Donald Ngo

A colleague sent me a link to Bob Lord's Thanksgiving "I'm thankful for TLS" post, The Quiet HTTPS Revolution https://lnkd.in/gCx2uxdU Good article, and TLS is doing a ton of work for all of us. Lest we forget about the pitfalls of metadata, however, if you're trying to achieve reasonable (not over-the-top) security, other fundamentals like the DNS exhaust from browsing should be protected, as well. Otherwise, someone that would have been in position to view the unencrypted trafffic can still make accurate guesses on what you are up to. Also, let's not forget to give a heartfelt thanks to the Electronic Frontier Foundation (EFF) for creating Let's Encrypt and Certbot, without which, millions of sites would still be without trusted certificates.

13

Are you coming to RSA Conference? If so, join us at SCW Coffee Shop! Bluestone Lane SOMA Coffee Shop 55 2nd St, San Francisco, CA 94103 On May 6th | 12:30PM PST. Join Secure Code Warrior CTO & Co-Founder, Dr. Matias Madou, Jeffrey Martin from Mendio, John B. Dickson from Lasithi Security, and Viswanath S Chirravuri from Thales Digital Identity and Security to learn about: Incredible techniques for winning over developers and helping them prioritize security The challenges in measuring security skill development, and how to overcome them Why a developer-centric ‘Trust Score’ could be the missing piece of the compliance puzzle for every top organization and can unlock the benchmarks needed to reach new levels of risk reduction in code. https://lnkd.in/gMzG2WuJ

12

Interesting Okta vulnerability (see link below) allowed users with usernames longer than 52 characters to potentially log in without password being validated. Kudos to Okta for a very detailed post on the issue but the root cause is that Okta seems to have used a password hashing algorithm (bcrypt) to generate a key. The fix was to use a key derivation function (PBKDF2) instead. Okta asked customers to verify logs to see any improper authentication methods. It is unlikely this was abused as the vulnerability was found (disclosed responsibly it looks like) and fixed quickly. But my co-founder Kartik CDS who full name expands to 45 characters breathed a sigh of relief :) It's 2024 - bcrypt and other password hashing functions have been around for a long time. It is well known that most implementations of bcrypt have limitations on password length (usually 72 bytes). Okta used a combination of user id + user name + password to derive a key. 20 byte user id and a 52 byte user name will easily go past the 72 byte limit rendering the password useless. Crypto is hard to get right and the impact of even a slightly improper use of crypto can be dangerous as can be seen by this advisory. We all write encryption/crypto policies as part of our compliance programs. The policies are almost always right but subtle mistakes such as these can be hidden everywhere. #encryption #keyderivation https://lnkd.in/g9dUQYXf

76

3 Comments

🕸 The Security Data Fabric Shift Explained🕸 Last month, Zscaler acquired Avalor for $350M. A security data fabric and vulnerability management startup that only came out of stealth in April of 2023. This acquisition sparked tons of interest and funding activity in the security data management space. It also reignited the platform v. best-of-breed debate and hinted at what's to come for AI in security products. However, this acquisition had many question marks surrounding it. In this deep dive, I cover: ✅ What security data fabrics and security data ETL are ✅ The flurry of activity that happened immediately after the acquisition ✅ Why the acquisition makes sense for Zscaler ✅ What other vendors are doing with data fabrics including CrowdStrike, Microsoft, F5, and SentinelOne. ✅ The implications for the security industry, including incumbents, startups, and security teams I also explore the growing importance of data and AI in security and how this acquisition positions Zscaler well for the next 5-10 years. What are your thoughts on this acquisition and the security data management space? Let me know what you think in the comments section! 👇 🔗 Link for the full post in the comments! #cybersecurity #datasecurity #AI #acquisition #innovation #infosec

62

23 Comments

Today's Adobe security update has patched the in-the-wild zero-day PoC that EXPMON Public (https://pub.expmon.com) detected couple months ago (https://lnkd.in/ghQYYzXR). https://lnkd.in/gqxHHCfe Note: not want to cause confusion - this is not a working exploit, but a good PoC. Users are recommended to update their Adobe Reader ASAP, as we're going to point to the public sample with all the details soon in the next few days.

