Tal Mozes

Curious about what it means to secure a blockchain and contribute to consensus? We wrote a course just for you :) https://lnkd.in/etYFd9zQ

31

This is a fantastic article by John Althouse. It does a deep dive on new security research into TCP Fingerprinting - JA4T. This builds tremendously on the previous research into TLS fingerprinting, JA4, which you now see being implemented in WAF solutions, such as AWS WAF. Fingerprinting TCP allows you to gain visibility into what devices are being used, whether the traffic is proxied, or even what cellular provider the device is on. This will enable firewalls to build more robust logic to protect against TLS as well as non-TLS traffic https://lnkd.in/ehtSxP8d

12

We get it—identity is confusing. All the new vendors entering the space following the latest buzzwords make matters worse. Human 👩‍🔧 , Non-Human 🤖 , Vendor 👷‍♂️ , Agentic AI 📲 ...it's enough to make your head spin. Knowing what identities you need to worry about, and how you secure them, is definitely not an easy task. Regardless of type, they do have one thing in common - they are identities that authenticate into your environments and access your systems or data. Yes there are differences in how you approach the problem of securing each type; however, you can't easily decouple or disregard the relationship between Human and Non-Human Identities as they are often tightly intertwined (as Paul Nguyen likes to say "there is no immaculate conception in Identities".) We've released an eBook to help make sense of the identity crisis. Check it out below.

12

2 Comments

Integrity Properties for Federations I’m writing to highly recommend the article “How to link an application protocol to an OpenID Federation 1.0 trust layer” by Vladimir Dzhuvinov. In it, he defines two kinds of integrity for Federations, and describes how to achieve them: Federation Integrity and Metadata Integrity. The article also explores how application protocols, such as OpenID Connect or digital wallet protocols, can achieve those properties in practice (and when they do and don’t need to). You can read my full recommendation at https://lnkd.in/gTRn_Yux and Vladimir's article at https://lnkd.in/gPwSnM2n.

26

1 Comment

The wave of consolidation in security (and in this case identity) is showing no signs of slowing down. But waves tend to crash, or at least crest, at some point. FWIW, I don't think this one has at this point but I'm thinking about what will be the signal we've hit peak consolidation. I think one pretty likely signal will be when a public company takes out a private at a valuation level high enough that Wall street really punishes the public with a double digits valuation haircut (at the time I'm writing this the impact on CYBR is a blip...up 1.3% during trading today and down only 0.76% after hours, so not this one). Apart from that, what I think this one has in common with the blockbuster SIEM deals of last week is financial consolidation. According to the article: "...Venafi is expected to add around $150 million in annual recurring revenue ***and will be accretive to CyberArk's margins immediately***" [*** mine] which I read as financial consolidation more so than product expansion / fulfillment of vision. The interesting thing about it is that there's a new cohort of startups doing Non Human Identity. Often that means the status quo is not satisfying the needs of the market and the discovery diligence of founders indicates the incumbents are vulnerable to a new generation of tech. Will be interesting to see how that plays out.

24

6 Comments

https://lnkd.in/eYbRzvqr #sovereign #data #vaults - how to store and recall data for #ssi beyond a #vc. - How to work with end-to-end encrypted storage? - How to turn #vc to a #database ? - How to work with non credential data in #ssi

5

Nice reverse engineering research on the Rabbit R1 and a perfect example of a new & hot product with a lot of media coverage but with poor security engineering. https://lnkd.in/dX-mUpH2 #rabbitr1 #CyberSecurity #appsec #IoT #R1

1

2025 will be a decisive year for the EU Wallet when used for PAYMENTS. Why is that you may wonder? Well, to begin with the Architecture and Reference Framework (ARF) does not really acknowledge the fact that payment authorization systems depend on technically (and commercially...) quite different arrangements compared to identity/authentication systems. As an example, Merchants are not relying parties, they rather need to be assured they are getting paid, something only the "payment backend" can provide. Furthermore, it is not entirely clear what the goal is (apart from compliance), like whether the EU Wallet should be competitive with other payment authorization systems, including Apple Pay and Wero. Personally (FWIW), I believe there is plenty of room for INNOVATION; the question is rather if we (the Europeans) are ready for challenging the traditional payment industry. AFAICT, Open Banking is also in need of a "technology refresh".

