How a Scientific Approach Can Save Security Testing – David Hunt – ESW #301
If you’ve ever worked on a red or purple team, you know scaling engagements to production is an intensive, unwieldy process. Technology pitfalls may exist, but the fundamental problem is this: the process of writing, testing, deploying, and verifying the efficacy of TTPs is highly flawed and inconsistent.
This conversation will focus on applying a scientific process to security testing in order to achieve production scale.
Segment Resources:
Prelude Build GitHub: https://github.com/preludeorg/build
Prelude Docs: https://docs.prelude.org/docs
Introducing Prelude Build: An Open Source IDE Purpose Built for Security Engineers: https://www.preludesecurity.com/blog/introducing-prelude-build-an-ide-purpose-built-for-security-engineers
A Practical Guide for Scaling Continuous Security Testing: https://www.preludesecurity.com/blog/scaled-security-testing-a-practical-guide
Prelude Build: https://www.preludesecurity.com/products/build
David leads the engineering effort at Prelude as CTO. Before Prelude, he led the team that built MITRE CALDERA. He has spent his career analyzing security across countless industries, including enterprise, aerospace, and OT.
Join our cybersecurity community on Discord! Connect directly with our expert hosts, join discussions with fellow audience members, and customize your notifications to receive alerts every time an episode of your favorite show publishes. Get your invite at securityweekly.com/discord!
InfoSec Community Culture & the Migration to Mastodon – Jerry Bell – ESW #301
We will discuss the migration of the security community from Twitter to Mastodon, logistical challenges, and related matters of managing the community.
Jerry has worked in IT for 30 years, holding various positions from programmer, to sysadmin and is currently the VP and CISO of IBM Public Cloud. Jerry has hosted the Defensive Security Podcast and has administered the Infosec.Exchange mastodon instance for the past 6 years.
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Unicorn Layoffs, Zombiecorns, IronNet, Remediant, & AI Generated Insecurity – ESW #301
Finally, in the enterprise security news, Security funding is back, baby! Security Unicorn layoffs continue though! We talk Zombiecorns, IronNet struggles, Netwrix acquires Remediant, We talk breaches: Lastpass, Rackspace, Okta via Github, Slack via Github, Github announces 2FA improvements, AI generates insecure code, Cyberinsurance challenges, Fyre Festival Fraudster Funding more Frauds All that and more, on this episode of Enterprise Security Weekly.
Stay up-to-date with us on X (formerly known as Twitter) for the latest show clips and updates! Find us @SecWeekly and stay connected with our cybersecurity community.
Adrian Sanabria
- FUNDING: Aztec Raises $100 million to Build Encrypted Ethereum
- FUNDING: CyberCube raises $50m for growth, with HSCM participating again – Artemis.bm
- FUNDING: DataVisor Announces $40 Million Strategic Growth Investment Led by Brighton Park Capital
- FUNDING: Germany’s VMRay ties up $34 million series B to expand threat detection and analysis
- FUNDING: Trilio raises $17M for its cloud-native data protection service – SiliconANGLE
- FUNDING: Seattle cybersecurity startup that aims to protect machine learning-based code lands $13.5M
- FUNDING: FireTail Raises $5M to Accelerate API Security, Led by Paladin Capital Group
- FUNDING: Cybersecurity startup SafeHouse raises pre-Series A funding
- (DE)FUNDING: IronNet’s latest NDR updates provide broader visibility of cyber threats – Help Net Security
- (DE)FUNDING: IronNet cybersecurity faces delisting threat, potential insolvency – Baltimore Business Journal
- ACQUISITIONS: Netwrix Acquires Remediant to Provide Customers with Enhanced Privileged Access Security
I'm very curious about the terms of any deal happening after the valuation reset. We'll probably never know with this one though.
The only recent comp is Palo Alto picking up Cider Security for $195m on $38m raised. That's 5.1x on money raised, but no idea what their Series A valuation was back in March, or how much revenue they managed to pick up in the 8-9 months they've been out of stealth.
This is Netwrix's 6th acquisition since getting picked up by TA Associates (PE) back in 2020.