12

** There's New Development about this case ** We tested the (exactly the same) sample on the "patched" Adobe Reader version, it displayed additional dialogs, but if the user clicked/closed those dialogs, the app still crashed! Same UAF bug! We're contacting Adobe to find out what's going on and will update here. For now, we have to postpone the release of the details because the bug seems not properly fixed. [Update on Monday] Adobe has confirmed to us that the bug is not properly patched. "I can confirm our Acrobat product team has identified a secondary fix that is required to fully address this issue. We are actively reviewing and working to prioritize the fix in an upcoming patch. I will be sure to follow up with you once we have a clear release timeframe." Guess we have to hold our blog posts until the new patch becomes available to users. Sigh.. https://lnkd.in/gbBDuDHC #expmon #adobe #pdf #zeroday #0day #detection

8

I wanted to share what seems to be a great service for AWS discount that was shared on a private Cloud Security Forum slack - https://pump.co/ Pump appears to be an AWS Distributor. While I have not used before, Pump allows SMBs to leverage enterprise discounts and prepayments without the minimum spend commitment. Worth checking out if you're wanting to save a little on your AWS bill - though read the T&C's first!

4

🔍 How IBM’s Purchase of HashiCorp Could Change Your Approach to Secrets Management. With HashiCorp Vault now under IBM’s wing, it’s a good time to rethink the tools you use for managing your secrets. Suresh Sathymurthy from Akeyless Security breaks it all down in our latest blog post. Read his insights on what this big move might mean for you. https://okt.to/bpVaTm #IBM #HashiCorp

14

Bringing Together Splunk Observability & AppDynamics for Unified Visibility Thursday, September 26, 2024  |  12PM SGT / 2PM AEST End-to-end, unified visibility is key to quickly troubleshooting and ensuring that, when issues do occur, your business and end user’s experience are affected as little as possible. But how do you truly achieve end-to-end visibility? By embracing full-stack observability and the power of the integrated Splunk Platform, Splunk Observability Cloud, AppDynamics, and Splunk IT Service Intelligence (ITSI). Join this session to explore the ins and outs of this integration, how it can help you and your team gain end-to-end visibility and accelerate troubleshooting, and how other customers have achieved real-life success. In this webinar you will learn: - How Splunk Platform, Observability Cloud, ITSI, and AppDynamics are currently being integrated - Why end-to-end visibility is critical and how it helps accelerate troubleshooting - How to implement this integration and what software components are involved - Real-life success stories showcasing the business outcomes and ROI achieved by other customers Use the link below to register: https://lnkd.in/gAZeiHhh

10

Check out this video where I explain where DagKnows fits in a typical incident response and remediation workflow. If you see a need for a tool to perform initial diagnostic steps and enrich your alerts or even remediate problems automatically then this tool is for you! In the next part, we go over the actual demo. Stay tuned.

19

Observability of your environment, regardless where it is deployed and regardless if the resources monitored are IT resources (infrastructure, VM's, Kubernetes clusters, etc.) or OT resources (devices, assets such as machines, pumps, etc.) [via the CNCF #AKRI initiative - https://docs.akri.sh/] is a critical application of any operation. If you cannot observe the behavior, health, and activities of your environment, you cannot optimize and ensure smooth operations, enable predictive maintainability to reduce outages due to wear and tear, and so forth. Observability is key to making this happen. It is great to see that the #AzureMonitor team is tapping into the power of #OpenTelemetry and is bringing an end-to-end observability solution to wherever your resources might operate. https://lnkd.in/gbVDcTYr

