Adam Shostack :donor: :rebelverified: / is on Nostr

Author, game designer, technologist, teacher.

Helped to create the CVE and many other things. Fixed autorun for XP. On Blackhat Review board.

Books include Threats: What Every Engineer Should Learn from Star Wars (2023), Threat Modeling: Designing for Security, and The New School of Information Security.

Following back if you have content.

Website: https://shostack.org
Latest book: https://threatsbook.com
Peertube Videos: https://video.infosec.exchange/accounts/adamshostack
Youtube: https://youtube.com/shostack

Last Notes

2024-09-13 01:52:26

- reply

Here I am floating in my tin can
Far from realty
America is blue
And there’s nothing I can do

2024-09-03 17:20:22

- reply

Appsec
Crowdstrike released what they call an RCA. Before they did, I said I’d judge it based on clarity, depth and scope, and it fails on all three. There’s no “five whys”, there’s no discussion of management choices or funding. Rushing root cause work gets you shallow analyses and you get shallow improvement.
Narrowing the Software Supply Chain Attack Vectors: The SSDF Is Wonderful but not Enough by Laurie Williams (from March, but I’d missed it).
Simon Tatham lists Code review antipatterns, none of which specifically mention security, but code reviews are often associated with security, and the “Late breaking design review” pattern certainly ties into threat modeling either done or communicated badly.

2024-09-03 17:20:14

My appsec roundup for August is out
https://shostack.org/blog/appsec-roundup-august-2024/
Brett Crawley released Threat Modeling Gameplay with EoP: A reference manual for spotting threats in software architecture, published by Packt, a full book on the game. Awesome! (I was honored to write the Foreword.)
In a blog post at Forbes, Zak Doffman discusses a New Warning As ‘Spike’ In GPS Spoofing Attacks Hit Passenger Planes, citing a rise from 200 daily incidents to 900 in Q2, 2024. It’s really nice to see quantified rates, and this echos a theme, that the threat to GPS location is growing.
Chris Martorella of Miro has released a template, Threat Modeling - STRIDE on their platform.
The Australian government led a coalition who released Best Practices for Event Logging and Threat Detection. It’s probably useful for reviewing operational logging practice, despite a focus on APTs (to the exclusion of ransomware or other attackers), and a confusion about the relationship of “baseline” to “best.”

2024-06-14 17:46:13

I have decided the time has come for me to speak up about someone who has been threatening, stalking and harassing me for over two decades. His actions have taken a toll on my health, my family, my business and my reputation. I have not done the things he accuses me of doing.
My full statement is at shostack.org/stalker
Following advice, I'm going to go offline for a bit, and friends will be handling my social media accounts. After that I'm going to get on with my life.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/615/749/212/731/544/original/d5825c2c5b1b29e0.png

2024-06-04 22:17:05

A group of leading AI researchers have released a letter about a "Right to Warn" advocating that staff can warn the public about risks from their employer’s products, without being sued for disparagement or retaliated against. It’s specific and thought provoking, and perhaps we should have a broader conversation about it, including not just AI, but security and privacy.
https://righttowarn.ai/

2024-05-25 18:35:50

“Being scolded on mastodon" is not an attractive proposition to the average person but fortunately I have a mute button.

2024-05-13 00:32:47

I admit to wondering what the National Pregnancy Database bill was all about, and according to this, it's government handouts to anti-choice organizations.
(Not to mention additional handouts to data brokers after each inevitable breach of the database.)
https://hachyderm.io/@cyberlyra/112428575610501862

2024-04-03 01:42:21

Live blogging the CSRB report which opens "The Board concludes that this intrusion should never have happened. Storm-0558 was able to succeed
because of a cascade of security failures at Microsoft."
at https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf

2024-03-25 20:43:47

New blog post
The National Vulnerability Database (the NVD) appears to be in some sort of hiatus, no longer assigning CVSS information to CVEs. They’ve posted a note:
NIST is currently working to establish a consortium to address challenges in the NVD program and develop improved tools and methods. You will temporarily see delays in analysis efforts during this transition. We apologize for the inconvenience and ask for your patience as we work to improve the NVD program.
If you want to understand what’s happening, hackread says [@joshbressers](https://infosec.exchange/@joshbressers) first drew attention to it, and Josh has a podcast on the episode. Me, I wonder if this has to do with the 12% budget reductions at NIST. Beyond the why, many people are quite concerned, because they’ve been using CVSS scores to reduce the amount of patching work they do, generally under a label like “risk management.” (I prefer to think of it as workload management when you’re letting someone else make “risk” decisions for you. And that’s fine. We do this outsourcing in all parts of life, work and personal.)
Full post:
https://shostack.org/blog/the-nvd-crisis/
#NVD #CVSS #patchmanagement
#riskmanagement
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/158/039/161/551/405/original/c4400eec2e7a38cf.png