Patrick Cable’s Post

Zero - Trust is the principle that is being put forth to avoid the ransomware and other attacks that are being experienced today by various organizations. It is important to follow this principle when designing and implementing software systems today to avoid business loss and face. Given that many organizations recruit extremely junior programmers, or pay so less to their vendors that they in turn are forced to work with extremely junior programmers, for the development and maintenance of their IT systems, it becomes a difficult game for the #security personnel of the organizations to play. On the one hand they have to secure the organization's IT system against the malicious attackers and on the other hand they need to keep the internet open for the IT personnel for to learn, get answers quickly and to try out new software. Most organizations end up adopting the zero-trust policy with all the employees. They block as many categories of sites as is possible and keep only a small set open. Many organizations, which depend heavily on IT for their existence (forget sustenance and growth) block the maven repository as well as sites like stackoverflow.com which have answers and solutions that many IT engineers are looking for. Is there a product or a solution which can prevent malicious attacks, but allow the employees freely browse for answer, learn and try out new software without hindrance while the organization remains safe from malicious attacks?

You are not Google. Unless you're Microsoft, Meta, or a couple of other big tech companies. You don't have billions of customers and you don't store exabytes of data. But there's one way in which you are Google (or, if you're not, should strive to be): Security. It's now 2024, over 20 years after Bill Gates announced the Trustworthy Computing (TwC) initiative at Microsoft and the company even prioritized Windows XP SP 2 over Longhorn to improve security and reliability of their then current OS. You've gotten the memo. In fact, you've gotten the memo over and over again in those past 20 years. Security is not a feature; it is an essential property of any well-designed software system.

I’ve seen so many companies, small and large (2000+ employees), that struggle with the “[EXTERNAL] RE: [EXTERNAL] RE: [EXTERNAL] RE: [EXTERNAL] RE: …” chain loop at the beginning of the subject line. In my opinion, it looks tacky, tells customers you aren’t focused on details, and frankly, is annoying to look at. It’s a quick fix, and I want to show you how you can make sure the chain-loop stops. Today, I’ll show you in Microsoft Exchange. We’ll review Google Workspace in another post. Here’s some easy steps to follow: - Open up your Exchange Admin Center. - Go to Mail Flow -> Rules. - Create a new rule. - Name the rule, apply it to external senders. - Add the [EXTERNAL] message to your subject line. - Create the exception so that if the message comes through with ‘[EXTERNAL]’ in the subject line, the rule won’t run. All of this assumes you can try this in a test environment first, or ensure the rule only applies to one user (yourself). Once you have tested it and know it works as predicted, you can apply the rule organization-wide. Day 15 / 100 #external #emailwarning #microsoft #mailrules #smallbusiness #smb #technology #cybersecurity #marketing #business #leadership #learning #socialmedia #startups #100daychallenge 

I just like these two paraphaphs actually - elequant. Excellent document to read. "Careful design of developer ecosystems can drastically lower the incidence of certain kinds of defects and vulnerabilities, and in some cases practically eliminate them. Developer ecosystems should be designed to ensure that the resulting products and services uphold security invariants. A developer ecosystem provides continuous assurance at scale when it does so not only at a point in time for one specific version, but for every code change and for every released version across a class of applications."

Great document from Google on "Secure by Design", and the conclusion is spot on: -------------------------------------------------- It’s helpful to state safety and security objectives in terms of invariants—properties that a system should ensure will always hold, no matter what, even when under attack. Security mishaps are often the result of user mistakes or risky actions. Recurring mishaps tend to result from recurring or pervasive potential for user error. It is often unreasonable to expect users to known how to avoid a hazard, and to never make a mistake. Systems and applications should be designed with a user-centric view and uphold security invariants even when users take risky actions or make mistakes. The security posture of software products and services is an emergent property of the developer ecosystem in which they are designed, implemented and deployed. Software developers and deployers are users of the components of the developer ecosystem—software libraries, developer tools, production platforms. In this context, mistakes and omissions by human users can result in the introduction of defects into a product. Careful design of developer ecosystems can drastically lower the incidence of certain kinds of defects and vulnerabilities, and in some cases practically eliminate them. Developer ecosystems should be designed to ensure that the resulting products and services uphold security invariants. A developer ecosystem provides continuous assurance at scale when it does so not only at a point in time for one specific version, but for every code change and for every released version across a class of applications. --------------------------------------------------

Knowledge is Power

An essential part of shipping software securely is red teaming. It broadly refers to the practice of emulating real-world adversaries and their tools, tactics, and procedures to identify risks, uncover blind spots, validate assumptions, and improve the overall security posture of systems. Microsoft has a rich history of red teaming emerging technology with a goal of proactively identifying failures in the technology. #microsoft  #information #business  #management #business #tech

I can't beat myself up over what's in the past, but I really wish I'd considered the opportunity cost of spending several months last year hacking on OpenVMS for x86-64, running benchmarks and porting open-source programs, for the challenge. VMS is an evolutionary dead-end. Skills aren't in demand. VSI, the company that's been supporting the Alpha and Itanium ports and that created the x86 port, seems to get a new CEO every year. I can't imagine that's a pleasant job. How will they ever get new customers? What's the point? I think part of it was I enjoyed knowing how to do stuff in this archaic environment, and socializing with people on comp.os.vms, but now that Google News has decoupled itself from USENET, after being inundated with enough spam to make groups unreadable, that's a dead end for me too. I spent too much time messing with the Itanium version of #openvms before that, and have the electricity bills to prove it. That was an even bigger waste of my time. It's not that I learned nothing at all, but all that knowledge was wiped from my brain so quickly after I realized that I'd better focus on my marketable skills that I've even completely forgotten the password I was using on the x86-64 VM that I created. I spent some time trying to remember exactly what I'd used, but no luck. If that's not a sign to not spend any more time learning technical details that will do me no good, I don't know what is. *sigh*

Are you optimizing your tech stack regularly? Optimization plays a key role in: 🚀 Enhancing Performance: Optimized tech stacks lead to faster load times, better user experience, and lower downtime. 🚀 Facilitating Scalability: As your business grows, your tech needs will change. An optimized stack can scale up or down as needed without compromising on performance. 🚀 Improving Security: Regular updates and the right choice of technologies reduce vulnerabilities, keeping your data safe. 🚀 Cost Efficiency: An optimized stack uses resources more efficiently, which can significantly reduce operational costs. Whether you're a startup looking to build a solid foundation or an established enterprise aiming to stay ahead, the importance of an optimized tech stack cannot be overstated.  Contact us for a comprehensive tech stack evaluation and personalized optimization strategy: https://lnkd.in/gZX_QvGM #TechOptimization #DigitalSuccess #DigitalTransformation

Cybercrimes can hit anyone, large or small businesses. One of the ways is through #socialengineering. Take a read of our latest blog on Social Engineering. We discuss how a small local business in #phoenix became a victim. https://lnkd.in/dF_4B2JM