Catherine Yost 🌻

#infosec professional.
she/her.
This isn't my real name. Once upon a time I thought making an account using my 'soap opera name' was a good idea. 🤷🏻‍♀️

[gabsmashh @gabsmashh]

working in a security generalist role is weird because i'm currently performing a pentest and also tuning detection rules and also writing policies/SOPS and also building a threat hunting program.

am i good at a lot of things or nothing at all? stay tuned.

[Signal @signalapp]

Right now there are a lot of new eyes on Signal, and not all of them are familiar with secure messaging and its nuances. Which means there’s misinfo flying around that might drive people away from Signal and private communications.

One piece of misinfo we need to address is the claim that there are ‘vulnerabilities’ in Signal. This isn’t accurate. Reporting on a Pentagon advisory memo appears to be at the heart of the misunderstanding: https://t.co/QfWgOxHAzp. The memo used the term ‘vulnerability’ in relation to Signal—but it had nothing to do with Signal’s core tech. It was warning against phishing scams targeting Signal users.

Phishing isn’t new, and it’s not a flaw in our encryption or any of Signal’s underlying technology. Phishing attacks are a constant threat for popular apps and websites.

In order to help protect people from falling victim to sophisticated phishing attacks, Signal introduced new user flows and in-app warnings. This work has been completed for some time and is unrelated to any current events. If you’re interested in learning more, this WIRED article from February 19th (over a month ago) goes into more detail:
https://t.co/xvVVdPDhSs

Signal is open source, so our code is regularly scrutinized in addition to regular formal audits. We also constantly monitor [email protected] for any new reports, and we act on them with quickness while also working to protect the people who rely on us from outside threats like phishing with warnings and safeguards.

This is why Signal remains the gold standard for private, secure communications.

[Catherine Yost 🌻 @c_yost]

Everyone should read this whole thread. Right meow.
Seriously, please, read it.

[Smarter Every Day @smartereveryday]

Hey it's me Destin, from Smarter Every Day. Now that it's time to elect America's next leader, I would like to share something very interesting and important with you. I've been paying attention to this for a while, and I think if you look for it, you see it too.
🧵 1/n

[Catherine Yost 🌻 @c_yost]

My guesses:
1. twizzlers
2. twix
3. toblerone
4. ?
5. reeses
6. milky way
7. kitkat
8. almond joy
9. ?
10. 3 musketeers or butterfinger
11. baby ruth
12. krackel

[Jon Bruner @JonBruner]

We CT scanned a dozen candy bars. Can you identify all of these?

I'll post the answers tomorrow!

[Catherine Yost 🌻 @c_yost]

My doctor co-signs this post 😅

[Helen (of Tor) @h313n_0f_t0r]

PSA—if ur old enough to have used Kali when it was known as BackTrack then u should probably start prioritizing ur cardiovascular health

[Yubico | #YubiKey @Yubico]

Very demure, very mindful

[Dr. Wesley McGrew @McGrewSecurity]

With the room searches for hacker tools, there's a lesson in this song for #defcon32 attendees https://t.co/042Tow0wdL

[Catherine Yost 🌻 @c_yost]

@cybersecmeg Did you travel while working? like digital nomad style? If so, what kind of employers have you found best support that lifestyle?

[Catherine Yost 🌻 @c_yost]

@sherrod_im 😻😻😻

[Catherine Yost 🌻 @c_yost]

@sherrod_im omg, you're my hero

[Catherine Yost 🌻 @c_yost]

3rd party breach response: all of the bullshit, none of the fun

[Catherine Yost 🌻 @c_yost]

Um @CISAgov, why are all the US-CERT and NCAS pages suddenly gone?

[Catherine Yost 🌻 @c_yost]

@desides01 @1Password Why did I read this as "a competent middle finger?" 😂

[Catherine Yost 🌻 @c_yost]

@darth @nicoleperlroth The email subject "urgent request" is exclusively used by scammers pretending to be your boss asking you to buy gift cards... and political fundraisers.

[Catherine Yost 🌻 @c_yost]

@AccidentalCISO I've worked for a single-time-zone org for 2+ years now, after years of working for global orgs. I recently learned that "time zones" is a skill that can atrophy 😅

[Catherine Yost 🌻 @c_yost]

I wish @AskAmex supported use of #yubikey @Yubico 🙏
#CybersecurityAwarenessMonth #2fa

[Catherine Yost 🌻 @c_yost]

@H3KTlC I do not recommend moving to Ohio. That's kinda what I did with my quarter life crisis. Not my best idea.

[Catherine Yost 🌻 @c_yost]

My therapist: Maybe try listening to something lighthearted and relaxing during your commute.
Me: I think I'm doing this wrong.
🤷‍♀️

[Catherine Yost 🌻 @c_yost]

@geminiimatt Who runs that rfj_usa twitter account? It's so weird. It follows a bunch of GOP folks/orgs, Fox News personalities, and officials from the previous administration but barely any officials currently in those roles.