Chris Wysopal / is on Nostr

Co-founder/CTO Veracode. Former L0pht security researcher. Builds tools to find vulnerabilities in code at scale. Twitter: @weldpond

Last Notes

2024-03-21 15:16:57

House passes Protecting Americans’ Data from Foreign Adversaries Act, H.R. 7520 https://www.politico.com/news/2024/03/20/lawmakers-privacy-bill-tiktok-00148070
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/134/338/289/596/424/original/4c82961e654ed19e.jpeg

2024-01-26 15:04:15

As long as cybersecurity is treated as a criminal issue instead of a safety issue we will continue to see cybersecurity as an elective for computer science students. As a computer & systems engineering student I was required to take a couple of mechanical engineering courses. One of the courses opened up on the first day with a video of the Tacoma Narrows bridge collapse due to high wind. I would love to see a first computer science class open up with a command injection attack compromising a web server and then follow through with lessons about building systems safely.
I have hope with the Secure by Design language being used that professors and students start to see systems vulnerable to attack as engineering failures and not just simply the way things need to be to innovate. Without secure software engineering the result is outsized risk that must be mitigated in a variety of expensive and ultimately ineffective ways.
We can't control bad actors just like can't control the wind. Design and build software with this in mind.

2024-01-26 14:46:09

Many of us in AppSec have been saying this for a while. Your developers are part of the cybersecurity workforce and must be trained that way in college.
"It is long overdue for academia to reconsider their role in producing a software developer workforce that enables increasingly damaging cyberattacks."
It's great to hear CISA using their influence to push for change here. https://www.cisa.gov/news-events/news/we-must-consider-software-developers-key-part-cybersecurity-workforce

2023-12-21 14:17:14

Your input matters for the future of cybersecurity.
@CISAgov
is actively seeking feedback on Secure-by-Design (SbD) guidelines. Here's what they're particularly interested in:
1️⃣ Ensuring security is woven into the fabric of software development from the very start. Share best practices that even smaller software companies can embrace.
2️⃣ Empowering higher education to infuse security knowledge into their computer science curricula, and NOT as an elective! We need to shape future software developers and development leaders.
3️⃣ Dive into the economics of secure-by-design practices. How do these investments stack up against the costs of incident response and breaches.
Request for Information on “Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software”
https://www.federalregister.gov/documents/2023/12/20/2023-27948/request-for-information-on-shifting-the-balance-of-cybersecurity-risk-principles-and-approaches-for

2023-12-14 05:07:25

Hacking is part of war now. https://www.forbes.com/sites/davidaxe/2023/12/13/ukraine-has-figured-out-a-new-way-of-winning-battles-start-by-grounding-russias-drones/

2023-12-06 14:25:15

Breaking: Aliens have finally contacted us, and guess what? They want us to update our antivirus software!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/533/930/143/177/241/original/940d2c329dffa5ff.jpeg

2023-12-01 00:18:38

On Nov 2, 1988 the Morris worm crippled 10% of the of the internet. It was the 1st major computer security event
On Nov 30, 1988 National Computer Security Day was created to raise awareness of this new problem
Today is National Computer Security Day. How do you celebrate?

2023-11-29 20:47:47

"There are nearly 600K unfilled cybersecurity jobs in the U.S. right now, and about 3.5M open roles globally, says Lisa Gevelber, Google’s chief marketing officer for the Americas"
This is because all the openings are entry level positions requiring 5 yrs experience.

2023-08-04 15:48:31

Discover the extraordinary journey of Window Snyder, a trailblazing cybersecurity pioneer! Her genius was fortifying crucial software and devices we rely on daily, making our digital world safer.
https://techcrunch.com/2023/08/04/window-snyder-cybersecurity-trailblazer/

2023-08-03 14:27:08

Don't fear the tool. Fear the vulns. Police are alerting on Flipper Zero's potential for bypassing access control systems. I wouldn't call it a bypass. These are systems *missing* access control and relying on solely security by obscurity.
https://www.dailydot.com/debug/flipper-zero-racially-motivated-extremists-fusion-center-alert-nypd/
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/826/144/257/516/778/original/4e5304cd0b9c74ac.png

2023-03-28 15:03:11

I talked with @silvexis about cloud costs and drew parallels to Microsoft's Trusted Computing epiphany and the need to secure by design. Instead of "patch later" we now have "optimize later" and suboptimal results https://techbeacon.com/enterprise-it/why-are-companies-still-struggling-cloud-costs