Michael Roberson

There is a debate about CyberSecurity Bootcamps. So, allow me to add my perspective. I've been an IT guy forever. After a few years of acting as an EOL caretaker for an older parent, I talked to several companies about cyber-security, IT, and other portions of this field. The response was: Where are your certifications? What can you do? So, I decided to take a cybersecurity bootcamp. And the biggest benefit of that bootcamp, so far, has been to sharpen my mind. The results are that I have several ways to SHOW what I have done, plus the Security+ test is a requirement of the bootcamp, and I have that. I also decided that since I was pursuing this, and had the experiences through work that I've done for nearly all of my working life, I'd go on to take other certifications as well. I currently have cc: Sec+: and CISSP. I'm in the midst of pursuing Cloud+, and a few other certs. And the people that I've met through, and at, the BootCamp, are great contacts and people. #BootcampsAreReal #Springboard #CyberSecurity #Certifications

4

We all have to think about the best place for "security vs. usability" to meet. Here's a new one that bugs me a little bit. I'm getting legit, real text messages with a bill from a medical provider. The "from" is just five digits and the URL is a shortener. I can usually tell what's legit and what's a scam, but many people cannot. This is going to be a scammer's dream. If medical providers are going to send bills over text, a lot of people are going to get scammed. I get that it's an easy, fast and low cost way to send out bills, but I feel like it's a little too far away from the "security" end of the spectrum. #smishing #SocialEngineering

14

1 Comment

I don't think this gets talked about enough: the single sign-on (SSO) Tax is predatory and highly unethical. If you're not familiar, check out this great site: https://sso.tax/ I've heard it said that there are cost factors that explain the need to charge extra for SSO. To me, it looks more like holding responsible consumers hostage for an upsell. Maybe I could be swayed if there was an itemized breakdown of how the additional development/infrastructure cost is reflected in the price tag, but I'd be willing to wager that SSO is turning a profit in many of these cases. This goes to the broader point that there are basic security rights that ought to be respected. You shouldn't sell cars without seatbelts, and you shouldn't be able to sell an enterprise-grade product without SSO as a given. Security isn't a luxury. If you're an enterprise consumer and see a prospective vendor doing this, I'd have second and third thoughts before signing on the dotted line.

9

2 Comments

Are you applying to dozens, if not hundreds of security operations openings and not hearing back? Quinnlan Varcoe will be teaching Hacker in Heels Insiders how to stand out in a unique way, and form genuine connections with people who can give you the opportunity to start or advance your career in security operations. Join me and our impressive, niche community of women in cybersecurity as we talk all things security operations tonight. 📆 Tuesday, June 11 @ 4P PT / 5P MT / 6P CT / 7P ET EXTRA: Would you, or someone you know make an excellent guest mentor? I'm looking for someone for our July 9th call. Priority will be given to women of color and/or women who want to speak on a cybersecurity subject (as opposed to personal branding, confidence, etc.) Share your proposed topic in the comments, or tag a nominee! P.S.—We offer to pay all our guest mentors, because we believe all women should have the option to be compensated for their labor 💜 #womenincybersecurity #cybersecurity #securityoperations #secops

63

15 Comments

So, lately I've been studying API Security, and I'm really fascinated. Here's my latest nugget of wisdom from webinars, books, and content I'm consuming…   When using an application, lots of API calls are likely happening in the background. Some developers have designed the app in such a way that a request will return a large body of data. However, only a portion of that data is rendered in the user interface (UI).   Adversaries are not limiting their use of your API to just the intended UI. They will pull all the data back to see if you're revealing more than you should in the response body.    This security issue is part of the OWASP Top 10 API Security Risks. Specifically, its API3:2023 - Broken Object Property Level Authorization.   Properly threat modeling the API would be ideal, but is likely a time consuming, release stalling endeavor.   I'm curious to hear how different people build API Security into their overall product security strategy. #CyberSecurity https://lnkd.in/gPJtMK6U

15

6 Comments

I've seen a number of security products recently touting "corporate knowledge" integration. While in theory this makes a lot of sense, the practicality in a real environment seems dubious. While knowing which databases have PII is great, most organizations don't have the instrumentation or inventory to answer that question (and I mean Fortune 100's as well). It would be cool to search Jira tickets to know every detail about a corporate system, of course. Have you looked at Jira boards in most companies? I know it makes for great talking points and demos, but our industry has a major problem with unrealistic expectations. It's hard enough to aggregate logs from every vendor, normalize the data, and try to make sense of that. The unstructured mess that is corporate chats, task management systems, and ticketing systems is an entirely different animal. The idea that your engineering team clearly writes out tickets that explain everything about the infrastructure just isn't realistic. In a perfect world, this data would help inform these threat detection platforms. But can we be real about the state of data fidelity and availability in the enterprise? I'm worried we are just falling into the same hype machine of empty promises as 2014-2016. There are some really cool tools, old and new, that can help us better detect and automate. But the idea of an "all-seeing eye" tool doesn't match the realities of a modern enterprise. I just wish we would think beyond demo day sometimes... #cyber #ai #artificialintelligence #threatdetection

