Adam Shostack :donor: :rebelverified: / is on Nostr

Author, game designer, technologist, teacher.

Helped to create the CVE and many other things. Fixed autorun for XP. On Blackhat Review board.

Books include Threats: What Every Engineer Should Learn from Star Wars (2023), Threat Modeling: Designing for Security, and The New School of Information Security.

Following back if you have content.

Website: https://shostack.org
Latest book: https://threatsbook.com
Peertube Videos: https://video.infosec.exchange/accounts/adamshostack
Youtube: https://youtube.com/shostack

Last Notes

2024-09-20 13:35:11

How it started, how it's going
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/170/140/659/266/857/original/529e2e14b07f0050.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/170/140/949/987/284/original/c865679e75f7754a.png

2024-09-12 23:52:26

- reply

Here I am floating in my tin can
Far from realty
America is blue
And there’s nothing I can do

2024-09-11 23:41:13

If the next administration wants to support entrepreneurs and small biz, we need a renewal of the paperwork minimization rules.
I'm now 45 minutes into insurance paperwork, despite having a broker supporting me. Enjoying such questions as "What is the ending month of the ERISA plan."
I've got 4 outstanding emails to lawyers, CPAs and more support email folks.

2024-09-03 15:20:22

- reply

Appsec
Crowdstrike released what they call an RCA. Before they did, I said I’d judge it based on clarity, depth and scope, and it fails on all three. There’s no “five whys”, there’s no discussion of management choices or funding. Rushing root cause work gets you shallow analyses and you get shallow improvement.
Narrowing the Software Supply Chain Attack Vectors: The SSDF Is Wonderful but not Enough by Laurie Williams (from March, but I’d missed it).
Simon Tatham lists Code review antipatterns, none of which specifically mention security, but code reviews are often associated with security, and the “Late breaking design review” pattern certainly ties into threat modeling either done or communicated badly.

2024-09-03 15:20:14

My appsec roundup for August is out
https://shostack.org/blog/appsec-roundup-august-2024/
Brett Crawley released Threat Modeling Gameplay with EoP: A reference manual for spotting threats in software architecture, published by Packt, a full book on the game. Awesome! (I was honored to write the Foreword.)
In a blog post at Forbes, Zak Doffman discusses a New Warning As ‘Spike’ In GPS Spoofing Attacks Hit Passenger Planes, citing a rise from 200 daily incidents to 900 in Q2, 2024. It’s really nice to see quantified rates, and this echos a theme, that the threat to GPS location is growing.
Chris Martorella of Miro has released a template, Threat Modeling - STRIDE on their platform.
The Australian government led a coalition who released Best Practices for Event Logging and Threat Detection. It’s probably useful for reviewing operational logging practice, despite a focus on APTs (to the exclusion of ransomware or other attackers), and a confusion about the relationship of “baseline” to “best.”

2024-08-22 18:38:40

In case you missed it, Ars Technica has a story, Secure Boot is completely broken on 200+ models from 5 big device makers. The key* point is that “Keys were labeled "DO NOT TRUST." Nearly 500 device models use them anyway.” At some level, I get it. There’s a lot of work to do in shipping a big complex system, even if that big complex system is in a small form factor. But.
Should a company shipping a cryptographic product realize they need to do something about the keys? I have a hard time with an answer other than “yes.” What that work is depends on the system, but they seem to have failed to look at a fundamental component that’s a key part of the boot process. Never mind “look carefully.”
Two of the companies which failed have taken CISA’s Secure by Design Pledge. (It’s not hard to figure out which, but my goal here is not to call them out or shame them.) Should they be penalized? Removed?
https://shostack.org/blog/secure-boot-and-secure-by-design/

2024-08-20 17:51:47

- reply

you could train an LLM on your captions and presentations, and then you'd have 3 problems? 😇
(accuracy, speed, and security!)

2024-06-14 15:46:13

I have decided the time has come for me to speak up about someone who has been threatening, stalking and harassing me for over two decades. His actions have taken a toll on my health, my family, my business and my reputation. I have not done the things he accuses me of doing.
My full statement is at shostack.org/stalker
Following advice, I'm going to go offline for a bit, and friends will be handling my social media accounts. After that I'm going to get on with my life.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/615/749/212/731/544/original/d5825c2c5b1b29e0.png

2024-06-04 20:17:05

A group of leading AI researchers have released a letter about a "Right to Warn" advocating that staff can warn the public about risks from their employer’s products, without being sued for disparagement or retaliated against. It’s specific and thought provoking, and perhaps we should have a broader conversation about it, including not just AI, but security and privacy.
https://righttowarn.ai/

2024-05-25 16:35:50

“Being scolded on mastodon" is not an attractive proposition to the average person but fortunately I have a mute button.

2024-05-12 22:32:47

I admit to wondering what the National Pregnancy Database bill was all about, and according to this, it's government handouts to anti-choice organizations.
(Not to mention additional handouts to data brokers after each inevitable breach of the database.)
https://hachyderm.io/@cyberlyra/112428575610501862

2024-04-02 23:42:21

Live blogging the CSRB report which opens "The Board concludes that this intrusion should never have happened. Storm-0558 was able to succeed
because of a cascade of security failures at Microsoft."
at https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf

2024-03-25 19:43:47

New blog post
The National Vulnerability Database (the NVD) appears to be in some sort of hiatus, no longer assigning CVSS information to CVEs. They’ve posted a note:
NIST is currently working to establish a consortium to address challenges in the NVD program and develop improved tools and methods. You will temporarily see delays in analysis efforts during this transition. We apologize for the inconvenience and ask for your patience as we work to improve the NVD program.
If you want to understand what’s happening, hackread says [@joshbressers](https://infosec.exchange/@joshbressers) first drew attention to it, and Josh has a podcast on the episode. Me, I wonder if this has to do with the 12% budget reductions at NIST. Beyond the why, many people are quite concerned, because they’ve been using CVSS scores to reduce the amount of patching work they do, generally under a label like “risk management.” (I prefer to think of it as workload management when you’re letting someone else make “risk” decisions for you. And that’s fine. We do this outsourcing in all parts of life, work and personal.)
Full post:
https://shostack.org/blog/the-nvd-crisis/
#NVD #CVSS #patchmanagement
#riskmanagement
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/158/039/161/551/405/original/c4400eec2e7a38cf.png