shortridge

shortridge, 1 day ago to Cybersecurity

my new post covers how to get started with chaos experiments without having to larp as sysadmin, disrupt your users, or piss off your execs ✨ https://www.fastly.com/blog/chaotic-good-resilience-stress-tests-at-the-edge

it includes a js code example that verifies super basic #cybersecurity assumptions about your org’s website, like:

🍪 my site requires cookies or auth headers
⚔️ my site does not allow cross-origin requests

so, it’s a great starter experiment to get familiar with the practice — and it clones requests to avoid fucking with prod ✨

shortridge, 5 days ago to random

a confession: I’ve battled mourning doves for months, ever since I bought a bird feeder for my garden and they kept draining it in less than a day.

they are allegedly stupid creatures, but that’s just what they want us to think.

I am plausibly an expert in cyber defense, having written a book and academic papers, lectured at federal agencies and F500s alike — yet the doves thwart my every mitigation.

I planned to write a blog post once I won, but my hope for victory further desiccates daily…

shortridge, 5 days ago to random

tired: too many browser tabs

wired: the system is struggling to absorb and regenerate from anthropogenic stresses

shortridge, 16 days ago to security

went down to the hotel lobby to retrieve my dinner delivery in a yoga outfit + snuggly cardigan + face mask.

some men with #RSAC2024 lanyards exited the elevator as I re-entered; they turned back to look at me and one said (very loudly, very pointedly staring at me) to the other, “I was like, did you hire me a hooker?”

if you are a man attending #rsac, please shut that kind of shit down when your peers do it. let’s not let insecurity rule our #security industry.

shortridge, 21 days ago to Cybersecurity

The 2024 Verizon Data Breach Investigations Report (#DBIR) is out this morning, and I make sense of it in my new post: https://kellyshortridge.com/blog/posts/shortridge-makes-sense-of-verizon-dbir-2024/

I focused on what felt like the most notable points, from #ransomware to MOVEit to web app pwnage to #GenAI and more.

I have insights, quibbles, and hot takes as always — but the fact remains it’s our best source of empirical data on cyberattack impacts. If you’re a #cybersecurity vendor, please consider contributing data to it.

shortridge, 22 days ago to Bulgaria

To my #EU friends, followers, and future allies: I’m keynoting #CraftConf in exactly one month (May 30).

I will bring #cybersecurity heresy — and custom #ChaosKitty stickers — with me to Budapest.

You still have spacetime to buy tickets and bask in software craftship: https://craft-conf.com/2024/talk/disputation-on-the-power-and-efficacy-of-cybersecurity

Let me know if you’ll be attending, speaking, or otherwise proximate xx

shortridge, 1 month ago to random

my Pilates instructor told me to “check on my gays,” so how are y’all today?

shortridge, 1 month ago to random

earthquake in nyc was not in my threat model… but I guess that’s the point of fault injection

(☞ ͡° ͜ʖ ͡°)☞

shortridge, 2 months ago to random

them: where do you want your career to go in the next 5 to 10 years?

me: to become widely known as “The Entity”

shortridge, 2 months ago to random

“…just as Error, by contrast, renders more dazzling the triumph of Truth…”

~ Proust on chaos experimentation circa 1337 BCE

shortridge, 2 months ago to Cybersecurity

tired: My job is to write kernel exploits to collect remote access across target systems

inspired: I am a corn farmer

#cybersecurity

shortridge, 2 months ago to random

OH: “None of these galactic fuckheads seem to realize YAML’s a goddamn data exchange format, not the fuckin’ language of the spheres, forged by the seraphim at the dawn of time, held securely in its place of honor in this one directory that’s checked into git”

👀 hello #yaml stans

shortridge, 2 months ago to random

a sales rep from a vendor reached out to my work email asking if I’ve thought about using chaos engineering

how should I respond?

I’m tempted to reply, “never heard of it”

shortridge, 2 months ago to random

some days it feels like if I read one more sentence putrefied by passive voice, my brain will implode.

they do not warn liberal arts majors of this hazard before entering the tech industry.

shortridge, 3 months ago to random

me: I haven’t ever hiked in Slovakia. You can say I… haven’t been keeping up with the Carpathians.

them: 😕🫣😑

shortridge, 3 months ago to security

in the spirit of transparency, here’s our response to CISA’s RFI on Secure by Design: https://kellyshortridge.com/papers/CISA-2023-0027-Shortridge-Sensemaking.pdf

SbD should not incentivize lip service or #security theater. It should not be at odds with business goals.

So, @rpetrich and I wrote what SbD should be and not be.

