rest. Learn more about this Secure by Design at: https://lnkd.in/guX_k4pN

4

2 Comments