Davin Arakaki

Last night I spent some time talking to a few dear friends calming them down, helping them to sanity check, and navigate evacuating the fires in SOCAL. Though they don't work in our industry, several of you have met these friends over the years. It reminded me of the principles that I keep in working incident response. I leaned on: 1. Being the most calm. 2. Being empathetic. It's ok for people to feel negative emotions, especially during events, I lean on understanding and channeling those emotions. 3. Assist in making action-oriented decisions smaller and more numerous. People, including you, make mistakes in responding to events, making decisions smaller and incremental gives people the opportunity to make smaller mistakes. In this case this meant asking questions about their driving, their speed, their gas situation, their fog lights, etc. Each of these are small decisions that can help people calm down and focus, as well as keep them safe. 4. Helping them avoid pitfalls. 5. Being honest. If I didn't know things I told them. If I knew things, I told them why (experience, news article, whatever). I also follow a mantra of: 1. Manage safety first. 2. Manage convenience second. 3. Manage emotions third. Getting folks to a safe spot is obvious, managing convenience to reduce the immediate challenges is important, but people often confuse this for the first priority. Knowing that it comes second enhances the first priority. Having emotions come last allows people to feel but also let's them know that their feelings don't influence what keeps them safe and what is most convenient. Always remember to communicate, even over communicate, your thoughts and focus on a mantra, your underlying focus is on their long-term well-being. Be flexible for people, but stringent on your principles. I remind folks that this is what I do. For 20+ years now, helping folks in situations, at it's core, is what I do. In professional terms since Blaster and MyDoom. Over that time, it became ingrained in who I am. Let them know that you're honored you could be on the other end of the phone in that situation with them. You're there for it. And lastly, maybe the most important. When everything is all said and done, whether it's a week, a month, whatever. Ask if they're ok. Over the years I've played virtually every role in industry in events (interim CISO, response commander, responder, SME, whatever), as I reflect on that, I recognize that these principles and steps have helped from all of those angles. My heart goes out to everyone affected by the fires in SOCAL. Be safe and take care of each other.

43

If you or your company don't do any business selling software or hardware with embedded software to the federal government, you can be forgiven for not knowing about this. With that said, you should because, like all major regulations, they tend to get adopted elsewhere. What I am talking about is the SSDAF. This is the Secure Software Development Attestation Form put out by Cybersecurity and Infrastructure Security Agency last month. This is a sea change in how Cybersecurity is handled with the business, in the form of the CEO (or delegate), must sign the form attesting that the software developed followed secure coding practices. Check out my article that goes in-depth on the SSDAF. #wwt #wwtatc #globalcyber #appsecurity #appsec #apisecurity #aisecurity #devsecops https://lnkd.in/gZ-6MD6U

14

Been doing some actual hands-on coding in the last week plus, and I can't say enough about Claude Dev. It would probably annoy expert coders (too slow and asks for too many approvals) and bewilder non-coders (too fast, makes sweeping changes that you have to approve) but for someone like me who knows what code looks like, wants to understand what the bots are doing (and sometimes redirect them) and can frame good questions about error messages, it is incredible. I've been using Cursor in parallel (including Composer mode) to do bits and pieces of this task, and Claude Dev is really a cut above. And right when I thought it couldn't get better, cached mode showed up and saved me 90% of the API costs lol Check it out, well done Saoud Rizwan: https://lnkd.in/e3NiYkes

5

Articles like these are why I use Brian Krebs articles in my workshops. If you want to learn how follow investigative thread to track down miscreants, see if you can copy one of Brian’s step by step investigative paths. https://lnkd.in/gbZDiH6Z

8

1 Comment

Trying to understand how AI and Analytics can help your Agency? Check this out!

2

Thoughts on security testing in production... "Oh, right. That makes perfect sense. Turn *right* to go *left*" -- Lightning McQueen to Doc Hudson To really understand software security behavior, you have to observe the fully assembled application as it runs. Trying to piece it together statically from a heap of repos, libraries, frameworks, and platform simply doesn't provide enough context and ends up with slow pipelines and huge backlogs. You can learn a lot in test and staging environments, but observing security behavior in a real environment with real data, real backend, and real users is best. Not surprisingly, this approach is widely adopted in performance and quality ecosystems. But not appsec. So I'm working with a number of companies that are starting to do runtime application security testing in production. With IAST (like APM tools) this just means watching the code run -- no scanning, no hacking. This allows these companies to get their entire application portfolio tested continuously without extra work. And real time feedback to development. At first, I thought this was a little crazy. I want to find vulnerabilities in development *before* they get to production. But scanners are slow and inaccurate, resulting in remediation times in the hundreds of days. The security test in production approach provides real time accurate feedback and gets things fixed faster. This way development teams can focus on the very small number of real vulnerabilities that are actually observed in production. But the biggest benefit is prioritizing work with production context. They can take into account whether code actually runs or not, which attack vectors are being used , which routes do dangerous things, which routes have authentication and authorization, which applications have huge numbers of users, which APIs process sensitive data, which attacks are automated, etc... If you're only looking statically, every SQL injection is critical. But if you know that the route is authenticated, only administrators are allowed, the database doesn't have sensitive data, etc... that SQL injection is extremely low risk. That's the magic of turning RIGHT to build context, and using it LEFT to accelerate and prioritize work effectively. Thoughts? https://lnkd.in/eChMjvcc

64

43 Comments

It is so satisfying to watch enterprise browser vendors hit the mainstream with Sunday football commercials. I’m looking forward to the disruption of SSE that at the least iterates on what it is today, if not replace it in years to come. The ecosystem is up to millions of seats. This isn’t going to be something that can be stopped. There’s no reason to render verdicts in the cloud for some security controls or even see some traffic flows in some middle box. The “shift left” to the browser service edge is on.

