Justin Garrett

Taking a break from the PE-parsing to just dockerize SSA and get that working. Apparently I messed up some syntax and will need to figure out a better way to copy the file to check into the container, but getting closer. Should I have drag and drop from host to guest? Probably not. Do I have drag and drop from host to guest. Absolutely. For grins and giggles I am checking my current image with Trivy(aqua FOSS). But yeah just making slow progress. Hoping to start making an initial pass through theZoo this weekend (maybe next weekend, my other job has me working Friday night/Saturday) I ran Trivy and holy vulns batman. Total: 1540 (UNKNOWN: 16, LOW: 533, MEDIUM: 848, HIGH: 136, CRITICAL: 7) So, like FYI the python:latest image seems to have a lot of vulnerabilities. Might have to just redo the container from alpine.

7

I've been tempted to write about AI security for a while. I've hovered over the "post" button several times, hesitating each time. But this past weekend's discussion with friends and family convinced me it was time to dive in. Full Disclosure: I am still navigating the complexities of AI and its security implications. I may not have all the answers yet, but the more I explore, the clearer it becomes. AI's potential is immense. Its promise to revolutionize healthcare, streamline processes, and even predict the perfect pizza topping combo excites people from all walks of life (though I maintain pineapple is a hard pass!). Yes, it all happened while making pizza around the house. Applying AI securely is paramount as it becomes increasingly integrated into our lives. This leads to a crucial question: What security layers are essential when building and using AI? I recently read about the TPS (Toyota Production System) concept and about continuously testing and refining before the deployment, just like what we should do with AI. We must establish safeguards despite the rush to build and market the next big AI innovation. Compliance with regulations like GDPR and HIPAA is crucial, and as I read in an article, Europe's new legislation to regulate AI underscores this need. This article also says something important: “We need to foster innovation, but to do it in a way that is secure and safe.” The journey of understanding and leveraging AI is ongoing. We must establish labs and test environments and continue to explore AI's capabilities safely. AI is poised to disrupt mundane tasks, yet it's in its infancy stage, which means there is a vast amount to learn about harnessing its potential responsibly. Even skeptics, like a friend who mentioned AI's tendency to "hallucinate," contribute to important security discussions. It's critical to verify and double-check information before it's widely disseminated. As AI becomes more entrenched in our daily lives, ensuring it operates pretty and ethically is as crucial as compliance. We must be vigilant about potential biases in data and algorithms and work towards frameworks that promote responsible AI usage. Just as a restaurant requires a food safety inspector, AI needs ethical guidelines to ensure its benefits are realized safely and justly. AI security may be complex, but we can collaborate to concoct a secure recipe for success. Have you considered AI's security implications? What concerns you the most? Which aspects of AI security intrigue you? We can forge a secure, AI-powered future by sharing our knowledge and perspectives. As I mentioned to friends and family, security is everyone's responsibility, and through collaboration, we can truly unlock AI's potential for good. Keeping the Conversation Going: This is just the beginning of my exploration into AI security. I'm still piecing together the puzzle, but the more I learn, the more I realize the importance of these discussions.

10

1 Comment

If your company has to tell itself and its employees (via cringe mottos) how great it is…..it’s probably not that great. Especially if it is constantly asking you to positively review it after employees give honest negative feedback on social platforms. Maybe listen to the employees instead of trying to convince them they are wrong. Employees are not unhappy because they want to be, they are unhappy because you made them that way with action or inaction. Im lucky to work for an organization that listens to employees and is constantly trying to understand problems and find resolutions. We don’t solve everything, but make the effort to try. Trying to balance employee, customer, and financial satisfaction is not easy and there will always be compromises. But what keeps me coming in everyday is our drive to be the best at what we do, being the best employer we can, and building our relationships with our customers so they feel like part of our team. An almost fifty year old company doesn't hang around that long for no reason.

