Anthony Vance

Lenz Professor and Commonwealth Cyber Initiative Fellow at Virginia Tech. Researching information security.

[Anthony Vance @anthonyvance]

I loved reading this article of 3 teenagers' descent into criminal hacking, their arrests, and later finding redemption. @a_greenberg is so good at telling stories, backed by deeply-researched reporting.

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

I spent this year talking to the 3 young hackers behind Mirai, the malware that once broke the internet.

This is WIRED's resulting cover story—an epic, untold, 22,000-word tale of cybercrime, friendship, chaos, betrayal, paranoia, and redemption.

Read: https://t.co/tpPk5EGkQJ

[Anthony Vance @anthonyvance]

Lockheed Martin is not very specific in addressing these points, but it's a start. I'm curious to see if other companies are more detailed in their cybersecurity disclosures.

[Anthony Vance @anthonyvance]

Lockheed Martin today appears to be the first to comply with the SEC's cybersecurity rules in its annual report. The new item 1C on cybersecurity is surprisingly extensive: https://t.co/6p99zVosmP

[Anthony Vance @anthonyvance]

This includes: "Whether and which management positions [e.g., the CISO] or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of the expertise."

[Kim Zetter @KimZetter]

Oh my. Kevin Mitnick has died. "Kevin David Mitnick, 59, died peacefully on Sunday, July 16, 2023, after valiantly battling pancreatic cancer for more than a year." https://t.co/62sqY7vxrQ

[Maria Dinzeo @MariaDinzeo]

#Breaking A federal judge decides not to sentence former Uber security chief Joe Sullivan to prison, but to 3 years probation. "I hope everyone in the CISO community take this is a lesson, and not leniency." @lawdotcom

[Anthony Vance @anthonyvance]

@mlowrycpa @iMeluny @DiscernibleInc And here’s the open access research article that the WSJ article is based on: https://t.co/WmDqkvHgr4

[Anthony Vance @anthonyvance]

I wrote an article with @mlowrycpa for The Wall Street Journal about how CISOs can gain influence in their organizations:

https://t.co/B71AvdHAWW

I’ll be talking about this research with @iMeluny and @DiscernibleInc this Friday, 12/8 at 3pm ET. Join us!

[Discernible Inc @DiscernibleInc]

How do CISOs build legitimacy with the board?

Don't miss your chance to join us next Thursday for a live discussion with Dr. @anthonyvance about his recent findings on improving the relationship between CISOs and the board of directors.

https://t.co/lntY8OaJil

[Anthony Vance @anthonyvance]

This is what “responsible departure” of a CISO looks like.

Twitter must soon submit a compliance report to the FTC about its security/privacy practices. https://t.co/ZGBgkznoDM

[Lea Kissner @LeaKissner]

I've made the hard decision to leave Twitter. I've had the opportunity to work with amazing people and I'm so proud of the privacy, security, and IT teams and the work we've done.

I'm looking forward to figuring out what's next, starting with my reviews for @USENIXSecurity 😁

[Anthony Vance @anthonyvance]

@LeaKissner Best wishes to you, Lea! Thank you for the work you did to keep us safe at Twitter.

[Discernible Inc @DiscernibleInc]

@anthonyvance Sign up to join our virtual, in-depth discussion with @anthonyvance about his research on December 8!

https://t.co/lntY8OaJil

[Anthony Vance @anthonyvance]

Thank you @DiscernibleInc, for talking with me.

[Discernible Inc @DiscernibleInc]

Influence as a trusted advisor is a core competency for effective CISO communications.

🔥 Read our new Q&A with @anthonyvance about his new research on how CISOs earn legitimacy with the board of directors.

https://t.co/RNUA2I2MHf

[Anthony Vance @anthonyvance]

@marciahofmann @KimZetter Excellent! Thank you, this answers my question. And thanks for sharing the jury instructions.

[Anthony Vance @anthonyvance]

@marciahofmann @KimZetter That makes sense. Thank you for explaining that.

[Anthony Vance @anthonyvance]

@marciahofmann @KimZetter Don’t many companies do this when they pay ransom and do not disclose the ransomware incident to authorities?

[Anthony Vance @anthonyvance]

@marciahofmann @KimZetter It seems this applies to the count of obstruction, but I am unclear about the count of misprision: “having knowledge of the actual commission of a felony” [unauthorized access/extortion] “did conceal the same, and did not as soon as possible make known the same” to an authority.

[Anthony Vance @anthonyvance]

@robertgraham The key issue is explained well by @lilyhnewman in her 2020 Wired article: https://t.co/hKOzUhtl2t

Essentially, Sullivan was the designated officer who gave sworn testimony and reports to the FTC before and after the 2016 hack. That’s why this case is unique.

[Anthony Vance @anthonyvance]

I’m very sorry about this result. The CISO role, already one of the toughest jobs in corporations, just got harder.

[Maria Dinzeo @MariaDinzeo]

#Breaking: Uber’s former head of security Joe Sullivan found guilty of obstructing an investigation by the Federal Trade Commission into Uber’s security practices and hiding a 2016 data breach from authorities. @CourthouseNews

[Anthony Vance @anthonyvance]

I published an article in the @WSJ with @mlowrycpa about why boards of directors need more cybersecurity expertise: https://t.co/ZiJYfwxvgG