1

Have you ever wondered what browser extensions your users have installed and what impact they might have to your organization? If you have, I'd bet it wasn't easy to figure out if you tried. I've launched Secure Annex to help folks with that. The tool provides enrichment and deep code analysis of browser extensions so that folks can be sure that the web browsers their employees use, where most work gets done today, is safe from threats. Check out my quick tour of Annex to see what is possible.

110

17 Comments

Delayed revocation events by the numbers: An epidemic of delayed revocations has infected the public CA community. Jason Soroko and I track delayed revocations since the beginning of 2021, examine the trend line, and discuss root causes. #pki #security #CABF #ssl #revocation https://lnkd.in/g6APX-Fx

21

I once asked a lead engineer on Angular: Which is better: Angular or React? His response: "Both require good engineering to be effective." So, my developer friends, consider this a reminder that "frameworks" like Diátaxis are fine, but they still require good engineering--such as UX, information architecture, style, maintenance processes, and so on--to create great documentation experiences for your customers. Alas, the framework alone isn't enough.

35

7 Comments

Looking back at this year's KubeCon NA, this is the talk I found most thought-provoking. Enabling developers to run CI "pipelines" locally is important work in its own right. This talk goes a step further, and proposes that all builds prior to merge (even your PR builds) could happen locally. If your developer workstations are powerful enough, you'll ease the burden on your CI infrastructure by doing so. https://lnkd.in/eG55b4b4

3

The latest Qwen2.5 Coder models outperform Sonnet and 4o on some benchmarks. Try it on Wingman today!

4

There are a lot more security data fabric startups than I realized! I wrote a post about this market in March and highlighted six companies who had raised capital or been acquired. I figured I was missing a few, but I had no idea how many. Over 100 comments later, my list of companies had nearly *doubled.* I wanted to do a follow-up post to include more companies since there is so much interest. Here's a quick summary of the companies I should have included the first time around: – Auguria is a security knowledge layer that automates the cleanup, classification, and ranking of security events and alerts to accelerate incident response and threat hunting. – Dassana was highlighted in Snowflake's Startup Spotlight series for its work as a partner building on Snowflake's Data Cloud. – DataBahn is a security data fabric and observability platform built by early Securonix team members, and the founding team's cybersecurity experience shows. The product has the full stack of security data focused features — from data observability to posture management — with pre-built security content. Their new AI features are going to set the standard for what's possible in this space. – DataBee is an internal startup in Comcast's Technology Solutions business unit. They've built a data transformation and content engine with use cases across security operations, GRC, vulnerability management, and more. – Paladin Cloud is a risk and prioritization focused solution that uses AI-powered risk scoring to identify threats from data collected across their security fabric. – Tenzir is an open source solution that gives security teams building blocks to create their own data pipelines. --- The security data fabric market has quickly become one of the most important and relevant new markets in cybersecurity. I'm planning a series of posts to dive in deeper, so more to come soon! ___ Note: I tightened up my definition of "security data fabric" a little more this time based on feedback from the last post. Cribl and Onum both get honorable mention here as relevant products in the space, just not 100% focused on security use cases. Avalor is a security data fabric company recently acquired by Zscaler. I only included non-acquired startups this time. I also miscategorized Synqly last time, but I still think it's an interesting product in the overall picture of security integrations.

178

60 Comments

A recent incident serves as a stark reminder of why we need to be vigilant about who has access to our systems… A former employee of NCS in Singapore was recently sentenced after illegally accessing his ex-employer’s systems and deleting 180 test servers. This act of revenge cost NCS a whopping $678,000. The employee’s access should have been revoked immediately after his termination, but due to an oversight, he retained a login. This enabled him to wreak havoc over several months, ultimately leading to significant financial damage and operational disruption. What can we learn from this? - Revoke access immediately: Ensure that access credentials are deactivated as soon as an employee leaves the company. This should be a standard part of your offboarding process. - Regularly audit access: Conduct periodic reviews of who has access to what. Even current employees should only have access to the information and systems necessary for their role. - Implement stringent controls: Use multi-factor authentication (MFA) where you get a code on another device to prove it’s you. Other security measures add layers of protection. This makes unauthorized access much more difficult. - Monitor and enhance: Keep an eye on your systems and regularly update your security protocols. Stay informed about the latest security practices and adapt as necessary. Remember, a small oversight can lead to huge losses. When did you last review who has access to what? If it’s been more than a few months, it’s time to get to work. My team can help if needed. Send me a DM. #CyberSecurity #BusinessSafety #AccessControl https://lnkd.in/eWFSv9Cw

3