FedRAMP High and DoD IL5 continue to not be worth the paper they’re written on and serve primarily as barriers to competition. Film at 11.
| Meritocracy | w00w00 |
| APT | FUZZYSNUGGLYDUCK |
| Hellsite | https://twitter.com/kikta |
Jason Kikta
- 690 Followers
- 270 Following
- 234 Posts
// Somehow a CTO
// Johns Hopkins SAIS Alperovitch adjunct
// IST Adjunct Senior Technical Advisor
// Former USCYBERCOM/CNMF
// Retired US Marine Corps
// Personal views and invective
NosirrahSec 🏴☠️ guillotine enthusiastI'm confused about why CVE-2024-30078 hasn't gotten nearly any attention.
Is it the proximity need, by way of it being Wi-Fi?
I figured a pre-auth RCE in ALL VERSIONS OF WINDOWS would be getting some really hard attention.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30078
JosephMennWhy name it the Alperovitch Institute when they could have had the Pew Pew Center?
Horkosit may surprise some people to learn that CISA’s Joint Ransomware Task Force (JRTF; a federal interagency body established by Congress to unify and strengthen efforts against the ongoing threat of ransomware) and IST’s Ransomware Task Force (RTF; a public-private group run by a think tank to work on non-binding policy “deep thoughts” about ransomware) are not — in fact — the same thing.
my boy <snorts loudly while taking a giant bite out of a renfair turkey leg that’s been in the fridge for 4 days> if you could only understand <wet grunt-fart> the complexities of <loudly passes a kidney stone while shitting at the same time> OCO where as relates vis-a-vis <snarls while leaping out a window to slide tackle a squealing hog, then screaming “AOOOOOGA”>
Haroon MeerDo Fortinet make remote access devices?
Kinda…
This is exactly the sort of thing I am getting at when I drag policy suggestions to improve cybersecurity that require major investment. Microsoft has had the capability to prevent NTLM relay attacks available since *Win98*, but is only now making it the default for Win11.
Supposedly, the delay was because data transfer operations are impacted by enabling SMB signing… so upgrading from 10Mbps Ethernet to 100Mbps and then 1Gbps and beyond weren’t enough, but now two and a half decades later we’ve hit the magic LAN speeds to make this feasible and finally eliminate this class of attack??
We clearly remain fundamentally unserious about improving cybersecurity if this is where we are.
Chris Inglis does an excellent job laying out why applying a “duty to care” and increased liability for vulnerable products to software companies is an important step toward a safer cyberspace writ large.
Meanwhile, the rebuttal is some of the weakest and most hand-wavy nonsense I’ve encountered since a prominent technology executive suggested that we need a “cyber Geneva convention” that makes it some kind of cyber war crime to exploit gaping vulnerabilities in ubiquitous software.
The code quality epidemic is real, it is sustained, and the hard fact is that it will only improve if it starts to cost tech companies something besides reputational risk and a little stock bounce after their products get exploited at scale by adversaries like China or Russia.
You know what might have been the most effective “left of boom” effort with regards to the monumental shift in initial access techniques over the last few years away from phishing and towards exploitation of external-facing network devices (at scale, I might add)?
A bit of high-grade QA driven by the fear of the liability and regulatory gods.
https://www.wsj.com/articles/should-software-companies-be-held-liable-security-flaws-d2a3f5db
If the US government is serious about all its talk of cyber norms and what not, it may want to consider dialing back rhetoric about how cyber espionage with the potential to serve as prepositioning for disruptive/destructive cyber attacks is “unacceptable” — especially on the basis of such activity’s “scope and scale”.
1. That kind of prepositioning, also known as operational preparation of the environment (OPE), is a common enough practice for US cyber elements. Abandoning cyber OPE would be voluntarily placing the USG at a tremendous disadvantage compared to adversaries, trading real national security benefits for a type of moral high ground that no one will functionally care about us occupying.
2. Conducting cyber operations at scale is basically the US intelligence community’s whole deal. This is the same kind of hypocrisy that showed up when people acted outraged that the SVR used SolarWinds to affect a supply chain compromise as if that tactic was somehow morally abhorrent to US intelligence.
3. Nothing in any of the public reporting released in the last few days credibly points to these China-nexus intrusions as being about prepositioning. It all looks like pretty standard cyber espionage against valid intelligence collection targets. Just because a line of access could conceivably be repurposed for effects — which is a super weak line of argument in my opinion since people only tend to trot it out when they are looking at a compromise and trying to raise the scare factor rather respond to operational reality — doesn’t mean it will be repurposed for effects.
Performative morality in national security is no substitute for maintaining substantive morality while successfully navigating gray areas in pursuit of actual strategic advantage.
https://amp.cnn.com/cnn/2023/05/26/politics/us-chinese-hackers-rob-joyce/index.html
US officials believe Chinese hackers may still have access to key US computer networks
US officials believe Chinese hackers could still have access to sensitive US computer networks they’ve targeted in recent months as a top American cyber official told CNN he is concerned about the “scope and scale” of the activity.
if your boss says “you should focus on work-life calibration, rather than work-life balance”, run for the fucking hills.
jobs will never, ever, ever love you back no matter how fulfilling they are; and when you’re facing the immortal wall of silent howling darkness that is death, I promise you won’t be thinking about all the work you did — you’ll be wishing you could re-experience some little sensory moment from life one last time before the gaping maw of incomprehensible blackness and silence takes you far away.