Amélie Koran

552 Followers
430 Following
112 Posts
Sayer of things, do’er of stuff - itinerant troublemaker and security loudmouth. Non-Resident Senior Fellow at The Atlantic Council. Supposedly told a really good story on Darknet Diaries for Episode #91. All opines are my own. RT/Fav/Follow≠Endorsement. Recovering systems engineer, and part-time policy wonk, I try to bring the reality of having “done the thing” to larger discussions by those trying to help steer the ship. At best, throwing things around to see what sticks.
Websitehttps://webjedi.net
GitHubhttps://github.com/webjedi

You know, a few months ago I said I was #hiring, I am now. So, if you're interested in #AI, #LLM, #Omnichannel and get #OffensiveSecurity at a #global scale, apply now. 



https://walmart.wd5.myworkdayjobs.com/WalmartExternal/job/Reston-VA/Staff--Incident-Response-Engineer---AI-Red-Team_R-1895939-1

Staff, Incident Response Engineer - AI Red Team

Position Summary... What you'll do... The Walmart Red Team’s mission is to provide valuable insights into our cyber security defenses and identify gaps and weaknesses that need to be addressed and continuously increase the resilience of Walmart against sophisticated attacks. By acting from a hostile perspective, we uncover digital, physical and social vulnerabilities and challenge our staff to react under real conditions.    About the Team:   At Walmart, we believe it is essential to keep innovating while safeguarding our data. Our team ensures that Walmart maintains a secure operating environment and the trust of our customers, associates, and stakeholders. We bring together a variety of services and capabilities to help prevent fraud, detect threats, and manage digital risk and access. In addition to mitigating attack risks and securing cloud transformation, we foster in our team members a secure and reliable working ethics.     What you'll do:  Perform testing on a wide scope of systems, including web applications, security controls, network infrastructure, wireless, and mobile deployments. Work as a team to explore the network until you reach their goal, taking time to avoid detection. Plan, execute, lead, and report on testing activities and outcomes. Execute covert operations to mimic adversary and threat actor tactics, techniques and procedures and work closely to test exploits.    What you'll bring:  Expertise in web application security and practical experience penetration testing in large e-commerce environments Ability to automate discovery and analysis of new web applications as they are deployed Practical Reverse Engineering and Vulnerability Research experience. Ability to translate reports and intelligence into real world attacks. Experience in offensive security tooling and development, including creation of scripts and debugging proof of concept code to leverage in campaigns. Strong knowledge of concepts and practices in infrastructure engineering and broad networking and systems experience either as a former administrator or in a formal red/blue/purple team role prior. Be able to leverage social engineering skills and understand human psychology for exploitation and persistence on campaign targets. Be able to parse and act on threat intelligence. Leverage awareness of tactics, techniques and procedures (TTPs) to mimic adversaries for scoped engagements. Be versant in technical writing for delivery of reporting to various leadership levels. Ability to clearly document and communicate findings and attack paths. Expertise relating to Machine Learning (ML) and Large Language Models (LLM) in both concept and adversarial actions    About Walmart Global Tech  From entry-level to executive positions, Walmart provides limitless opportunities for growth, and career development. Walmart started small, with a single discount store and the simple philosophy of selling more for less. Today, we are a growing technology-enabled company founded on the same values as our first store. We establish clear expectations, empower associates to manage their work, and hold ourselves and one another to a high standard. Walmart's scale enables us to have an. No other company has the reach of Walmart, with 2.3 million associates worldwide and over 230 million weekly customers. Walmart is reshaping retail by investing in an expanding workforce. While technology is at the heart of our digital transformation, people are the reason we succeed and the force behind our innovations. We train our team in the skillsets of the future and bring in experts like you to help us grow.     Flexible, hybrid work  We use a hybrid way of working that is primarily virtual, while remaining near the locations Global Tech calls home. This approach helps us make quicker decisions, remove location barriers across our global team, be more flexible in our personal lives and spend less time commuting. Of course, being together in person is an important part of our culture and shared success. We use our campuses to collaborate and be together in person, as business needs require and for development and networking opportunities.     