I generally try to stay on technical topics, because my understanding is that’s what readers want. But events are overwhelming and I believe that not speaking out is now a political choice. I want to start from this Chris Rock video: I hadn’t seen it before, but I have spent a lot of time studying…
Read More One Bad AppleThere’s an interesting article in Bentham’s Gaze, “Science ‘of’ or ‘for’ security?” It usefully teases apart some concepts, and, yes, it probably is consistent with the New School.
Read More Science of Security, Science for Security
Post thumbnail
When Andrew and I wrote The New School, and talked about the need to learn from other professions, we didn’t mean for doctors to learn from ‘cybersecurity thought leaders’ about hiding their problems: …Only one organism grew back. C. auris. It was spreading, but word of it was not. The hospital, a specialty lung and…
Read More ‘No need’ to tell the public(?!?)“90% of attacks start with phishing!*” “Cyber attacks will cost the world 6 trillion by 2020!” We’ve all seen these sorts of numbers from vendors, and in a sense they’re April Fools day numbers: you’d have to be a fool to believe them. But vendors quote insane because there’s no downside and much upside. We…
Read More Leave Those Numbers for April 1stBruce Schneier and I wrote an article on Facebook’s privacy changes: “A New Privacy Constitution for Facebook.”
Read More Facebook’s Privacy Constitution
Post thumbnail
SANS has announced a new boardgame, “Pivots and Payloads,” that “takes you through pen test methodology, tactics, and tools with many possible setbacks that defenders can utilize to hinder forward progress for a pen tester or attacker. The game helps you learn while you play. It’s also a great way to showcase to others what…
Read More Pivots and Payloads
Post thumbnail
Last week, I encouraged you to take a look at the ARM Network Camera Threat Model and Security Analysis, and consider: First, how does it align with the 4-question frame (“what are we working on,” “What can go wrong,” “what are we going to do about it,” and “did we do a good job?”) Second,…
Read More Threat Model Thursday: ARM’s Network Camera TMSA
Post thumbnail
[Update: The final article is available at “That Was Close! Reward Reporting of Cybersecurity ‘Near Misses’,” at the Colorado Technology Law Journal.] Last week at Art into Science, I presented “That was Close! Doing Science with Near Misses” (Slides as web page, or download the pptx.) The core idea is that we should borrow from…
Read More Doing Science With Near Misses[Update: Steve Bellovin has a blog post] One of the major pillars of science is the collection of data to disprove arguments. That data gathering can include experiments, observations, and, in engineering, investigations into failures. One of the issues that makes security hard is that we have little data about large scale systems. (I believe…
Read More Learning from Near Misses