@shortridge@hachyderm.io
@shortridge@hachyderm.io avatar

shortridge

@shortridge@hachyderm.io

Senior Director @Fastly | author of Security Chaos Engineering: Sustaining Resilience in Software & Systems (O'Reilly)

resilience + complex systems | bringing software security out of the dark ages

&void; | daedric prince of chaos | previously @swagitda_

“In the information society, nobody thinks. We expected to banish paper, but we actually banished thought."

This profile is from a federated server and may be incomplete. Browse more on the original instance.

shortridge, to random
@shortridge@hachyderm.io avatar

This Barbie wrote a book on resilience.

I saw last night (won't spoil anything, promise) and, like most, dressed full for the occasion.

A core theme is that Barbie can be anything and honestly that vibes super well with the philosophy underlying resilience: we need to adapt as the conditions around us evolve and we should stay forever curious.

But also, the movie is peak absurd and fun af, so even without the nerdy analysis it's worth the watch.

shortridge,
@shortridge@hachyderm.io avatar

@hazelweakly just wait until Black Hat 👀

bcantrill, to random
@bcantrill@mastodon.social avatar

"Moby Dick" is, as it turns out, a really good book.

shortridge,
@shortridge@hachyderm.io avatar

@bcantrill continually one of my favs, whale facts 4 lyfe

shortridge, to random
@shortridge@hachyderm.io avatar

sometimes my brain generates truly cursed ideas; usually I keep them to myself but today I will share one with you all:

cap and trade, but for vulnerabilities to solve supply chain security

shortridge, to random
@shortridge@hachyderm.io avatar

When PagerDuty tells me that junior devs have been ignoring low urgency alerts for weeks

Jennifer Lawrence Laughing GIF by Sony Pictures

shortridge, to random
@shortridge@hachyderm.io avatar

some days I write pretty thoughts and other days I message friends like @bea things such as:

> like “can do we have detect for all the attackery things”

please feel free to use this turn of phrase to describe your security controls from now on

shortridge, to random
@shortridge@hachyderm.io avatar

Mastodon cyber nerds, I am need of your aid: can anyone endorse me on Arxiv for cs.CR?

I want to post a preprint paper that appeared in IEEE SecDev so the community can enjoy but I am too plebeian for arxiv’s moderation system, it seems.

If you’ve submitted >=3 papers to cs.* within the past five years that probably makes you an endorser.

shortridge, to random
@shortridge@hachyderm.io avatar

Mark your calendars, I’ll be speaking at on Wednesday, August 9 at 11:20 local in Oceanside A https://www.blackhat.com/us-23/briefings/schedule/index.html#fast-ever-evolving-defenders-the-resilience-revolution-32751

Cannot wait for you all to experience this talk and the resilience revolution. The progress-haters may walk out in a huff like last time, too (true story) 👀

P.S. find me roaming the con and I’ll give you Chaos Kitty stickers and sign my book if you bring/buy a copy. I’ll be dressed as Thought Leader Barbie so you can’t miss me.

shortridge,
@shortridge@hachyderm.io avatar

PPS I heard a rumor that if you attend my talk you can get a ticket for a free copy of my new book that I’ll sign at the Fastly booth

Honestly the talk is going to be iconic, you don’t want to miss it. It’s time for cybersecurity to have its eternal hot girl summer and I’m here to give the makeover.

https://www.blackhat.com/us-23/briefings/schedule/index.html#fast-ever-evolving-defenders-the-resilience-revolution-32751

shortridge, to random
@shortridge@hachyderm.io avatar

there’s an essay about crypto in this month’s New York Review of Books and the writer woke up and chose violence against crypto bros

“Even Charles Ponzi’s postage reply stamps really could be used for postal services, and he was a single, central, responsible entity.”

it’s ferocious, it’s informed, it’s everything I ever wanted in a crypto takedown. bless you, Trevor Jackson

Read here: https://www.nybooks.com/articles/2023/06/08/the-price-of-crypto-the-cryptopians-laura-shin/

shortridge,
@shortridge@hachyderm.io avatar

“Even if it could be rescued from this pullulating hive of scams, hacks, and mendacity, and even if the nakedly reactionary politics could be set aside, the prospect of holding medical records on a transparent public ledger is not a good idea.”

