Read Time: 6 minutes

Vulnerable U Community,

Welcome to the latest edition!

Topic of the Week:

Picture this: you're scrolling the news and you come across yet another data breach in the headlines. It starts to feel like noise after a little while, doesn't it? Many of us assume that our email, phone number, and address are part of numerous data breaches and have various lines of defense mechanisms to limit the impact.

As infosec professionals, what can we learn from these breaches? Usually, we learn best from our own mistakes, and that still holds true. Who has worked at a company that has suffered a breach and all of a sudden found their previously proposed security roadmap has become miraculously prioritized? That's learning from one's own mistakes.

🌟 However, we work in a unique industry where we can also learn from others' mistakes frequently. This is due to some folks choosing to be vulnerable and talking publicly about their failures or challenges - but also helped along by regulations that require customer notification of data loss.

How can we best learn from others' challenges?

📚 I like a book by Angela Duckworth titled "Grit" where she uses a few key concepts that can help us here. One of my favorites is:

💡 “Develop a growth mindset” - Rewiring your brain to view challenges and setbacks as opportunities for growth and learning, rather than as evidence of unwavering limitations.

Fortunately, in our industry, we get to practice our growth mindset any time we open the news and read about a new breach. What can we learn from our peers challenges?

🔗 First off, as I stated in previous editions of Vulnerable U [link], extreme goals in infosec are useless. "Don't get hacked", "prevent all security incidents", these are things I've actually seen on strategy decks. Going back to Duckworth's book, she would suggest these goals could potentially lead to a fixed mindset and a sense of defeat when those outcomes are not achieved.

🏋️ To draw a parallel I came across in another part of my life: I've worked with a number of fitness coaches in my career and many times had a "goal weight" I wanted to achieve while working with them. One of my coaches at some point had a conversation with me early in the program where I asked him for help setting a good "goal weight" to strive for based on my height, age, etc. He said something along the lines of:

🤔 "What if we don't do that? If you said you wanted to lose 50 pounds with me and you only lost 40, would you consider yourself a failure?"

It really helped rewire me so that I wouldn't set myself up for potential disappointment and discouragement of even starting. Instead, we learn…

🎯 The process is the goal 🎯

So taking into account a recent breach like Uber's law firm [link], what can we learn without having to go through the same thing ourselves? I saw a few tweets about this article tongue in cheek saying "time to update your threat model" - but how many actually do that? Who is at work this week creating a document that illustrates how a data breach of their external council could lead to their own data loss event? I'd guess it is a very small number of folks. I'm making the case that number should be bigger.

🚀 Challenging you to take some actions:

1. Write down what adapting a "growth mindset" would look like for you in your personal and professional life.

2. Identify 3 setbacks you or your team have gone through recently. How could you view them as opportunities for improvement and identify areas for growth and development?

3. Brainstorm ways you can foster a culture of continuous improvement and innovation on your team. If you bring up ideas and solutions instead of problems and complaints, I guarantee your team, boss, and family will see the shift immediately and positively.

By focusing on the process of learning and growth, individuals and organizations can maintain their growth mindset and approach infosec with a sense of possibility and resilience instead of perpetual failure. Embrace the lessons learned from data breaches and setbacks, and use them as fuel for continuous improvement in the ever-evolving world of information security.

Elective Reading

Here are some things I’m reading right now and some cliff notes or thoughts:

Huge aggregate of malware defense papers going back many years - but just this week updated for 2023

SAST tool Semgrep has dipped their toe into using AI to help out with a problem that plagues vuln identification, false positives. - It even goes beyond that and suggests fixes to code automatically, powerful stuff on the horizon here.

Staying on the AI topic - Daniel Miessler has been putting out some fantastic head scratchers on the future ahead of us know that the AI pandora’s box has begun to open.

Super interesting point made by Alec Muffett here. The Executive Order has failed to link "capability to gain remote access" to the intended purpose of the software, which makes any application with an RCE bug illegal under the current definition of "commercial spyware.”

orca founder stepping down as ceo to shift leaders. Andy Ellis - Previous CISO for Akamai - talks about how this is a very mature move to avoid Founders Syndrome.

This is one of the best public write ups of a Threat Model I’ve ever seen. I’m going to do some long form discussions about it its so good. Attack trees, Data flow diagrams, trust boundaries, its got it all!

Kind of on brand with today’s newsletter topic eh? There are usually a lot of external forces pushing against sharing breach info publicly.

Andrew from GreyNoise sharing some great data as usual about a recent ransomware wave. Some great data visualizations to check out on it attached.

Hackers getting into the mainstream media always entertains me. Also why I dislike most “smart” devices in the home.

Plenty of articles on the takedown of Genesis Market. But a pretty cool document you don’t always get to see, the actual warrant used to perform the seizure: https://s3.documentcloud.org/documents/23742615/genesis-market.pdf

Jhaddix has been sharing a lot of good with the community for years. Lately he’s been pouring gas on that fire and really focusing on it. His new newsletter is full of goodies, he’s teaching a good course, he put out his master GPT prompts for free. Go give him a follow - especially if you’re a bug hunter or red teamer.

Community Spotlight:

Two of my favorite people in the industry, Ed Bellis and Michael Roytman released a book this week. I’ve worked closely with these two over the years and even given conference talks with both of them on the topics that they have not only written a book about, but built a company around.

If you’ve ever read about data driven approaches to vulnerability management, chances are you came across some of the data these two produced at their time running Kenna Security (now part of Cisco).

I still reference a slide deck Roytman put out titled “CVSS Sucks” and the breakdown of how fixing vulns stack ranked by CVSS Score is no better than randomly picking from your pile in actually fixing a vuln that might be used in a breach.

I’m excited to go through this book, they have told me its basically “How to build your own Kenna” - which I feel like a lot of people are trying to do, if they realize it or not.

Check it out if you’re into that: https://us.artechhouse.com/mobile/Modern-Vulnerability-Management-Predictive-Cybersecurity-P2278.aspx

(this is not a sponsored slot, I genuinely am proud of these two and love everything they put out)

Please write to me and share stories or anecdotes for this section. It goes very well with the theme of being vulnerable together to share stories. I’d especially love to hear about your failures. What is a time you failed? What did you learn? How did it change your life?

Extra Credit:

Help Us Grow! If you know someone who might be interested in joining the Vulnerable U community, please share this newsletter with them! As of now, spread will just be by word of mouth.

Parting Thoughts:

Let me know how I can help as always.. If there's a topic you'd like to see covered in a future edition of the newsletter, or if you have any questions or concerns, please don't hesitate to reach out to us. I’m always happy to hear from our readers and help in any way I can.

Stay safe, Matt Johansen
@mattjay