11

2 Comments

For those looking for their first or next cybersecurity role, here is some interesting research from NICE's CyberSeek job study for you... There are many job openings in cyber, with approximately 15% (469,930) of cybersecurity jobs being unfilled (CyberSeek). The harsh reality of those open positions is that they are demanding more experience than the market can provide. The data in the CyberSeek study, a joint research effort led by the National Initiative for Cybersecurity Education (NICE), CompTIA, and Lightcast, provides job seekers and employers with insights about the number of qualified professionals (based on certification) in states and metropolitan areas around the U.S. Before proceeding I'll also acknowledge that certifications are not always the best measure of an individuals skill and certainly not their potential. However, certifications can often be the most efficient way to select a handful of candidates to interview from a pool of hundreds or thousands. The data for my locality, Richmond, Va., shows the following: - Richmond is slightly below the national average when it comes to filling jobs, with 17% of available roles being unfilled. - The shortage of cybersecurity professionals began around 2018, peaked around 2022 with 47% of the total available cyber roles in Richmond being unfilled, and has rebounded in the past two years to come near the national average with 17% of roles being unfilled. - Oversight and Compliance roles lead the way with the most openings, followed closely by Implementation and Operations, Design and Development, Protection and Defense, and falling off drastically with other types of roles. - There are approximately 1,332 CompTIA Security+, 566 CISSPs, 321 GIACs, and 89 CIPPs, and there are not enough CISAs or CISMs to be recorded. Meanwhile, there are currently 710 open roles for CISSPs, 505 for CISAs, 385 for CISMs, 376 for CompTIA Security+, 232 GIACs, and 61 CIPPs. Here is what the data says to me, much of which is no surprise: 1. There is a clear need for experienced professionals (CISSPs, CISAs, CISMs) 2. There are many entry-level professionals (CompTIA Security+), with 1,332 in the City and only 376 open roles looking for this certification. 3. Looking in an area outside of your immediate metropolitan zone may change your luck in the job hunt significantly. Many of the numbers I've cited for Richmond are flipped on their head if you look at Northern Virginia & D.C. statistics. 4. To break into cyber, you may have to be willing to work in a role that isn't your dream role in the immediate and long-game your path to your desired end-state. (This was me) I thought this was an interesting resource worth sharing for those currently interested in the market. You can check out the CyberSeek study results here: https://buff.ly/2J89dpf #cybersecurity #infosec #jobsearch #careers

23

3 Comments

This breach at #GlobeLife serves as a reminder that security isn't a one-time setup — it's a continuous process. Regular audits of access permissions and user identity management are essential. Orgs have to continuously evaluate their security posture to address vulnerabilities before they are exploited.

2

Since I'm so down on CNAPP, people might assume I'm anti-platform. I'm actually pro-platform, but "cloud security" as the platform never made sense. Instead, there should be one scanning solution that gives findings to devs as far left as possible, and one runtime solution that protects runtime cloud infrastructure from attacks. Some examples are below. CNAPP is the worst of both worlds - it's scanning configuration when it's too late, sending those alerts to the wrong teams, and wrapping runtime in as an afterthought. Here are some example "platform" vendor pairings I think make a lot more sense than buying a CNAPP. For clarity, when I say ASPM I include being able to scan and when I say CDR I include a Kubernetes agent at the heart of that: 1. OX Security + Sweet Security (ASPM + CDR) 2. Cycode | Complete ASPM + RAD Security (ASPM + CDR) 3. Xygeni + Upwind Security (ASPM + CDR) 4. Aikido Security + ARMO (ASPM + CDR) 5. Jit.io + Sysdig (ASPM + CDR) 6. Arnica + Aqua Security (ASPM + CDR) 7. Backslash Security + Wiz (uniquely complementary overlap) With any of these combination of solutions, you're pretty well set with simple complementary tooling to "shift left" and "shield right"

175

56 Comments

🎤 Friendly PSA: make sure your app doesn't send reset password emails to unverified email addresses. 📨 "Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email address." 🧠 This is also a good reminder to turn on that MFA for your accounts. As GitLab states: "Additionally, users who have two-factor authentication enabled are vulnerable to password reset but not account takeover as their second authentication factor is required to login." https://lnkd.in/gAv5WKkj #hack #mfa #cisa #passwords #security #auth #wristband

8

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments

"The National Vulnerability Database is broken, and there isn't an easy fix." This is another canary in the coalmine visual. There are currently 10190 CVE's awaiting analysis (as of 8:53 am EST on 5/14/2024). Last month alone 3704 were received for analysis, 223 were analyzed (~6%). That's a significant backlog.. We don't know what we won't know for a considerable amount of time... That's concerning... https://lnkd.in/e5DCVwvr https://lnkd.in/eSBJEHg4 #penetrationtesting #vulnerabilitymanagement #infosc #cybersecurity #riskmanagement #resiliency #resilience #compliance #healthcare #HITRUST #HIPAA #criticalinfrastructure #risktolerance #NVD

2

Submitted 2 bugs at a time 1. Default credentials leads to admin panel access 2. Information Disclosure Through Metrics . . . . #cyberattacks #cybersecuritytips #redteam #hacked #security #securityanalyst #informationsecurity #penetrationtesting #vulnerability #vulnerabilitymanagement #vulnerabilityassessment #vulnerabilities #hacking #testing #manualtesting #report #reported #wayback #jwt #sensitive #information

57

Copilot for Security Prompt of the Day: Show me Sentinel incidents that were closed as a false positive. While this one works, a better one would direct CfS to show the actual Incident number and title. ...so... Better Copilot for Security Prompt of the Day: Show me Sentinel incidents that were closed as a false positive. Supply the Incident number and Incident Title. https://lnkd.in/g7_pfDhV #CopilotforSecurity #Cybersecurity #MicrosoftSecurity #Security #GenerativeAI

13