You should be aware of the term "harvest now, decrypt later". At some point, the encryption we use today will be easily crackable. Don't rely too heavily on it. Better to be very protective of where your data ends up, even if it's encrypted.
Credit union BECU has turned off Quicken access for 2 months and counting due to cyber attacks. MANY banks still allow user:pass only access to OFX with no MFA, ripe for password spray and reuse attacks.
https://t.co/vnkOvrIt3Y
SSL/TLS issues come up all the time during PenTests and explaining the technical detail of all of the different TLS configuration options can be quite difficult - so I put together a handy guide!
https://t.co/mCNEjDyv7H
@arkadiyt * Uses authn/authz outside the supported path
* Creates a new public endpoint/API
* Involves payments/money
List the product areas that are high impact or frequently cause security bugs.
As an industry, security needs to move away from filing a vulnerability Jira ticket and calling it a day. Business risk is only reduced when vulnerabilities are mitigated or fixed. Far too many Jira tickets stay open for months or even years. In these cases, we haven't helped. 🧵
The most thorough timeline and technical explanation of the incident I've read so far. A lot of good lessons learned for other companies in this post mortem.
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023:
A blameless post-mortem of USA v. Joseph Sullivan
https://t.co/qNyt3bqJKb
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023:
A blameless post-mortem of USA v. Joseph Sullivan
https://t.co/qNyt3bqJKb