We hope mastonerds especially appreciate our recommendations in Section 1.2.1 for how #software teams can start investing in SbD while supporting velocity, dev productivity, & reliability.

blog: https://kellyshortridge.com/blog/posts/rfi-secure-by-design-response/

shortridge, 3 months ago to random

hello fediverse, it’s the weekend in most places and I know you’re doing some nerd shit (which isn’t limited to computers!)

please share your nerdy hobby projects with me so we can all share in some wholesome dopamine harvesting ✨

things that count in my mind: computers, gardening, knitting, metalworking, flower arranging, glassblowing, felt needling, organizing, woodworking, scrapbooking, elaborate cat castle building, house DIY projects, basically anything with niche interest + skillset

shortridge, 3 months ago to random

I wish there were more crystal girlies in tech.

They wouldn’t blame an incident on “human error,” they’d be scouring traces for unwanted energy, probing liminal spaces for malevolent spirits, writing new spells-as-code for automated cleansing.

Key contributing factors would be trickster fae, confusing incantations, unsafe reagents.

When Neptune is ascendant, they’ll update the test suite and save your ass. Saturn in transit? She’ll verify the observability pipeline by moonlight just in case.

shortridge, 3 months ago to Cybersecurity

this Galentine’s / Palentine’s/ Valentine’s Day, do you want to learn the secret to everlasting love?

my secret is writing a book ✨ because a book or creative project will never let you down or cheat on you or leave you or get tired of you rambling about your special interests for hours and hours, in fact that is the whole point and if you create for yourself, you can be beautiful weirdos together, forever 💞

https://www.securitychaoseng.com/

#cybersecurity #resilience #writing

A video of me frolicking around NYC in Valentine's regalia with my beloved book. My first outfit is a hot pink skort suit that is kind of like if Barbie misunderstood what a business dress code meant, especially given I paired it with impossibly towering crystal emblazoned platform heels. My second outfit is a fluffy lilac turtleneck, as cozy and warm as it sounds, and my pants are a ludicrously bright shade of pink. There are many scenes, such as tossing the book in a park and hugging it with playful glee. Spinning with the book up in the air rom-com style on a cobblestone street. Caressing the book in front of a store festooned with floral garlands. Shopping with my book trying on something that can only be described as a minidress sequined with mermaid lore. Rambling to my book in a garden; it “nods” in agreement. More spinny on the street. A hot girl walk with ranunculi and the book. Doing yoga in my apartment wearing a Geek Squad shirt and NASA pajama pants, starting in star pose then descend into skandasana while keeping the book on my head, much to my own surprise. Even more spinny! Reposing in front of my fireplace in a silky black robe nuzzling my book as the flames flicker on my pale skin and its glossy cover. Finally stop spinny but now dizzy. For the final shot, I'm in Barbie's First Board Meeting outfit again in a romantic neighborhood bar reading my book fondly before giving it a final kiss and showing it off for the camera. You're welcome, femmes and thems.

shortridge, 3 months ago to security

dear plausibly sentient citizens of the milky way,

I published a cliff notes / cheat sheet / tl;dr guide for you on what the hot topixxx of software #resilience and #security chaos engineering (SCE) mean: https://kellyshortridge.com/blog/posts/security-chaos-engineering-sustaining-software-systems-resilience-cliff-notes/

it’s basically the chapter summaries of my paywalled book repurposed as a public, bite-sized guide for you to devour, absorb, then change-make (or sound smart online, in meetings, at parties, to your cat, etc)

let’s keep trying to modernize #infosec together xx

shortridge, 3 months ago to random

I just received a notification that an order of $item is out for delivery…

…an order I placed November 17…

…in 2022…

🤨

shortridge, 3 months ago to random

not me trying to connect to the Airbnb wifi over and over until realizing they decided to end the “sentence” containing the password with a period. right next to it. like “password.” but the password is just “password” and if you hear about some new sorcerer recluse in the woods near you soon you know who it is

shortridge, 3 months ago to random

in case there are other nerds out there who haven’t yet read this classic, behold “the case of the 500-mile email” https://www.ibiblio.org/harris/500milemail.html

I adore the “absurd computer-borne mysteries” genre and kindly ask for more content from the annals of y’all’s careers

shortridge, 3 months ago to Cybersecurity

tbh I’m getting frustrated hearing “everyone does this” from #cybersecurity engineers at high-growth tech companies when I talk about modern security / #resilience stuff.

but then the “mature corp” majority often haven’t even heard of some of the basic concepts/practices, let alone are trying to adopt them…

it’s why I often leverage the “two Americas” analogy to describe the state of cybersecurity today. These things really aren’t “obvious” to many and pretending they are widens the gap.

shortridge, 3 months ago to gaming

Monday morning read: The untold history of Barbie Fashion Designer, the first mass-market ‘game for girls’ https://www.polygon.com/23776996/barbie-fashion-designer-retro-game-untold-story-history

lots of 90s game dev lore gems in it; feels incredible they pulled it off tbh

and, was it lowkey the first mainstream 3D printing game, too??

#gaming #gamedev