“The trouble with trustlessness… is that crypto promoters actually trusted a lot of people, very much including people they shouldn’t have.”

Trevor did not come to play. A thorough dismantling of the crypto ecosystem and ethos: https://www.nybooks.com/articles/2023/06/08/the-price-of-crypto-the-cryptopians-laura-shin/

shortridge, to random
@shortridge@hachyderm.io avatar

I received an early copy of this year’s Verizon Data Breach Investigations Report () because I'm such a thot leader so I wrote a post with my thots and hot takes about it: https://kellyshortridge.com/blog/posts/kellys-kommentary-on-verizon-dbir-2023/

read it to sound smart to your colleagues or if you actually enjoy empirical data rather than performing the crude rituals of traditional infosec where risks are divined from the musty ether...

thread incoming with tl;dr snippets for mortals with no attention span:

shortridge,
@shortridge@hachyderm.io avatar

Yet again, the data shows 94.6% of breaches are financially driven.

It's reminder for us to invest in security that addresses reals rather than feels; and a reminder that the best way to hurt attackers, whether at local or macro scales, is to poison their ROI.

For the software engineers among you, remember this when your chicken little security team squawks about APT nation state quantum threats or whatever and throw the evidence in their face.

full post: https://kellyshortridge.com/blog/posts/kellys-kommentary-on-verizon-dbir-2023/

1/N

shortridge,
@shortridge@hachyderm.io avatar

Pretexting doubled this past year per the ! Attackers are using employees' email access to insert themselves into existing threads to ask a target victim to perform some sort of task.

I find this funny because I spend a lot of effort avoiding being included in email threads, so honestly I respect the hustle and grind here a bit.

Also worth noting the median payoff of pretexting is 5X that of ransomware...

full post: https://kellyshortridge.com/blog/posts/kellys-kommentary-on-verizon-dbir-2023/

2/N

shortridge,
@shortridge@hachyderm.io avatar

Ransomware's proportion of breaches stayed flat (~24%) in this year's and 93% of ransomware incidents had no loss.

Otherwise, the lower bound was just $1.00; you can't even get a slice of pizza in NYC for that anymore!

The median loss was $26,000, which I calculate to cover the annual EDR bill for a meager ~350 endpoints... 👀

full post: https://kellyshortridge.com/blog/posts/kellys-kommentary-on-verizon-dbir-2023/

3/N

shortridge,
@shortridge@hachyderm.io avatar

Log4Shell wasn't quite the bombshell we anticipated -- only ~0.4% of incidents in the data -- but I think we should also be proud of our efforts to make it a non-event.

Also worth noting is 73% of Log4J cases were for espionage purposes; I muse on why that might be in the blog post...

And I also rant about SBOMs in the Log4J section: https://kellyshortridge.com/blog/posts/kellys-kommentary-on-verizon-dbir-2023/

4/N

shortridge,
@shortridge@hachyderm.io avatar

According to the 41% of breaches involve mail servers (not just sending and receiving email).

Okay, but why the fuck is anyone still rolling their own mail server??? It isn't even convenient! Some real bottom energy there. Entirely unserious behavior.

5/N

shortridge,
@shortridge@hachyderm.io avatar

Desktop sharing isn’t caring... Desktop sharing software was right behind email as the top "action vector" for ransomware in the .

I call out Microsoft specifically in my blog post, although I don't have much hope in things changing since they make money off these features to give customers' leadership the ability to spy on employees...

full post: https://kellyshortridge.com/blog/posts/kellys-kommentary-on-verizon-dbir-2023/

6/N

shortridge, to random
@shortridge@hachyderm.io avatar

I wrote this blog post because I’m so fed up with ppl being like “but where’s my regex” 🥺🥺🥺

It’s nowhere because we are living in 2023 and we have hot girl shit to do instead of flinging our lives away on regex-based detection rules.

