Jaysus

Detection Engineer & False Positive Aficionado 🦸‍♂️🇨🇦

[Zack Korman @ZackKorman]

A lot of cybersecurity problems are really organizational dysfunction problems hidden behind a layer of tech. No amount of AI tokens can fix that.

Feel free to send this post to your boss.

[mRr3b00t @UK_Daniel_Card]

Deterministic Code is FASTER than non Deterministic...

People saying machine speed are generally talking nonsense (no offence but it's true)

[💻 Sherrod @sherrod_im]

"No one is coming to save you"

Detection engineers:

[Jaysus @JayInfoSec]

Good luck on your national IQ test, Americans!

[Zack Korman @ZackKorman]

My whole product is “throw tokens at detection” and even I don’t agree with this.

This is the president and CPO of Cisco.

[thaddeus e. grugq @thegrugq]

Security is maintained through the combination of

- people
- technology
- procedures

Fixation on bugs as the sole element of security (offensive and defensive) is a category error. A profound misunderstanding of how systems work, and how they fail.

[Jaysus @JayInfoSec]

@jeffcanadamson @professor_ajay @Yoshua_Bengio no cybersecurity?

[Accidental CISO @AccidentalCISO]

If your CISO isn't interesting, you have the wrong person.

[Jaysus @JayInfoSec]

@brotendies im drunk rn and i could do that. pathetic.

[Jaysus @JayInfoSec]

@sherrod_im i will NOT be renewing mine this year

[Rob T. Lee @robtlee]

We're screening for North Korean IT workers in the wrong place. Most of the advice on North Korean IT workers is about catching them in the interview. I think that's the wrong place to put most of our effort.

The joint advisory four governments just put out is a good example. The hiring advice is almost entirely human: check the applicant's IP against where they say they live, call their phone number, drill the resume live, and ask about their hometown and hobbies.

(Apparently "tell me about your hometown" is a security control now.)

I'm not knocking any of it. Talking to a real person is still one of the better fraud checks we have. But it only works on applicants, and a laptop farm exists to beat the IP check anyway. None of it helps with the one who already passed, got the laptop, and built a normal work record.

And I'd assume one already has. At @OneRSAC last year, @Mandiant's Charles Carmakal said nearly every Fortune 500 CISO he'd talked to about this problem admitted hiring at least one North Korean IT worker. I wouldn't bet on smaller shops doing better. (I'd love to be wrong on that.)

The advisory does mention least privilege, in one line, next to revoking accounts once you suspect someone. Revoking only helps once somebody notices. I'd put least privilege at the center for new remote hires. Access should grow with tenure instead of arriving on day one, and you should have a tested answer for how fast you can pull it back.

Pick your newest remote engineer. What could they reach, exfiltrate, administer, deploy, or monetize before anyone had a reason to wonder? I built the brand new FOR500: SANS Windows Forensic Analysis case with @HeatherMahalik Barnhart and @ovie Carroll around exactly that hire.

Operation Crimson Ledger puts you on the Windows 11 laptop of a remote engineer who cleared the interview and looked normal for months: two remote-access tools, a consumer VPN, an AI coding agent with more screen time than Office, company files staged to a personal Google Drive, a mailbox exported through a second copy of Office, and a wiper run seven times in the two minutes around the upload. (Least privilege wouldn't have stopped all of it, but it would have made the trail a lot shorter.)

Advisory: https://t.co/Xm8GAJVBtr
SecurityWeek: https://t.co/RVzzCwCNns

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

Attacker vs. Defender AI Advantage

https://t.co/ljLyuoRVOJ

[Jaysus @JayInfoSec]

@robtlee @k8em0 Team Marcus all the way

[Jaysus @JayInfoSec]

@notaguruyet @MarkJCarney Canada Secures Nearly CA$500 Billion in New Investment at Major Summit in Toronto

lol

https://t.co/9LKSHvxevS

[Jaysus @JayInfoSec]

@mrnastynodrama I bet you couldn't explain why you feel that way articulately.

[Jaysus @JayInfoSec]

@NoLore Carney could cure cancer and you would still complain.

[Jaysus @JayInfoSec]

@hoboken_gary @Beyondreporter1 Did you want him to spoil it for everybody? This is not vague at all lol.

[Jaysus @JayInfoSec]

@wakefield00 @TheThanigasalam @fordnation @VictorFedeli absolutely insane

[Jaysus @JayInfoSec]

look at that track record, wtf

[Vijay Thanigasalam @TheThanigasalam]

I am deeply humbled and honoured to be appointed Ontario’s first-ever Associate Minister of Artificial Intelligence Adoption ⚡

I want to thank Premier @fordnation for his continued trust in me to serve in his cabinet, especially in such an important portfolio. I am looking forward to working closely with the Premier alongside Minister @VictorFedeli at the Ministry of Economic Development, Job Creation, and Trade.

Ontario is the birthplace of AI, and as we continue our mandate to #ProtectOntario from President Trump’s attacks, we are committed to growing economic opportunities in AI here at home.

Let’s make Ontario the AI Capital of Canada 🇨🇦

[Zack Korman @ZackKorman]

The independent review of the OpenAI Hugging Face incident, supposedly a watershed moment in cybersecurity, wasn't done by a cybersecurity firm and the authors have no cybersecurity experience. That's bad.

Here's my new video.