More on the Attack Hypersurface. Cloud Estates Can Only Be Understood With Modelling. And Just Look at All the SKUs.

In a previous article I started to discuss the idea of how infrastructure technology has evolved into having an "attack hypersurface," not just a normal sized, regular old attack surface, but something more than that...something almost unknowable.

Surivorship Bias & the Nation State Long Con. The Number of Software Backdoors Is Not Zero. We Are a Techno-Society That Depends on Open Source Software.

The open source software movement is one of the most interesting things to happen in recent human history. We are a techno-society that depends on open source software, so what happens when nation states go after the basic human frailty of OSS maintainers?

We May Never Be Rid of Log4J. It Was, and Still Is, an Endemic Vulnerability. It’s the Long Tail That Is Concerning.

Log4J has a long tail. About 38% of Java applications are still vulnerable. Traces of exploit attempts are increasing across the Internet. CISA said that the Log4J vulnerability would be a long living and persistent one, and it is.

The Cybersecurity Attack Surface Is Getting Bigger and Bigger. We’ve Been Going Through a Mega-Evolution. It’s a Hypersurface Now.

We've invented and evolved thousands of computational thingamawhatsits to deploy applications with, and combined them in billions of permutations...then we need to build the cybersecurity around them. It's worth it to take a moment, step back, and ponder that.

“The Fashionable Negligence of the Day” and the Three Body Problem: Mark Burgess On Our Industry-Wide Problems With Configuration Management (Yet...the Stock Market Still Works?).

More than 30 years after CFEngine, Mark Burgess is still thinking about configuration management. He has a new post on configuration and how it can't be made easy, and in this article I look through some of his more provocative and interesting statements.

Memory Safe Languages: Does Just Bossing around Developers Work (From a Security Perspective?)

One of the smartest computer security people around (not me) asks if we can just keep piling work on developers, including things like rewriting everything in memory-safe languages.

A Look at NIST 800-204D: Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

At this point, the name Solarwinds has become almost synonymous with the idea of a Software Supply Chain (SSC) attack. And now, a few years after this particular attack, we have some recommendations from NIST on how to secure the systems that build and update software products.

Cyber Deterrence

We've long been under the global spectre of MAD, mutually assured destruction, but that's only one model of deterrence. We also need to examine what deterrence means in the context of cybersecurity.

Transformational Versus Transactional Leadership

John McMahon, a five time Chief Revenue Officer, talks about how helping people to grow is a sign of true leadership.

In Linux Everything Is a File. In Threat Detection, Everything Is a Stream.

To detect threats, we need to look at all the events that occur across our infrastructure. The open-source Falco project has historically looked at system calls but can also analyze any streaming log file, such as those provided by cloud and SaaS platforms.