5

Let me get this straight: everyone is outraged the FBI bought location data that is sold to everyone else willing to pay for it? Really? Let me tell you something, they did not buy "special" data that no other marketing firm or foreign "interest" can't buy. The companies who collect this data sell it to anyone who can pay. Where is the outrage at that? What we need is a law making all such sales illegal, rather than pandering to just the anti big government lobby. https://lnkd.in/gXtUR6uh

1

I had a particularly productive weekend away from work this weekend, servicing and checking the vehicles. After doing the oil change and spending a small fortune on oil, I scanned each car for stored faults. Unfortunately, one car had two stored faults: 1. Open circuit windows heater ( I couldn't find anything wrong) 2. Improbable value - DPF differential pressure sensor As the engine light wasn't on, I decided to test the DPF differential pressure sensor, and it was indeed faulty. As it was late I ordered the generic Borsch replacement for £30 (including delievery) from a well know next day delivery website, and went to bed. The next day I decided to call the dealership, to see if they had the OEM part in stock, which they did. I purchased the OEM part for a shocking £86.22. Many ask why I refuse to fit non OEM part to my vehicles, even when I know the generic part and OEM part are built by the same supplier in the same factory. The answer is simply to keep the car as close as possible to when it left the showroom. As a collector I of beautiful things, I value things being as close to the original as I can keep them. But I do find myself asking why the dealership asks for more than x3 what the part would usually retail for, without a sticker of car manufacturer's logo on it. In this case the part usually retails for around £23, and that still allows for profit margins to both the manufacturer, and the retailer. So why did adding a new sticker result in a retail price of more than 3x what it normally retails for?

4

I've been on a side-journey for awhile, looking for a viable Linux desktop for my needs and situation. Basically load something as a dual boot and try it for awhile, run in to a roadblock, wipe the partitions and switch back to Windows for a bit, then try again with a different distribution. The current test with "Pop! OS (with Nvidia drivers)" has been going really well. The UI is crisp and fast, easy to config and use. I have had significantly fewer issues that I've had to look up or manually configure around (the dual boot was a concern for a hot minute, but figured that out with rEFInd). What I've noticed is that with this distro, _everything_ loads so much faster, even compared with the prior Linux tests. I am astonished at how fast many programs load and how snappy the system is. Even after all these years in IT, I can still be surprised. :) #linux #computers

9

1 Comment

Had a great time at the RVAsec 13 conference this week. Some highlights: - 👑 Kymberlee Price absolutely nailed the problems SMBs have with security products. We don’t have teams of people in IT, much less teams of people in security. We often have to chose between 1. paying a ton of money per seat or 2. not having SSO, which should be table stakes in the year 2024 (https://sso.tax/). - Prior to Tuesday I had never picked a lock. I have now picked 4 locks. The community here was so awesome. I had barely finished saying “I’ve never done this” before someone was next to me happily showing me how a lock works. - James Sebree and Evan Grant reminded me that there are some things you should probably think about before installing the router your ISP gives you. - David Girvin gave a phenomenal talk about how to be a good human when buying - and selling - software. Some really helpful advice to help you not get got by a sales person, and also how to not be a terrible sales person. - Caleb Sima made it clear AI is coming whether we like it or not. There are security concerns, but there is also potential for massive benefits. I am kind of upset that I just recently discovered RVAsec and HackRVA, but also excited to get more involved. DEFINITELY upset I didn’t sign up in time to get an electronic badge though. #RVAsec13

19

3 Comments

This is one of my favorite things on my desk: a little model of a dumpster fire. There is so much bad IT, processes and software out there, it really is one giant dumpster fire. My goal is to change that, one solution and one client at a time. That's it. That's the post. #microsoft #mspartner #dyngp #processes #it

27

4 Comments

Great to see Verizon start to put more emphasis on #SecureByDesign software as the root cause of so many breaches. Hopefully this means that frameworks that focus on product security like NIST SSDF become more prevalent in vendor selection.

18

1 Comment

New Podcast Episode has dropped. Season 2 Episode 3: Technical Certifications In this episode I will be speaking on technical certifications. -What are they -Where to find them -How to afford them https://lnkd.in/gv5bsVYv

5

Hi Linkedin, 20 years ago Sasser was born. Do you remember this one?  ✅The first infections occurred on April 30, 2004, on machines where the security patch provided by Microsoft since April 13, 2004, had not been applied.  ✅This worm spreads automatically through port 445 on any network-connected machine running Microsoft Windows 2000, Windows XP, or Windows Server 2003 without the necessary patch (or if it is not protected by a properly configured firewall) Did you have to face Sasser worm in a situation? 🤔 More infos at https://lnkd.in/e68tqin7 #infosec #informationtechnology #history #security #cybersecurity #cyber

12

9 Comments