Read, weep, rejoice, whatever other verb suits your vibe after reading this:
https://www.fastly.com/blog/regex-in-retrograde

codinghorror, to random

First of all, how dare you sir. https://www.fastly.com/blog/regex-in-retrograde

shortridge,
@shortridge@hachyderm.io avatar

@codinghorror sorry not sorry 👀👀👀

shortridge, to random
@shortridge@hachyderm.io avatar

The FSB’s Snake malware is noted for its sophistication in part due to its architecture that “allows for easy incorporation of new or replacement components.”

Yet that characteristic is often what cybersecurity traditionalists try to impede in their own org’s software…

People marvel at how I wrote the new book in ~9 months and the reason is basically the above — more productive than screaming into the void and maybe changes things.

Source (pdf report): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a

danderson, to random
@danderson@hachyderm.io avatar

Framework is so cool.

"To fix power efficiency, we're shipping a new rev of our DisplayPort module..."

(me: aww, I'll have to buy a new module)

"... but if you have an older module already, click here for instructions on how to update its firmware!"

"Sadly the HDMI module did need some electrical changes in addition to firmware..."

(me: aww, oh well)

"... but if you're handy with an iron, here's the rework instructions to upgrade your v1 module!"

🤯 Amazing amount of giving a shit.

shortridge,
@shortridge@hachyderm.io avatar

@danderson @hazelweakly fun fact: I was in a total panic before my SREcon talk because

  1. my new framework laptop kept crashing randomly

  2. I needed to swap the display port module for the HDMI one and couldn’t get it out

the lovely A/V staff solved #2, which in turn solved #1… so this update is thrilling to see.

I’m otherwise super happy with the machine, too.

shortridge, to infosec
@shortridge@hachyderm.io avatar

cybersecurity loves Sun Tzu quotes so I’m reverse uno carding with this post on why he would actually be disappointed in the industry: https://kellyshortridge.com/blog/posts/sun-tzu-wouldnt-like-the-cybersecurity-industry/

I am NOT saying we should bring Sun Tzu quotes back! I AM suggesting we “where is your god now” as much harmful folk wisdom as we can — fighting fire with fire, if fire was appeal to authority

anyway enjoy the spice xx

shortridge, to random
@shortridge@hachyderm.io avatar

The video of my talk is live: https://youtu.be/DGdtfB1eY98

It's all about how SREs can align their mental models of a system with reality to sustain software -- because SREs are a critical mechanism of adaptation in our systems.

If you're an you're probably not like, waking up thinking, "How will I be the mechanism of adaptation today?" so I wanted to provide some scaffolding around the concept in the talk.

This will be a 🧵of five key takeaways:

shortridge,
@shortridge@hachyderm.io avatar

Takeaway #5 from my talk on and learning from failure https://youtu.be/DGdtfB1eY98

💾 The open source tool Deciduous (https://deciduous.app) is a practical means to start implementing decision trees in your organization and day-to-day work immediately.

shortridge,
@shortridge@hachyderm.io avatar

I loved the opportunity to share my wisdom with such a thoughtful, engaged audience (and to meet likeminded nerds like @hazelweakly!)

I sincerely believe and engineering teams are critical for sustaining software (and ).

PS if you vibe with my talk and this thread, read my new book: https://securitychaoseng.com

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • tacticalgear
  • magazineikmin
  • thenastyranch
  • Youngstown
  • mdbf
  • rosin
  • slotface
  • InstantRegret
  • khanakhh
  • Durango
  • kavyap
  • osvaldo12
  • DreamBathrooms
  • JUstTest
  • GTA5RPClips
  • ngwrru68w68
  • everett
  • tester
  • ethstaker
  • cisconetworking
  • cubers
  • modclub
  • provamag3
  • anitta
  • normalnudes
  • Leos
  • lostlight
  • All magazines
    •