Benefits:  Beyond our great compensation package, you can receive incentive awards for your performance. Other great perks include 401(k) match, stock purchase plan, paid maternity and parental leave, PTO, multiple health plans, and much more.     Equal Opportunity Employer:  Walmart, Inc. is an Equal Opportunity Employer – By Choice. We believe we are best equipped to help our associates, customers and the communities we serve live better when we really know them. That means understanding, respecting and valuing diversity- unique styles, experiences, identities, ideas and opinions – while being inclusive of all people.     The above information has been designed to indicate the general nature and level of work performed in the role. It is not designed to contain or be interpreted as a comprehensive inventory of all responsibilities and qualifications required of employees assigned to this job. The full Job Description can be made available as part of the hiring process.    At Walmart, we offer competitive pay as well as performance-based bonus awards and other great benefits for a happier mind, body, and wallet. Health benefits include medical, vision and dental coverage. Financial benefits include 401(k), stock purchase and company-paid life insurance. Paid time off benefits include PTO (including sick leave), parental leave, family care leave, bereavement, jury duty, and voting. Other benefits include short-term and long-term disability, company discounts, Military Leave Pay, adoption and surrogacy expense reimbursement, and more. ‎ ‎ ‎ You will also receive PTO and/or PPTO that can be used for vacation, sick leave, holidays, or other purposes. The amount you receive depends on your job classification and length of employment. It will meet or exceed the requirements of paid sick leave laws, where applicable. ‎ For information about PTO, see https://one.walmart.com/notices. ‎ ‎ Live Better U is a Walmart-paid education benefit program for full-time and part-time associates in Walmart and Sam's Club facilities. Programs range from high school completion to bachelor's degrees, including English Language Learning and short-form certificates. Tuition, books, and fees are completely paid for by Walmart. ‎ Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to a specific plan or program terms. ‎ For information about benefits and eligibility, see One.Walmart. ‎ Reston, Virginia US-07759:The annual salary range for this position is $132,000.00-$264,000.00 ‎ Bentonville, Arkansas US-09050:The annual salary range for this position is $110,000.00-$220,000.00 ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ ‎ Additional compensation includes annual or quarterly performance bonuses. ‎ Additional compensation for certain positions may also include: ‎ ‎ - Stock ‎ ‎ Minimum Qualifications... Outlined below are the required minimum qualifications for this position. If none are listed, there are no minimum qualifications. Option 1: Bachelor's degree in computer science, information technology, engineering, information systems, cybersecurity, or related area and 4 years’ experience in incident response or related area at a technology, retail, or data-driven company.Option 2: 6 years’ experience in incident response or related area at a technology, retail, or data-driven company. Preferred Qualifications... Outlined below are the optional preferred qualifications for this position. If none are listed, there are no preferred qualifications. Certifications in Security+, Network+, GISF, GSEC, CISSP, CCSP, or GCIH, Master’s degree in Computer Science, Information Technology, Engineering, Information Systems, Cybersecurity or related area and 2 year’s Exposure of leading/ working on Information Security / Cybersecurity Projects, We value candidates with a background in creating inclusive digital experiences, demonstrating knowledge in implementing Web Content Accessibility Guidelines (WCAG) 2.2 AA standards, assistive technologies, and integrating digital accessibility seamlessly. The ideal candidate would have knowledge of accessibility best practices and join us as we continue to create accessible products and services following Walmart’s accessibility standards and guidelines for supporting an inclusive culture. CISSP - Certified Information Systems Security Professional - Certification Primary Location... 10790 Parkridge Dr. Suite 200, Reston, VA 20191, United States of America About Walmart: Fifty years ago, Sam Walton started a single mom-and-pop shop and transformed it into the world's biggest retailer. Since those founding days, one thing has remained consistent: our commitment to helping our customers save money so they can live better. Today, we're reinventing the shopping experience and our associates are at the heart of it. You'll play a crucial role in shaping the future of retail, improving millions of lives around the world. This is that place where your passions meet purpose. Join our family and create a career you're proud of.