- LAYOFFS: Cybersecurity unicorn Armis axes 25 employees
- LAYOFFS: Cybersecurity startup CyCognito cuts 15% of jobs
- NEW COMPANIES: Zecurity
Where to start? The name? The tagline (Sustainable Cybersecurity)? The description of what they do? "Zecurity's platform is a SaaS-based zero-trust platform to air gap your infrastructure from the Internet."
Everything about Zecurity reads like someone went to ChatGPT and asked for the most clickbaity cybersecurity startup copy ever.
- NEW COMPANIES: QWERX
- NEW COMPANIES: Picnic
- NEW COMPANIES: Gomboc – Cloud Infrastructure Security
- NEW FEATURES: Raising the bar for software security: next steps for GitHub.com 2FA
We've got quite a few breaches this week that begin and end with GitHub, so it's no surprise they're busy, trying to improve security for users and convince them to use it!
- OPEN SOURCE: Google releases vulnerability scanner for open-source software, backed by community-editable database
- BREACHES: Okta’s GitHub source code stolen, company downplays impact
- BREACHES: Slack’s private GitHub code repositories stolen over holidays
- BREACHES: Kevin Beaumont’s epic, month-long thread on the Rackspace breach
TL;DR - Rackspace made a big mistake choosing not to patch Exchange when they had a chance, but did an impressive job recovering from one of the worst worst-case scenarios I've seen a business deal with in a while - total destruction of a product line (though one that only accounted for 1% of their $3B revenue).
Still, no word on whether the email belonging to tens of thousands of small and medium-sized businesses were stolen.
- BREACHES: The LastPass disclosure of leaked password vaults is being torn apart by security experts
And I was one of them! I have some insights to share after tearing apart and examining my own (old, forgotten, I should have deleted it years ago) Lastpass vault.
- BREACHES: What’s in a PR statement: LastPass breach explained
- BREACHES: A retrospective on public cloud breaches of 2022, with Rami McCarthy and Houston Hopkins
- BREACHES: Notice of Recent Security Incident – The LastPass Blog
- DRAMA: Insiders worry CISA is too distracted from critical cyber mission
- TRENDS: Switzerland Strategy – Digital Switzerland Strategy 2023
Clearly, Switzerland saw episode 299 with Joe Carson and were inspired to put together an all-in-on-digital strategy. They turned around this plan pretty quick, I'm impressed! ;)
- TRENDS: AI assistants help developers produce code that’s insecure
This is a question I've had for a while. If AI is trained on general human-produced content, and humans are susceptible to mistakes, bias, and myths... How does the AI know the different between good content, or good code, and crap? Isn't it liable to just regurgitate humanity's mistakes?
What I REALLY worry about are folks being okay with this - folks who just want AN answer, and care less about whether it's the RIGHT answer.
- TRENDS: Non-Compete Clause Rulemaking
- MARKET ANALYSIS: Zombiecorns, by the numbers
- MARKET ANALYSIS: Welcome to ZOMBIE(corn)LAND!
u can’t do it alone. In the new world of the Zombiecorns, founders and leaders must look to their team to help carry them forward. Lead with passion, be transparent whenever possible, and help others to rally to your cause. If you try to be a hero and lead in silence you will not make it. Remember it took a team of people to get you where you are today, it’s going to take that same team of people to save you from the Zombiecorn fate.
- REPORTS: NSA Publishes 2022 Cybersecurity Year in Review
- REPORTS: The State of Cybersecurity in 2022 and Trends and Predictions for 2023
- CYBERINSURANCE: Ohio Supreme Court Says Ransomware Is Not Physical Damage
- CYBERINSURANCE: Cyber attacks set to become ‘uninsurable’, says Zurich chief
- SQUIRREL: Convicted Fyre Festival Fraudster Is Planning Another Bahamas Venture, But the Bahamas Don’t Want Him
- SQUIRREL: A Startup Founder and an Industry Analyst walk into a bar…
Startup Founder: How can I describe our product in a way that stands out to customers? The cybersecurity market is already saturated.
Industry Analyst: I got you dog, say no more
