Brian Semrau

Digital forensics pro in privacy & security. Built CIRT so IT/security teams can review third-party software before approving it.

[Brian Semrau @InfosecBrianS]

Remember, a SOC 2 report is evidence, not conclusions. When evaluating controls within a SOC 2 report, pay close attention to language such as “where feasible” or “exceptions approved”.

While such language does not necessarily denote a negative finding, it does invite further review to determine whether the exception has become the rule.

[Brian Semrau @InfosecBrianS]

One of the biggest misconceptions in the field of incident response is that containment and evidence collection are opposing goals. Isolate the endpoint first, then collect data from it.

A snapshot of a virtual server (even one shut down) is usually all that is needed for evidence collection, and yes, that means downtime for the virtual server. Losing evidence of an incident is often far more expensive than that - even when you have a strict RTO.

[Brian Semrau @InfosecBrianS]

@josharmour @troyhunt Yep... If they can't even figure out how to use PGP/GPG, there's no way I even want to look at what they have... Lol!

[Brian Semrau @InfosecBrianS]

@troyhunt Actually, forgot one part. "Please note we are not giving permission to test our infrastructure in a way that would violate CFAA; however, if such testing has already taken place and is responsibility disclosed in good faith, we will not pursue CFAA enforcement."

[Brian Semrau @InfosecBrianS]

@troyhunt My response is always "we do not have an official bug bounty program, but please feel free to send any responsible disclosure details to me using my public key X. We may consider a bounty based on the severity that our engineers assign."

Always radio silence after that.

[Brian Semrau @InfosecBrianS]

@Snubs *failed to disclose*. Evidently I can't talk coherently today - lol.

[Brian Semrau @InfosecBrianS]

@Snubs I've given up on inspections. I just bought my first place, put about 30k into customizing it how I wanted, only to find out that the finished basement (which was a big part of what I customized) had a major flooding problem that the seller failed to disclosure and basically hid.

[Brian Semrau @InfosecBrianS]

@troyhunt @rsobers I also absolutely *hate* the FUD approach to sales. I have hung up on vendors before when they go overboard on that.

[Brian Semrau @InfosecBrianS]

@troyhunt @rsobers Frankly I take issue with the notion that security is "set it and forget it". Obviously it's not, and it involves a whole heck of a lot more threats than just endpoint related issues you could solve with AV. S1 has a decent product, but the video is very off-putting to me.

[Brian Semrau @InfosecBrianS]

@Snubs @pond5 @TeamYouTube Have you ever looked at Audiio? They have that figured out already and have a one time fee rather than a monthly or per song. Pretty decent quality too.

[Brian Semrau @InfosecBrianS]

@troyhunt @mr_matt_t @0xrtt @_ar1234567 @alexsirota It asks which to use when you setup the account now, but once set to full (strict), it certainly does block non-encrypted origins and also validates the cert. Setting to full will require encryption, but will not validate the cert, which is why strict should be used.

[Brian Semrau @InfosecBrianS]

@Snubs Maybe a defamation/lible claim might help? I imagine you could ask for injunctive relief and court costs... Granted it would be a ton of effort... But as long as the facts are on your side, I can't imagine it would be a very tough case...

[Brian Semrau @InfosecBrianS]

@troyhunt @CyberLink I also asked if the encryption was taken with the data and their response was that they were positive that "passwords were not exposed". So yeah... Just the encrypted data and the means to decrypt that data...... Right? -_-

[Brian Semrau @InfosecBrianS]

@troyhunt @CyberLink I've been pushing them on the wording of encrypted. They insist on using the word "encrypted" and that it met industry standard encryption. I wonder how that is when the industry standard is to [salt and] hash? ;)

[Brian Semrau @InfosecBrianS]

@Snubs This is why late fees are a thing. Had a client who regularly took advantage of my payment policy. Now after every 7 days past due, 20% of the balance is added. When I come across clients that have hardship, I waive the fees; But those fees are a good motivator for everyone else.

[Brian Semrau @InfosecBrianS]

@haveibeenpwned But the question is do they have "a high privacy bar with strict data protection standards"? That's the real question here.... 😆

[Brian Semrau @InfosecBrianS]

@ZoomCarIndia @haveibeenpwned @Of_Rupesh 🤣"Impossible" and [in earlier tweets] "absolutely" - pretty sure these words do not mean what you think they do... because it doesn't matter who you are, there is absolutely no such thing as "absolutely secure" or "impossible to access". Using those phrases just shows ignorance.

[Brian Semrau @InfosecBrianS]

@Kris98111987 @haveibeenpwned HIBP if they were salted - at least not on the scale we are talking here. (5 of 5)

[Brian Semrau @InfosecBrianS]

@Kris98111987 @haveibeenpwned because the salt is different, so they have to do it all over again - in other words you are stopping rainbow table attacks. Because there are random values being added to the passwords in a salted hash, there would be no way for the hashes to match what is already in (4 of 5)