@ICS_SCADA on the #S4x24 Main Stage introducing the Normalization of Deviance concept with the powerful example of the evolution of safety systems.
https://t.co/Yvf4J2QbeJ
We are at the last open ticket block for #S4x24, 751-1000. Tickets 1001 - 1100 will be limited to asset owners.
S4x24 is March 4 - 7 in Miami South Beach.
https://t.co/YK4htbsgSD
The September 13 meeting summary for @CISAgov’s cybersecurity advisory committee includes a blurb about the recommendations from the technical advisory council re: the agency’s work to protect high-risk communities. https://t.co/fdPtos5QGI
Now that AI can do captchas better than humans, how long will they continue to be around. Years based on the continued practice of forced periodic password changes.
Just this week I went through an onerous every 90-day password change procedure for a Fortune 500 client. Even though USG, UKG and others have said this is not a good practice and removed it from standards.
S4x24 tickets on sale now at https://t.co/ho7pzLphpO
1st 100 tickets sold in the first two hours, but we keep the ticket #1 - #100 price until noon EDT on Tuesday, Oct 3 to be fair to all time zones.
Ticket also gets you coveted hotel block info.
I think the term "cyber hygiene" is perfectly used here. 4 basic steps that everyone, every company should do. Like washing hands, seat belts.
Maybe this will help the ICS security community and others stop using it as a replacement for a long list of security good practice controls.
It’s clear that the MITRE Engenuity ATT&CK is a dead testing criteria / evaluation and more about gaming the scores.
MITRE ATT&CK however is still an amazing framework for evaluating coverage and effectiveness. Lots of great things there still even if Engenuity is a hot mess.
most of my career has been weathering this reaction tbh.
I’ve long agreed with @argvee’s answer that the cybersecurity industry shouldn’t exist, because it needs to be solved in design/arch.
I also think the industry will resist Secure by Design/Default for this very reason…