386

11 Comments

Sharing the original post for reach as Shawn Hunter Turnbull is good people and those are good roles at JFrog. Under the 'sharing for reach' value add for 2025, I'll each time start to add the Datadog Integration for that software offering. It should be a busy year in that regard when you consider Datadog has over 800 out-of-the-box integrations (that's a healthy and growing number) such as this one for JFrog, significantly reducing time to value received. Datadog - JFrog Integration https://lnkd.in/eVvjq7HX All Datadog Integrations https://lnkd.in/gjdKEyt6 Simple not simplistic. Datadog is unified observability and security. If you have challenges correlating operational, development, security AND experience signals, team to team, system to system (and most do), we can help almost immediately. Ready for 2025! See you there friends.

18

1 Comment

This seems like a great role - If you can go to the office in Irvine or Palo Alto 3 days a week and live on $160k per year LMK and I'll help you with introductions. Key Responsibilities: Develop and implement automated security solutions to streamline cybersecurity processes, minimize manual interventions, and enhance operational efficiency across digital workplace and end-user platforms (email, endpoints, etc.). Design, configure, and integrate security tools with a focus on creating reusable, code-based solutions that scale across environments and adhere to best development practices. Proactively build and optimize scripts and applications to improve the effectiveness of cybersecurity controls, ensuring they remain resilient against emerging threats. Provide immediate “break glass” support to maintain stability and efficiency of cybersecurity services, prioritizing development solutions to prevent future occurrences. Continuously assess and improve email and endpoint security measures through automated monitoring and response frameworks to quickly adapt to new threat landscapes. Foster seamless integration and communication between cybersecurity tools, end-user platforms, and IT teams, leveraging APIs and custom integrations where applicable. Conduct regular audits and refinements to security operations, ensuring alignment with evolving cybersecurity standards, company strategy, and development best practices. Strong programming background in object-oriented languages (Python, Go, Java, etc.) and SQL, with experience building maintainable, scalable solutions. Proven experience with security tool development and integration (e.g., endpoint protection, email security, datalake, SOAR) including API utilization, custom scripting, and tool configuration to automate security processes. Experience with security data engineering or working in a DevSecOps environment, emphasizing automation, security telemetry, and scalable security infrastructure. Experience with modern cybersecurity technologies and platforms, including but not limited to endpoint security, email security platforms, EDR, SOAR, and datalake tools. Solid knowledge of endpoint and email security principles and a record of implementing and maintaining security controls in corporate environments. Comprehensive knowledge of RESTful APIs and data integration techniques to enable efficient, secure, and scalable data flow and communication between security systems and user-facing platforms. Strong familiarity with infrastructure-as-code tools such as Terraform or Ansible to automate and standardize security configurations across diverse environments. Hands-on experience with CI/CD pipelines, version control systems (e.g., Git), and modern software development practices to ensure high standards of consistency, quality, and automation in deploying and updating security tools.

5

A new "Ransomware" module is being deployed by #P2PInfect. Just recently we presented at fwd:cloudsec about our discovery of #P2PInfect and how aggressive it is becoming. We noticed an increase in aggressive behavior over the year. Recently a new "Ransomware" module is being deployed. Candid.Technology report here: https://lnkd.in/erQJqM6E #Ransomware fwd:cloudsec talk here: https://lnkd.in/erhEQuFi

19

1 Comment

“It would take forever with our current tooling to try and get feature parity [with Harmonic Security] or even come close to it. We’d be writing regexes forever.” To understand what we've built at Harmonic Security, it’s best to hear from some of our customers who have deployed it and are using it in earnest. For a third-party perspective, we worked with the amazing folks at Enterprise Strategy Group to speak with our customers and see it in action for themselves. 🤘 96% fewer alerts than the existing data loss prevention (DLP) solutions 💰 75% saved on project costs, resources, and time Full report below 👇

33

You need to use the findings and automate based on those. eBPF is not enough.

2