_tk_

I work in a team of 100+ cyber professionals, and consume the typical infosec content that’s out there. None of the authors that I know, or any of my peers argue in this presumed way. Additionally, as…

If there’s a business need, you can secure a wooden box on the sidewalk in a way, that it is almost impossible to break in. It will be very costly, but if profit or IP depends on it, one can find a wa…

There are other stakeholders involved in a transaction like this, most importantly banks. Payments, especially large ones, are heavily regulated. You cannot hack a finance department and issue a mone…

Could you elaborate on where you see the hardening taking place? Colonial had a threat actor in their network and by paying the ransom, they supposedly left without doing any more damage. I don’t thin…

Disclaimer: I work as a CISO in a large corporation. The interesting bit in this article is not necessarily the sum of the ransom, but that Colonial decided to pay quasi-immediately. It seems as if t…

I can’t speak for Thomas- but generally you’d want to invest your money in a vuln that is rather static. Web applications with attack surfaces that are constantly changing are not a good fit for a sop…

I feel the same way about this issue (the chat and the photo) and the response by Troy just feels... abysmal. He starts out by saying: "The photo, however, is the one most consistent with others …

Can someone elaborate what the satirical part of this article is? I’m not sure I understand. Or in other words: I agree with this version very much.

Correct. This is an argument made from a corporate network perspective.

To maybe give some perspective _why_ security people say that security by obscurity is bad - and especially serving ssh via port 64323: Typically you want to know who is connecting to what server via …

With the numbers shown "the entire internet" is really more than exaggerated and thus the title seems pretty clickbait-y.