Ryan McGeehan

Writes "Starting Up Security" @ tweets horror stories @badthingsdaily

[Mitchell Hashimoto @mitchellh]

I strongly believe there are entire companies right now under heavy AI psychosis and its impossible to have rational conversations about it with them. I can't name any specific people because they include personal friends I deeply respect, but I worry about how this plays out.

I lived through the great MTBF vs MTTR (mean-time-between-failure vs. mean-time-to-recovery) reckoning of infrastructure during the transition to cloud and cloud automation. All those arguments are rearing their ugly heads again but now its... the whole software development industry (maybe the whole world, really).

It's frightening, because the psychosis folks operate under an almost absolute "MTTR is all you need" mentality: "its fine to ship bugs because the agents will fix them so quickly and at a scale humans can't do!" We learned in infrastructure that MTTR is great but you can't yeet resilient systems entirely.

The main issue is I don't even know how to bring this up to people I know personally, because bringing this topic up leads to immediately dismissals like "no no, it has full test coverage" or "bug reports are going down" or something, which just don't paint the whole picture.

We already learned this lesson once in infrastructure: you can automate yourself into a very resilient catastrophe machine. Systems can appear healthy by local metrics while globally becoming incomprehensible. Bug reports can go down while latent risk explodes. Test coverage can rise while semantic understanding falls. Changes happens so fast that nobody notices the underlying architecture decaying.

I worry.

[Ryan McGeehan @Magoo]

@crtheisen @bettersafetynet Hi @bettersafetynet - Here's a good starting point to get acclimated if you're looking for one: https://t.co/OIm16jaLr1

Happy to DM if you run into trouble

[Ryan McGeehan @Magoo]

I wish all security pros practiced a scenario-first mindset. Explanations based on risk scenarios before jumping to best practices, gaps, controls, compliance etc. I wrote an essay to coach on this: "Writing a risk scenario"

https://t.co/mvft7zeClo

[Ryan McGeehan @Magoo]

I wrote about that moment every security team faces when someone asks if they can work from China for a while, and then everyone freaks out.
https://t.co/4e8BzwMDdt

[Ryan McGeehan @Magoo]

Securing Customer Support: https://t.co/YADwG8m0YD

[Ryan McGeehan @Magoo]

@jeremiahg Yeah, either interpretation would have a pretty useful answer IMO, so I'm curious which it ends up being. Subscribed.

[Ryan McGeehan @Magoo]

@jeremiahg Oh, I see. Said differently: An even smaller subset of of vulns that appear in KVEs actually result in claims. This is what the correct suggestion is, right?

Where my mind went, was that certain CVEs caused claims that were not present in KVE, which is not what you meant

[Ryan McGeehan @Magoo]

@jeremiahg Clarifying question: This suggests some amount of CVE's with observed ITW exploitation that are not also formally accounted for in KEV data?

[Ryan McGeehan @Magoo]

Ramping up on bluesky 🦋: https://t.co/P8HJ3ElcA3

[Ryan McGeehan @Magoo]

In the wild exploit in Firefox, disclosed and fixed within 25 hours.

https://t.co/aEau9wRuCz

[Ryan McGeehan @Magoo]

My "Starting Up Security" writing correlates to my caffeine intake which has dropped off over the last few years. Today I got tricked into an actual coffee, so drafts are open. Taking any requests, just DM ☕️

[Clint Gibler @clintgibler]

“Detection is a problem I describe as deceptively tractable.”

@Magoo on 🔍 Prioritizing Detection Engineering

Proposed implementation order:

1. Get logging in order, focusing on query-ability and minimum viable logs.

2. Spend time on hardening before formalizing detection.

3. Introduce high-quality detections and alerts, starting with a reference alert and focusing on invariants.

4. Address management challenges before scaling detection efforts.

5. Fully embrace an engineering approach to detection, with the ability to throttle or accelerate work as needed.

https://t.co/JXkzErURjz

[Ryan McGeehan @Magoo]

@robertgraham @lcamtuf Seems less likely that an interdiction added explosives and relied on a known vuln to trigger it. More likely, while introducing explosives, introduced a trigger at the same time so it could be triggered at a more predictable time. Was it additional hardware, or malware?

[Ryan McGeehan @Magoo]

@robertgraham @lcamtuf I think it's most likely that some kind of intervention occurred to add explosives, but it would still need to be triggered. If a physical intervention is already given, shouldn't some kind of malicious software trigger also be necessary? Or were they all on a simple timer?

[Ryan McGeehan @Magoo]

Malware (!!??!!) may have been the factor in an attack that blew up hundreds of Hezbollah Operatives pagers in an attack.

[Ryan McGeehan @Magoo]

I will be really surprised if these were not sabotaged before delivery somehow.

[Ryan McGeehan @Magoo]

I wrote about how detection engineering should be prioritized in a security program. Feedback and discussion welcome!

https://t.co/1JalkBNWWQ

[Ryan McGeehan @Magoo]

The boring security management stuff. 🤣 Managing a quarterly security review:

Feedback welcome as usual.
https://t.co/hypks1IrSk