1. Shapeshifting Chrome extensions
2. Comprehensive (>6500 word) business and technical teardown of spyware peddler Paragon
3. Migrate your Tweets to Bluesky, preserving the original date
Novel use of the AT Protocol’s timestamp functionality, which allows backdating of posts. To avoid the appearance of shenanigans, the date and time of the Bluesky post will reflect when it was migrated, and the original date is preserved as a badge.
1. Cyber insurance is no silver bullet for cybersecurity
“Regulators and businesses hope cyber insurance will drive stronger security practices. In reality, a narrow focus on mitigating financial loss makes it an unreliable solution”
This is a fascinating statement and article. Risk management is grounded in losses, and cybersecurity losses in the context of insurance are explicitly financial. Also, insurance in general is not intended to be a silver bullet, but one of several tools used to manage risk.
2. A simple framework for predicting where the InfoSec market is heading using cyber-insurance (Thread Reader version)
1. Crafty Camel, a threat targeting the UAE
2. Another piece of the DPRK tech worker puzzle
3. “The Defining Challenge of the 21st Century”, a hearing of the House Committee on Homeland Security. Not explicitly focused on cybersecurity, but cybersecurity featured prominently throughout. [Full hearing video]
4. “End the Typhoons: How to Deter Beijing’s Cyber Actions and Enhance America’s Lackluster Cyber Defenses”, a hearing of the House Select Committee on the Chinese Communist Party. Links to opening statements below. [Full hearing video]
One of Paul Graham’s best.
If people can’t think clearly about anything that has become part of their identity, then all other things being equal, the best plan is to let as few things into your identity as possible.
Most people reading this will already be fairly tolerant. But there is a step beyond thinking of yourself as x but tolerating y: not even to consider yourself an x. The more labels you have for yourself, the dumber they make you.
I’ve long viewed incidents as one of an organization’s very best tools for measuring everything from cybersecurity effectiveness, to overall operational maturity. Unsurprisingly, I’d also recommend using incidents to define and understand security outcomes (i.e., whether your costly security-related investments are getting the job done).
Here are three relatively simply incident-centric cybersecurity outcomes to consider:
The one security outcome to rule them all is the material cybersecurity incident. Although this term was popularized by the U.S. Securities and Exchange Commission, every organization—regulated or not—defines “materiality” for itself. This creates a neat, tidy, binary condition: either you have had a material cybersecurity incident or you have not.
Beyond material incidents, incidents at-large can be categorized using organization-specific definitions or common severity (SEV) levels (e.g., SEV-1 being most severe, and SEV-2+ being increasingly less so). If using a standard SEV model, some or all SEV-1 incidents will be material, and all material incidents should be classified as SEV-1.
A third outcome is cost per incident, which encompasses the expenses of technical controls, personnel, and external partners. Typically, lower-severity incidents incur lower costs, while costs rise exponentially with severity.
It’ll be easiest to implement these starting with the first: define what would constitute a material cybersecurity incident for your organization. Don’t overthink it. If it prevents you from making money, serving your customers, or both then that may be a good enough start. Once you’ve defined that and believe you’d know materiality when you see it, move on to defining incident severity level and performing basic incident management, and then evolve your incident management process to include cost.