Daniel Woods

I research the economics of cybersecurity & privacy
Cyber risk science at @SolveCyberRisk @EdinburghUni
My own thoughts

[Lawfare @lawfare]

In a new paper for Lawfare's Security by Design Series, Sezaneh Seymour and @IelTop argue that "Secure by Design (SbD) policies should be calibrated to the actual risks faced by small businesses, rather than focusing primarily on software vulnerabilities."

[Daniel Woods @IelTop]

I moved to <the other platform> and hope others will join.

@CDra_90n set up a "security economics" follower-pack so you can quickly build a network of WEIS-y people.

Contact one of us if you join <the other platform> and want to be added to the starter-pack.

[Daniel Woods @IelTop]

@RobTerrin Apparently it's the old number because that was 2004!

Buffet as an unlikely Gen Z who thinks you need $500k a year for a comfortable life.

[Daniel Woods @IelTop]

@rossjanderson @CDra_90n also scraped a bunch of descriptive stats on team size, finding that the biggest teams have 500+ members.

[Daniel Woods @IelTop]

Very proud of @CDra_90n who had his first article accepted at @IEEESSP.

The paper looks at the role of hacker teams in the Chinese bug bounty ecosystem.

We very sadly lost @rossjanderson mid way through this project.
https://t.co/xbmnhIEGn9

[Daniel Woods @IelTop]

My favourite finding is that these teams function like labour unions in negotiating with large tech companies to receive fair bug bounty payouts.

This fighting for the little guy was very much @rossjanderson.

[Daniel Woods @IelTop]

@RobTerrin @ravirockks @ollieatnowhere /who gets the bigger long term pay bump for doing so.

[Daniel Woods @IelTop]

@RobTerrin @ravirockks @ollieatnowhere The real question is what's more expensive. Paying an InfoSec person not to do Infosec and instead learn a bit of insurance, or to pay an Insurance person to learn a bit of InfoSec 😀

[Daniel Woods @IelTop]

@ravirockks @ollieatnowhere The points about InfoSec expertise bothered me more, as if the industry hasn't thought about hiring/acquiring outside insurance.

[Dino A. Dai Zovi @dinodaizovi]

The entire 3rd-edition of @rossjanderson's "Security Engineering" is available free as PDFs now!

https://t.co/4Mjd9TOzUp

[Daniel Woods @IelTop]

Interested in pursuing an MSc in Cyber Security, Privacy and Trust, freshly certified by @NCSC?

Register for our virtual open day next week to hear more: https://t.co/vahpbrec6g

@InfAtEd @EdinburghUni

[Daniel Woods @IelTop]

Overview of the recent (lack of) progress towards establishing a software liability regime.

https://t.co/DadblTIQby

[RUSI @RUSI_org]

📅 Join us on 29 October for an online panel on the cyber insurance industry’s efforts to shape global cybersecurity governance. Find our more on our website.

🗣Speaker include: @josephinecwolff, @IelTop, and @tjohansmeyer.
https://t.co/pLvaHfLF9r

[Daniel Woods @IelTop]

@ale_paulus @CyberStatecraft This kind of argument has been made for over a decade, but the availability of info has changed in the last few years.

For example, Sezaneh Seymour and I assembled info on security control efficacy in our 2024 article: https://t.co/Vahzu2jD5b

[Daniel Woods @IelTop]

@ravirockks @jamiemaccoll @arekfurt @jamiemaccoll will be able to speak to how insurers influence DFIR firms on payment decisions, but the influence won't be via wordings

[Daniel Woods @IelTop]

@ravirockks @jamiemaccoll @arekfurt I think insurance wordings/disputes are a red herring.

They've made a court acknowledge the elephant in the room, e.g. that OFAC don't enforce ransomware sanctions. But that doesn't mean the specific wordings matter much.

[Daniel Woods @IelTop]

@Maxwsmeets What do you see as the gold standard for estimating ransomware trends?