Ian Wright’s Post

The actual metric being used here is interesting: "55% of the total lines of code (LoC) for all projects were written in a memory-unsafe language." If you are buying software that will be Internet visible then it is worth asking the vendor for this specific metric. The response could tell you a lot about the vendors attitude and approach to product security. https://lnkd.in/ggqGyV4z

I quite like CISA's Secure by Design Pledge. It often feels like we are not making much progress towards improving software security but picking a small number of valuable, achievable and measurable goals is a good way to get things moving in the right direction. https://lnkd.in/gCw-gKcx

Real world security patch deployment is *much* slower than you might expect.

"regular reconnaissance postures the group to identify vulnerable, end-of-life or no longer maintained devices on networks of interest, and to rapidly deploy exploits" This is why continuous attack surface discovery and vulnerability analysis needs to be part of every cyber defence program. It is included by default in our Cyber➾Guard service: https://lnkd.in/g3ebgTfW

It's 2024 and networked industrial control systems are still being shipped with hardcoded credentials. https://lnkd.in/enszuS2A

Interesting to see how much effort the initial payload puts into terminating security monitoring processes. Endpoint detection definitely has some value but it should only ever be seen as a single, fallible, defensive layer.

Interesting paper on detecting LLMs through the use of excess vocabulary. Or, to put it another way: A profoundly comprehensive, meticulously detailed, and exhaustively thorough investigation into the deployment, utilisation, and integration of ChatGPT in scholarly and academic research papers, conducted through a multifaceted and rigorous analytical lens focused on the identification, assessment, evaluation, and scrutiny of the proliferation, prevalence, and excessive use of advanced, highly sophisticated, and overabundant vocabulary choices, lexical selections, and intricately complex linguistic constructs and expressions. https://lnkd.in/e28298Dc

Entrust have some minor process issues so Google decides to kill every site that uses an Entrust certificate! Is this an over reaction? Or maybe 'big bad Google' is attempting to bully the much smaller Entrust by abusing their position as a major browser vendor? Nope. I think Google is doing exactly the right thing here. Certificate Authorities exist to enforce a set of rules, that is the only reason we need them. For most companies processes are simply a tool that is used to run the business but for a CA the process *is* the business. If they can't get it right then all they do is weaken the whole ecosystem. Some security decisions are hard. The Chrome team deserve credit for taking a difficult but necessary step. Forbes article: https://lnkd.in/ehPTsqDf Google Blog Post: https://lnkd.in/eqnNSTRT Entrust Response: https://lnkd.in/eeuVteiv