rs-

| intake of security/tech content |

[Dr Gerhard Knecht, PhD @GerhardKnecht]

Why Trusting Your Vulnerability Scanner is a Bad Idea.

Attackers are moving past basic initial access and simple data extortion. Instead, they are building complex supply chain attacks with a very specific goal of infiltrating AI development pipelines. https://t.co/aGFzjvKEpC

[Dodge This Security @shotgunner101]

This is a big deal if true. Had they managed to actually make it that last final step i feel like this could have been fatal for the company.

[Cybersecurity and Infrastructure Security Agency @CISAgov]

We’re hiring! We have new positions open for IT Cybersecurity Specialists, Cybersecurity State Coordinators, and Protective Security Advisors to help secure our nation’s critical infrastructure. Apply now: https://t.co/arFjUkoBF4

[Dr Gerhard Knecht, PhD @GerhardKnecht]

Here is a timely lesson for the defense sector: no matter how advanced military AI becomes, it can still be outmaneuvered by human ingenuity, unconventional thinking, and old-fashioned manual tactics.

A conventional SOC may still beat an AI firewall.

[Wandering Star @SW_Samii]

Looking for expert analysis and advice on cybersecurity? Follow @SecWeekly for valuable content and updates! https://t.co/OpkZZXsduh

[rs- @RustySowers]

🧠 an original: “The Risks of SSL Inspection”

http[s]://www.sei.cmu.edu/blog/the-risks-of-ssl-inspection/
📜

@SEI_CMU
@wdormann
#cybersecuritytips
#cybersecurityawareness

[Suni @suni_code]

Interviewer:

HTTPS encrypts everything.

Then how do CDNs still cache content?

[Kim Zetter @KimZetter]

Snoop Dogg Says "Hack is Wack!" http://bit.ly/9C5BNb <- really, Symantec?

[rs- @RustySowers]

⚠️ indicator of cyber insider threat to employer

(if they’re on r/publicfreakout) 💫

#cybersecurity
#Cybersécurité

[UwU Underground @uwu_underground]

We are officially expanding our UwU Underground drink protectors campaigns to any event, conference or vendor that is interested.

We will happily collab and use vendor approved packaging, branded and non-branded options, and sealed packaging.

Feel free to reach out to us or @princessakano for coordinating.

[rs- @RustySowers]

@ZackKorman an opportunity, still, as audit frameworks, attestations, sections of cyber “experts”, etc were again proven not credible & offer no assurance of security

[Florian Roth ⚡️ @cyb3rops]

I don’t want any LLM running random applications on my computer, navigating my browser, or touching my spreadsheets. I don’t trust them to do the right thing all the time - and nobody doing serious work should.
Sandboxed, with a controlled blast radius, fine. Full control over anything you can’t afford to lose? Never.

[Security Weekly Podcast Network @SecWeekly]

Your attack surface isn’t just endpoints anymore.

Modern security platforms now include identities, applications, cloud workloads—even IoT devices. As the definition of “asset” expands, so does where and how you need to apply controls.

If your security strategy hasn’t evolved with your environment, where are the gaps?

#Cybersecurity #AttackSurface #Infosec

[rs- @RustySowers]

prohibit physical access to tech by those untrusted or at minimum adversarial peer nation(s)⚠️

#cybersecurity
#Cybersécurité

[rs- @RustySowers]

physical access control - what are best security options used by USA gov & biz for hardware tech where first physical access is by adversarial peer nation(s) (via manufacturing due to perceived lower costs)

what are security options for ensuring onsite support for same hardware is performed by those not committed to adversarial peer nation

[rs- @RustySowers]

answered for network router asset type

#CyberSecurityAwareness

[Lukasz Olejnik @lukOlejnik]

USA bans foreign-made consumer network routers, considering those produced outside the US a national security risk, and prohibits them from being imported or sold. China makes ~60% of them sold in the US. The official reason: foreign-made routers were used in several large cyberattacks on American infrastructure, including ones targeting energy grids and water systems. So now there will be no foreign routers. The ban doesn't say "Chinese routers". It says all foreign-made routers. Netgear, Eero, Google Nest -- all considered. Companies can apply for an exemption if they submit a detailed reshoring plan: where they'll build in the US, how much they'll invest, quarterly progress reports, a dedicated compliance officer -- just to sell a box that blinks green in your hallway.

[rs- @RustySowers]

strategic cyber threat intel feeding operational & tactical cyber threat intel

more strategic cti? ban overdue by 1 or 2 decades
#cybersecurity

[Engadget @engadget]

The US bans all new foreign-made network routers https://t.co/4GjNAZxlcN

[Adam Curry - curryirc.com @adamcurry]

We're live now with No Agenda episode 1853 #@pocketnoagenda https://t.co/pxNFye9jHh

With JCD back on the mic!

[Shrav Mehta @shravvmehtaa]

Insiders have known about this behavior from Delve and new upstarts for a long time.

Secureframe (and many others) reported it to the AICPA. The AICPA acknowledged the issue, but ultimately didn’t take any action. Unfortunately, that essentially made the practice okay. It’s also nearly impossible for a CPA to lose their license, which makes it low risk for audit firms to continue these practices.

We explained this to customers, but eventually stopped since it was coming off as petty and many prospects didn’t care if a YC backed, seemingly credible company, was promising them certifications without lifting a finger.

It’s unfortunate for all the companies involved who didn’t know any better. We are here to help over the weekend to all those affected.

[rs- @RustySowers]

great week for US biz cyber, strategic cyber threat intel, in further establishing:

-performative security, false attestation
-excessive consolidation of critical tech to a single, external biz
-need for industry pro-reg
-hr resume discrimination due to (over) reliance on ai ats

#cybersecurity
#cybersecuritynews

[rs- @RustySowers]

variety of examples of false US biz cyber via answering only to investors & weak thought, reverence of cyber marketing, lacking ethos, & more ✅

#informationsecurity
#cybersecurity

[Zack Korman @ZackKorman]

The Delve stuff is bad, but all of these compliance platforms (Vanta, Drata, etc) have their "trusted auditors" they recommend. That is the core issue that corrupts this space.

[rs- @RustySowers]

viewed biz security code of conduct as optional 💫

#CyberSecurityAwareness
#cybersecuritytips
#cyberSecuritynews

[Ryan @ohryansbelt]

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown:

> 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in
> Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions
> All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client
> Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months
> The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done
> Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author
> Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper"
> When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams
> Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved
> When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance
> Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor