Bob McWhirter

If you or your company don't do any business selling software or hardware with embedded software to the federal government, you can be forgiven for not knowing about this. With that said, you should because, like all major regulations, they tend to get adopted elsewhere. What I am talking about is the SSDAF. This is the Secure Software Development Attestation Form put out by Cybersecurity and Infrastructure Security Agency last month. This is a sea change in how Cybersecurity is handled with the business, in the form of the CEO (or delegate), must sign the form attesting that the software developed followed secure coding practices. Check out my article that goes in-depth on the SSDAF. #wwt #wwtatc #globalcyber #appsecurity #appsec #apisecurity #aisecurity #devsecops https://lnkd.in/gZ-6MD6U

14

I BUILT A TIME MACHINE...OUT OF CODE?! (The Power of SBOMs) The SBOM is critical for securing the software supply chain behind government and critical infrastructure systems. Standards for #SBOM data are improving, and #CISA provides clear requirements for different development stages. Acting like a complete list of ingredients, SBOMs detail every software component used in a product, including its origin, version, and potential security weaknesses. Experts predict a rise in SBOM usage, particularly for safety-critical systems with AI. However, evolving #opensource licensing and difficulty finding compliant vendors may slow down wider adoption by government agencies. Strengthen your software security posture with Root streamlined reporting and monitoring. This enables you to effortlessly exceed customer expectations and ensure seamless compliance with #vulnerability management SLAs.

85

6 Comments

I have a new blog post in which I compare and contrast how privacy laws are proposed and implemented in California and at the Federal level. This is very analogous to software development: in California, it is open and agile, while at the Federal level, it is closed and waterfall. https://lnkd.in/gW387JRZ

34

1 Comment

Ransomware prevention startup Halcyon - led by former Cylance Inc. Chief Research Officer Jon Miller - raised $100 million to thwart data exfiltration and safeguard Mac, Linux and cloud environments: https://lnkd.in/ewHNF8e9 "This wasn't somebody coming in and trying to buy a seat at the table. This was done by our existing board, so they're privy to all the numbers and all the performance, and they came in and decided that we had made the metrics that warranted a unicorn valuation. It's very, very rare for a company to go from zero to a billion in under three years," Miller told Information Security Media Group (ISMG). #ISMGnews

43

Sandboxed recommendations that are prioritized by their risk-reduction potential are part of the foundation for strategic and programmatic cyber decisions, such as those made during risk committee meetings. The outcomes of those decisions can either be technically observed (i.e., implemented and validated via integration) or provided via user feedback (i.e., silencing because of control sustainability within a given business environment). The ultimate success story for this type of capability is enabling decision-analysis across business quarters, where three very simple questions can be answered: 1) What have we done? 2) What do we need to do? 3) How are we trending? #pelloniumriskintelligence

1

I recently gave a talk on supply chain security in software, focusing on determinism and compiler safety. If you're interested, you can watch it here: https://lnkd.in/gMRnG3Md Additionally, we are continuing our work on StageX, a Linux distribution aimed at addressing some security weaknesses that have been overlooked and that my talk exposes. You can find more information about the project here: https://lnkd.in/gkJXVXhY I welcome any thoughts or discussions on these topics!

26

5 Comments

Are you in need of justification for investment in certificate lifecycle management? Tim Callan and I map the crucial role of CLM to NIST's Cybersecurity Framework 2.0. In glorious video.

12

1 Comment

Don't lose sight of the first "C" -- One of the 6 principles of mission command (ADP 6-0), a Shared Understanding which, "deepens trust, clarifies authorities for action, assists problem framing..., and enriches guidance and intent..." (JS-J7). One way interoperability is supported is through messaging standards. #SitaWare does that through continuous enhancement in each software release. #FMN #MIP #SA #C2 #C4ISR

3

Task estimations are always a contentious topic, aren't they? 😅 We've all been in those meetings where there's a spirited debate on how long a task will take. At Ottia Labs, we decided to tackle this challenge from a new angle through an intriguing experiment: leveraging AI. Our latest experiment examined how accurately Large Language Models (LLMs) can predict task times when given the same descriptions that developers would receive. The findings were fascinating and hold immense potential for automating this often painstaking process. ⏳💡 We're excited about the possibilities this opens up for development efficiency and planning. Check out our blog post below if you're curious about the details. https://lnkd.in/dgwk7TcW

2

3 Comments

I’ve been telling folks for years to prepare for DPIAs to become public one way or another. It’s not a secret filing. Shrewd privacy and communication professionals will recognize the opportunity to counsel organizations on how to stop creating & hiding skeletons in the closet. Because when DPIAs become public, everyone will know what you know, including: - how honest & thorough you were from the jump (or did it take 5 versions to meet the requirements?) - known risks you haven’t told them about yet - how transparent you are with regulators - how you evaluate tradeoffs - if you have command of both technical & legal controls

5

Finally got time to review the fascinating 😲 story about the extraction of keys from #PlayReady DRM... Two days ago Roku urged to migrate away to other solutions [1]. Here is the story of yet another big #security issue that is going to drive a new #piracy wave that our industry doesn't need. Key elements: - Affects Windows and a potential of 69% of PCs. - A Web browser is sufficient to conduct the exploit. - Due to lifetime management this issue will likely last for 18+ months... - Leaks keys from CANAL+ Group, Netflix, HBO Max, Prime Video & Amazon MGM Studios showcased. - The disclosure contains reports, code, keys... really bad. This story highlights how media content platforms tend to delegate security to their DRM providers. This can be avoid with good complementary practices such as avoiding: - The use of public CDNs (with no access tokens). - Using too many DRMs which widens the attack surface. - Successful use of expired content keys. - Not understanding that forensic tools (such as watermarking) are not a panacea. - So many other points... Please comment 😉 What happened? Once upon a time... 🌖 - A Microsoft engineer release some debug information on a public forum by mistake. - This leak gave access to unpublished information about 1) Warbird (obfuscation system) and 2) keys and constants from PlayReady. - Microsoft remote debug database (pdb) for the PlayReady libraries was accessible in clear. - Communication between researchers and Microsoft didn't allow to put the disclosure in the expected safe way. At my personal level: - It seems Microsoft didn't value properly 💰 the researchers' work. As an open-source developer this resonates a lot, especially in the security area where open-source is simultaneously freely leveraged and dismissed 👎 - Platforms need more flexible packaging 🚀 and a better commitment to standards and industry consortia to stay at the top of the security situation. If you's like to have more details, read more from the security researchers themselves: https://lnkd.in/efsYFGw5 [1] https://lnkd.in/eKBpkDR4

79

1 Comment

The acquisition may already have happened by the time this posts, but here's the "why" of the downfall for Lacework: good people left. "Six months after the monster Series D funding round, Lacework laid off 20% of its staff in a bid to strengthen the company's balance sheet. Then in summer 2022, President and Chief Revenue Officer Andy Byron - who spearheaded all of Lacework's go-to-market functions since 2019 - departed. Lacework's CRO responsibilities on an interim basis went to David Hatfield, who joined the company as CEO in February 2021 and became co-CEO in August 2021 after the addition of Facebook engineering head Jay Parikh. But in October 2022, Hatfield left the company, with Parikh telling staff, "Now is the time to unify the company under one leader." Parikh remains the sole CEO of Lacework (see: Lacework Co-CEO David Hatfield Out 4 Months After Layoffs). Parikh spoke with ISMG in February 2023 about Lacework's new attack path analysis tool, which helps organizations understand the havoc specific threats could wreak within their cloud infrastructure. "Our data-driven approach here really drives efficiency and effectiveness for these teams so they can prioritize what they should focus their time on to understand and remediate different areas of risk" (see: Lacework CEO on How to Prioritize Cloud Infrastructure Risks). But these investments failed to prevent continued brain drain at Lacework. After holding headcount steady between 975 and 1,025 employees between September 2022 to August 2023, the company's workforce has shrunk by nearly 24% over the past eight months despite never formally disclosing any layoffs." Finding and retaining good people needs to be job number 1. If it's not, buckle up.

1

Got a GitHub issue to update a package dependency due to a transitive dependency two levels deep with a CVE. I closed it because nothing I reference directly has a CVE. What's the responsibility of OSS authors to update package references with transitive references with CVEs? I closed the issue because I felt it's the consumer's responsibility, not mine. If dependabot doesn't flag my package, it's not my problem.

35

5 Comments

This is one of a few posts I've seen recently emphasizing the use of post-infection, command-and-control functions. Ideally, strict, egress access control lists thwart C2 activity, but often frustrate employees and admins. https://lnkd.in/et_UX6j6

1

Does anyone else think NVDIA looks hypoxic? As the saying goes; History repeats itself. A better saying goes; History doesn't repeat itself, but it often rhymes. The overlay chart below shows RCA’s moonshot ascent and final top in 1929. The larger chart framing it shows what Nvidia shares would have to do to replicate RCA’s dirtnap plunge into hellfire. The company's ability to capture the imagination of investors regarding the future has sparked a febrile buying frenzy in the stock, reminiscent of the intense excitement witnessed during the RCA mania just 100 years ago. Will these charts ultimately coincide? Never underestimate the hubris and stupidity of institutional traders and investors.

3

3 Comments