I promised some “thots and wheelings” on this yesterday. I was supposed to get markup into another doc, but I’m more of a stream kind of gal.

This isn’t comprehensive, mainly because I’m not picking the strategy apart, piece by piece. It’s not great, it’s not bad, and there’s room for improvement (the strategy and my commentary).

As with all, it’s a starting point to grow, fix, and redo again. It needs to be iterative and not dogmatic, which is what worries me about anything published by the government, mainly on how folks (individuals and industry) view things said by them.

https://medium.com/@webjedi/thots-on-the-national-cyber-security-strategy-26c6f9937fb2

“Thots and Wheelings” on the “National Cyber Security Strategy”

National strategies are always aspirational. They are there to present big ideas and inspire, changing from the status quo, and are usually pretty light on the mechanics of how to get it done, who…

Medium

Oh goodness, I don't think we now need to be fact checking ML infused search engine responses. A tech I don't think anybody really wanted: (also humans are really bad at judgment calls when they want something fast - says I, an impulse buyer)

Sorry, having done research for talks about mis- and disinformation from the web for elections and the like, not exactly the kind of difficulty level I needed added to the discourse.

A friend I shared this to noted that "I like how these implementations of generative AI are kinda demonstrating (and normalizing) the idea of 'being confidently wrong'"... I noted “it’s the Dunning-Kruger of AI”, which is what we have now… a real shame and it’s going to hurt AI/ML in the long run.

I gave a talk on this, that, while centering on DevSecOps, is generally applied to adopting any new method or process in tech.

https://www.theverge.com/2023/2/7/23589536/microsoft-bing-ai-chat-inaccurate-results

...also, not trying to be a luddite, but with an understanding of the new tech, ethics, and so forth... the rush to "be the new hotness" is going to hurt in the long run. It's a matter of is it good tech, or are they chasing the dragon for business advantage to drive Wall Street.

Motives need to be asked about.

Also, these models only get better if people use them, but the caveat as it always has been - you ARE the product. You're giving free work to them, you are essentially becoming there Mechanical Turk.

The new Microsoft Bing will sometimes misrepresent the info it finds

Microsoft’s new GPT-powered Bing will provide some “unexpected and inaccurate” answers, the company warns. Microsoft just announced its “AI copilot” alongside a new version of its Edge browser.

The Verge
NASA is hiring a Chief Data Officer. I'll bet a few of you know someone who absolutely needs to know about this opportunity: https://www.usajobs.gov/job/700799600
Chief Data Officer

The Chief Data Officer (CDO) is responsible for the Agency's data strategy, including enterprise-wide governance and utilization of information as an asset, via data processing, analysis, data mining, information trading, and other means. Serves as a key advisor and member of the OCIO senior leadership team. Reviews the impact of the IT infrastructure of the Agency on data asset accessibility to improve infrastructure to reduce barriers that inhibit secure data asset accessibility.

USAJOBS

Today I ran into one of the reasons people hate MDM. (And MSPs)

User couldn’t enroll or unenroll and thus all other managed apps were useless. While troubleshooting this I found a policy assignment misconfig, which I corrected. Resulting in a non-compliant VIP getting a pop up to install an app, and other users a confusing privacy warning from iOS about a managing a managed app.

How in hell are you supposed to manage this user impact expectations with only 8 hours a week, when users all have BYOD env probs, if the company won’t spend for company phones?

There is a frustrating expense waterline in security that results directly in degraded user experience for sub 100 user companies because they can’t afford testing infra, company mobiles, full MDM implemented well, SEIM/SOAR, and proper group policy management. Or even the hours for someone to manage all of this.

We need to construct an easier and cheaper path to security WITH usability for the companies that just can’t afford more than an IT MSP for a few hours a month.

Been thinking about tech conference inclusivity and what being proactively welcoming and encouraging looks like. Much of what follows are snippets of my understanding of the subject matter: an incomplete and necessarily broad and shallow look at a systemic problem I have been trying to comprehend and seek solutions for.

