In a previous post I talked about how security questionnaires are security theater.…
Thoughts on the OWASP Top 10 2021
This post will talk about my initial thoughts on The OWASP Top 10 release for…
The Strange World of “Good Enough” Fencing
I’ve always been fascinated by security that was “just good enough”.…
Dead Drops and Security Through Obscurity
There’s massive confusion in the security community around Security Through…
The Presenting Vendor Paradox
There’s a paradox in information security where the community wants two…
Why an NTSB Wouldn’t Be Helpful For Ransomware
Twitter is great for quick ideas that may or may not be useful. I had one the…
Analysis of the 2021 Verizon Data Breach Report (DBIR)
Every year I like to look at Verizon’s DBIR report and see what kind of…
Explaining Threats, Threat Actors, Vulnerabilities, and Risk Using a Real-World Scenario
Casey Ellis (of Bugcrowd fame) had a great post on Twitter today about security…
What if We Made Paying Ransoms Illegal?
I was on Twitter the other day and saw someone suggest that we could fix people…
The Consumer Authentication Strength Maturity Model (CASMM) v5
If you know anything about internet security then you likely spend a lot of your…
A @TomNomNom Recon Tools Primer
There are recon tools, and there are recon tools. @tomnomnom—also called…
3 Metrics That Will Indicate We’re Taking Security Seriously
A lot of people are surprised when I tell them that computer security isn’t…
Analysis of the RECON/Attack Surface Management Space
I am often asked for my thoughts on the Bug Bounty / RECON / Asset Inventory /…
The New Reality of State-sponsored Attacks on US Businesses
The Lawfare Podcast is one of my few staples, and I just listened to another great…
Demand, CyberInsurance, and Automation/AI Are the Future of InfoSec
I think there are four main trends that will play out in the field of information…
I Actually Like Remote and Pre-recorded Presentations
I have an unpopular opinion about the security conference scene. Basically, it’s…
You Should Be Running Your Own VPN Server
VPNs are more popular than ever, but I think many are confused about why they’re…
Ransomware Groups Add a Third Threat Vector: DDoS
I’ve been writing a lot on ransomware recently, and wanted to comment on…
Operation Fortify: A US Ransomware Plan
The US is currently being ravaged by ransomware. Google News Results for US Ransomware…
Cyber Pearl Harbor Is Happening Right Now — It’s Ransomware
Since 2007 the InfoSec industry has been talking about TheBigOne™—the…
Everyday Threat Modeling
Threat modeling is a superpower. When done correctly it gives you the ability…
No, Moving Your SSH Port Isn’t Security by Obscurity
I just came across another post on Hacker News talking about why you shouldn’t…
Zuboff vs. Doctorow vs. Miessler: What’s the Greatest Threat to Human Privacy?
Shoshana Zuboff came out with a brilliant work called Surveillance Capitalism…
Mechanizing The Methodology
Download the Slides. I presented at DEFCON’s Red Team Village on August…
How to Initiate Contact With a Mentor
I’ve been in security for over 20 years now and have received thousands of emails…