38

18 Comments

I see compassion as a core element of successful cybersecurity because so much of a cybersecurity executive's role is communicating with and relating to others. A mindset where one believes they are above others is never productive and, in many cases, can be detrimental. When you lead with a negative attitude, people begin to ignore your well-reasoned advice. #Leadership #CISO #Cybersecurity

12

Why #Scams Are Different and What #Customer #Security Means? Scams target the #human factor directly - demanding a #paradigm #shift from protecting systems to #protecting #people. Yesterday, at the #FraudFighters IL Meetup hosted at the Team8 offices, I discussed how we can #rethink #fraud #prevention through Customer Security: 1️⃣ The #Human #Factor: Scams exploit #trust and #emotions, not systems. Understanding human #vulnerabilities and emerging scam trends is key to staying ahead. 2️⃣ #Beyond #Perimeters: Scams move across platforms — starting on #social #media and ending in a #bank transaction or #card #payment. Fighting them requires a connected view beyond any single organization. 3️⃣ #Beyond #Identity: Traditional fraud focuses on who you are. With scams, the challenge lies with the recipient, making #recipient #intelligence critical to prevention. 4️⃣ #Shattered #Trust: Scams hit people hardest - breaking trust and causing real #emotional #distress. Organizations must respond with #care, #support, and better #incident #response. Scams are not just another fraud type — they force us to rethink how we #protect people and help victims #recover. Oren Karmi - thanks for leading this #community! How do you think we can address this growing challenge together? I’d love to hear your thoughts. #FraudPrevention #ScamIntelligence #Cybersecurity #HumanFactor #CustomerSecurity #team8

79

8 Comments

Proposed Implementer's Draft of OpenID Federation The OpenID Connect working group has started working group last call (WGLC) for a proposed Implementer’s Draft of the OpenID Federation specification. As described in the WGLC message: "OpenID Federation -35 has been published at https://lnkd.in/g-N77DdF and https://lnkd.in/gdv-JTa2. This draft is being proposed as the fourth (and hopefully final) Implementer’s Draft of the specification." An Implementer’s Draft is a stable version of a specification providing intellectual property protections to implementers of the specification. The two-week working group last call ends on Friday, May 31, 2024. Unless reasons are identified during the last call to substantially revise the specification, the 45-day OpenID Foundation-wide review of the specification for approval as an OpenID Implementer’s Draft will shortly follow. Special thanks to all the implementers and deployers who provided feedback to get us to this point! See the post at https://lnkd.in/gmEhYueB. OpenID Foundation Roland Hedberg Giuseppe De Marco Vladimir Dzhuvinov John Bradley Andreas Åkre Solberg #OpenID #Federation

68

5 Comments

If you really want to embrace secure development - you need more than just expensive tools - you need to empower and equip your team. Join this up coming webinar to go deep on how to use capability frameworks to drive real #appsec change.

12

Presenting our research at DeFi Security Summit was an absolute pleasure! In security research, sharing is caring. All defenders fight the same bad guys, and we all spend resources to understand their tools and techniques. With Drainer as a Service (DaaS) ecosystem becoming a serious issue in the ecosystem, we need to make sure all eyes are following the evolution of these kits. Overcoming obfuscation is a fundamental part of malware analysis, and as Blockchain Security matures, we need more security teams are sharing advanced techniques. Last but definitely not least, this is another great opportunity to highlight Matan Nevo's amazing work leading this project 👑 #MalwareAalysis #BlockchainSecurity #CryptoSecurity #Web3Security #Deobfuscation

107

10 Comments

New APT alert - APT 44 aka Sandworm. To date, no other Russian government-backed cyber group has played a more central role in shaping and supporting Russia’s military campaign. This group is defining how cyber is used in wartime efforts. Ways we are proactively protecting customers and the community: - Google's Threat Analysis Group (TAG) uses the results of our research to improve the safety and security of Google’s products. - Upon discovery, all identified websites and domains are added to Safe Browsing to protect users from further exploitation. - All targeted Gmail and Workspace users are sent government-backed attacker alerts, notifying them of the activity, encouraging potential targets to enable Enhanced Safe Browsing for Chrome, and ensuring them that all devices are updated. - Where possible, Mandiant sends victim notifications via the Victim Notification Program. - If you are a Google Chronicle Enterprise+ customer, Chronicle rules were released to your Emerging Threats rule pack, and IOCs are available for prioritization with Applied Threat Intelligence. - A VirusTotal Collection featuring APT44-related indicators of compromise is now available for registered users.

11

APT35, also known as Charming Kitten, is a cyber group linked to Iran, very recently targeting organizations in Albania. These attackers focus on infiltrating critical systems to extract data, posing serious risks for both national security and private industries. At Alphatechs we are deeply involved in tracking and analyzing these activities, staying alert to the tactics they use and the threats they bring. For those who want to understand more about these threats and what they mean for Albania, our full report provides further insights. https://lnkd.in/daYcGjqc

19

🔥❗ PAN-OS RCE UPDATE: tl;dr: somehow it's getting worse For those of us just waking up and getting going in the UK, if you're tracking the RCE in PAN-OS (CVE-2024-3400), please be advised: Telemetry is no longer a pre-requisite for exploiting this vuln for RCE. This is being exploited in the wild by motivated threat actors right now. It has been for ages. Stop messing about and get patched.

11

Be careful when downloading apps….

5