People much more qualified than me with on these kinds of issues do this professionally and quite frankly get paid by their organizations to do so.

-----

A prerequisite of feeling welcome is believing you will be safe in a space.

The tech industry is a powerful and critical sub-system of our society. It is a force multiplier for any individual, organization, corporation, or government that has access to it. And like all sub-systems it mirrors the whole for better and for worse.

Systems of accountability are a required control in any organization--from the family to the largest organizations on the planet.

The responsibility to create safe and welcoming spaces (at work, at conferences, in leadership, etc) rests squarely on (the mostly white, mostly male) leadership.

This responsibility starts with self-education about cultural, systemic, and institutional racism, sexism and bigotry.

Understanding our biases and how they are informed by a culture and legal system rooted in white supremacy is required to undo the harm and exclusivity of our industry, our society, and in ourselves.

-----

Standards are created for areas which need controls.

Controls are put in place to modify and enforce behavior.

Controls require certification to be effective.

Certification requires governance.

Governance is created when a system or subsystem needs to be regulated. This is Control. (Hammurabi Code, Ten Commandments, Magna Carta, NIST, ISO, IEEE, UL, oversight committees, etc).

Without transparency, inclusivity, and equity, governance disproportionally benefits those in power and causes harm to those excluded from governance.

Governance which is not transparent to, inclusive of, and equitable for all that are governed will always continuously empower those already in power.

-----

The tech industry is the wealthiest and therefore arguably the most powerful subsystem in the world.

The tech industry is in grave need of governance and controls that are transparent, inclusive and equitable.

-----

Individual conferences (organizations, companies, etc) will continue to struggle to be safe, welcoming, inclusive and equitable without standards.

Frameworks for safety, equity and inclusion exist.

To my knowledge, no certification is available for tech orgs that have standardized efforts to be safe, equitable, and inclusive.

-----

Enacted policy which cannot be complied with is worse than having no policy because policy relies on trust.

Enacting a policy which you (knowingly or unknowingly) cannot comply with is breaking the social contract created by trust.

Certification creates trust though standardized, repeatable, equitable verification.

Self-certification is not really certification.

No organization can certify itself as having taken measures to be safe, inclusive and equitable.

-----

If the system of the tech industry is to change a board of governance for inclusion and equity must be championed by people in power in the industry.

For this board to be effective, it must be transparent, inclusive and equitable.

-----

Seek out those who work on inclusion and equity. Empower them.

I forget where we mentioned it when talking about changing corporate behavior in times of business practices and cybersecurity the last few days, and we noted "T-Mobile" and the regularity of it (it's breach season) - and well, dang, if this just the damnest... I feel like we summoned the event like Beetlejuice

If layoffs are about over hiring, why am I seeing so many 15+ year Googler friends let go? They’re the ones who built it into a business with $100 billion in cash.

It’s not about over hiring.

Awesome to see @TOOOL at #shmoocon year after year, with the @TOOOL_DC chapter playing such a key role in the #LockpickVillage where more than just mechanical hardware is on display. 🔑🔓

Was waiting for the end of the talk to see how it wrapped up, but the "Escaping the Tar Pit and Securing the Supply Chain" by Kasimir Schulz was pretty good, pretty technical, for some mass analysis and practical patching (and notification) or mass open source vulnerabilities with core packages.

This is kind of a brute-force method, but the results from the pull requests seem to get enough positive results to warrant maybe some wider support, especially for critical packages and projects.

I'm curious, that while this is one package, how far up and wide this can scale for other key components if found vulnerable. Given the stats point to most OSS projects having 1-2 developers listed as active maintainers/committers, this wider scope (if also not rate limited by GitHub and other repo sinks/syncs) could be a nice way to get a reasonable amount of inoculation of projects that may lack the resources to be fully aware to their dependencies.

https://shmoocon.org/speakers/#tarpit

Speakers – ShmooCon