Travis McPeak

Jason Soroko and I explain the major news items from the most recent CA/Browser Forum face-to-face meeting in Tokyo on the Root Causes Podcast. Topics include MPIC, 47-day certificate term, and Temporary Restraining Orders. Audio: https://lnkd.in/g-RaJifc Video: https://lnkd.in/gDJuyRAg

34

1 Comment

Crazy stat from our Sales Kickoff…AI Pentesting has led to $660M in cost avoidance for the US Government NodeZero has run 40,000 hours of pentests for the Defense Industrial Base (DIB) via the CAPT program NodeZero is 55x faster than a human, that’s the equivalent of 2.2M hours of consulting labor At $300 per hour for a consultant, that’s $660,000,000 of consulting labor costs the tax payer has avoided All while *significantly* reducing exploitation risk of critical DoD suppliers 🤯🤯🤑🤑💰💰 #infosec #pentesting Horizon3.ai #DIB https://lnkd.in/gbYWawyi

233

15 Comments

After DHS did not renew its funding contract for reasons unspecified, MITRE’s 25-year-old Common Vulnerabilities and Exposures (CVE) program was slated for an abrupt shutdown on April 16, which would have left security flaw tracking in limbo. CISA stepped in to provide a bridge. A CISA spokesperson sent CSO a statement saying, “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure there will be no lapse in critical CVE services. We appreciate our partners’ and stakeholders’ patience.” Sources say the contract extension will last 11 months. Yosry Barsoum, vice president and director of the Center for Securing the Homeland at MITRE, commented: “Thanks to actions taken by the government, a break in service for the Common Vulnerabilities and Exposures (CVE®) Program and the Common Weakness Enumeration (CWE™) Program has been avoided. As of Wednesday morning, April 16, 2025, CISA identified incremental funding to keep the Programs operational. We appreciate the overwhelming support for these programs that have been expressed by the global cyber community, industry, and government over the last 24 hours. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE and CWE as global resources.” https://lnkd.in/gPhB8vVQ

170

12 Comments

Hawaiian Airlines’ cybersecurity incident is a wake-up call: cyber resilience in aviation must go beyond uptime. While flights continued, backend disruptions highlight the urgent need for visibility into east-west traffic and hidden threats. This is where 𝐍𝐞𝐭𝐰𝐨𝐫𝐤 𝐃𝐞𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞 (𝐍𝐃𝐑) plays a pivotal role by continuously monitoring network activity, detecting anomalies in real time, and enabling faster containment. In today’s threat landscape, NDR isn’t just a security tool, it’s a business continuity essential. Cybersecurity must now fly in the cockpit of every airline’s risk strategy.

44

2 Comments

🚀🚀 #vet 1.9.8 released and it supports scanning GitHub Actions "code" The recent tj-actions/changed-files supply chain attack is the topic of the town. While it is a major incident, it appears the actual impact was somewhat limited. Coincidentally or otherwise. We want to protect our users against such attacks but we faced a key challenge. Our malicious code and package scanning infrastructure is built on the assumption that a package version, such as `pkg/npm:express@4.17.1` is immutable. If we scan this package once, we can trust its result in future because npm package registry will guarantee that a package version cannot be updated. This assumption was broken when it comes to scanning GitHub Actions code because GitHub tags are MUTABLE and thats what we saw in tj-actions/changed-files hack as well. To workaround this limitation, we handle GitHub Actions as a special case. We resolve the commit SHA of a given GitHub Action at the time of scanning before initiating a code analysis session. The implementation is generic enough to scan any GitHub repository. Try it out. Feedbacks and suggestions from the community is what drives our roadmap. Link in comment. 💻 Omkar Phansopkar Arunanshu Biswas Sudhanshu Dasgupta Kunal Singh 🎯 Sahil Bansal

64

2 Comments

Audits and forensics aren’t witch-hunts to “name the hacker.” They’re how you stop the next breach. A good audit/forensic review will: Expose misconfigurations and control gaps Surface broken processes (people • tech • vendors) Produce a clear timeline to improve response Provide evidence for insurance claims and regulators Demonstrate senior management intent and due diligence One breach costs more—in money, trust, and time—than doing the work properly up front. At Tylers, we turn incidents into hardening plans: fixes, owners, deadlines. Not blame—better security. #CyberSecurity #DigitalTrust #Forensics #Audit #IncidentResponse #Tylers

17

2 Comments

For SOCs, it’s not just the hackers that pose a threat - it’s the avalanche of data that buries real signals under noise. Security logs, once the fuel for detection, are now both an asset and a liability. The flood of redundant, misaligned, or uncurated telemetry drains not just budgets - but analysts. The challenge isn’t just collecting data - it’s collecting the right data, in the right shape, at the right time. Security tools generate logs by the terabyte. Yet most organizations lack a strategy to qualify, contextualize, or prioritize what enters their SIEMs. As a result: ▪ Real threats get buried in noise. ▪ False positives clutter dashboards, wasting attention. ▪ Costs balloon from excessive licensing and storage. To move from reactive firefighting to proactive defense, SOCs must elevate telemetry management as a core security function. Here's how leading teams do it: 1. Precision Filtering, Not Blanket Collection Start with a threat-informed view: what data truly supports detections? Eliminate noise - e.g., suppress successful login logs unless from unusual geographies or times. 2. Normalization and Enrichment as Multipliers Standardize formats and enrich with business context - asset criticality, user identity, threat intel, geolocation. This transforms raw logs into events that trigger rules more accurately and reduce triage ambiguity. 3. Retention That Reflects Risk Abandon “store everything” habits. Align retention with risk: real-time detection data stays hot; compliance data can go cold. 4. Use Case-Driven Collection Let strategy guide ingestion. Data should map to real correlation rules, MITRE ATT&CK coverage, or compliance needs. If it doesn’t, reconsider ingesting it. Log optimization isn’t just about saving money, it enables: ▪ Faster decision-making ▪ Reduced alert fatigue ▪ Stronger detection fidelity When telemetry pipelines are treated with the same rigor as detection logic or incident response, the SOC becomes sharper and more effective. Final thought…. Data isn't your greatest asset - useful data is. 👉Ask Yourself Are you collecting data to feel secure - or to be secure? #CyberSecurity #SOC #SecOps #ThreatDetection #Telemetry #DataStrategy #DataQuality #OptimizeLogs #LogReduction #SecurityEfficiency #SIEMOptimization #AlertFatigue #TelemetryPipeline

33

4 Comments