Jul 6, 2021[TRANSCRIPT] IT Visionaries Podcast with Malcolm HarknessAlbert: You don’t get paid for shipping security and that’s a problem. In our thirst for developing the newest technologies, our business practices have enabled and opened huge gaps in our product in data security. If it seems like these cyber attacks are increasing, it’s because they are, and it’s…Bugcrowd36 min readBugcrowd36 min read
Jun 27, 2021The Bar Fight Risk TaxonomyAfter hearing “vulnerability” and “threat” used interchangeably for a >9,000th time I decided to do something about it, and the Bar Fight Risk Taxonomy was born. I use metaphors to explain cybersecurity and risk concepts A LOT, mostly because risk is such an ambiguous and abstract concept, to begin with…3 min read3 min read
May 23, 2021My “office” setup — Part 2Yeah, so listen We’re going to need a blog post detailing the gear and how you arrived at it — ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ (@DanielMiessler) May 22, 2021 [https://twitter.com/DanielMiessler/status/1396031403242844162?ref_src=twsrc%5Etfw] Ok @DanielMeissler, you got it :P Ikea Kivik Chaise [https://www.ikea.com/au/en/p/kivik-chaise-longue-orrsta-light-grey-s59011389] and foot-stool [https://www.ikea.com/au/en/p/kivik-footstool-with-storage-orrsta-light-grey-s59011394/] . If you’ve not met me in real life, you…Thoughtops4 min readThoughtops4 min read
May 8, 2021On Project Zero’s 90+30 vulnerability disclosure policy changesI was asked a few questions by Lindsay O’Donnell of the awesome Decipher Bureau regarding Google Project Zero’s changes to their default disclosure policy. …Vulnerability5 min readVulnerability5 min read
Mar 28, 2021My “office” setuptl;dr: If you want the tech list, jump straight to the middle. The front is about how choices were made and what I was optimizing for, and the back is a few things I’ve done to make a new space feel like home. Backstory It has just gone a year since…Work From Home8 min readWork From Home8 min read
Mar 8, 2021NIST: Vulnerability Disclosure as a Requirement for Every OrganizationThe NIST Cybersecurity Framework is a set of policies meant to help the private sector in strengthening their cybersecurity readiness and awareness. The framework is published by the National Institute of Standards and Technology (NIST), under the US Department of Commerce. Originally designed for critical infrastructure IT, it has since…Cybersecurity3 min readCybersecurity3 min read
Oct 7, 2020NIST SP 800–53 R5 adds Vulnerability Disclosure Programs to Federal Security and Privacy Controls | @BugcrowdWhat are the changes? Released on September 23, 2020 , Revision 5 contains a number of improvements, broadens its applicability to better include both security and privacy concepts, and for the first time, introduces vulnerability disclosure programs (VDPs) as a recommended control under the vulnerability management and scanning section: “RA-5…Vulnerability Disclosure3 min readVulnerability Disclosure3 min read
Sep 30, 2020Information Asymmetry and the 1950s Nuclear BountyThe idea of a bounty (or, more specifically, payment-for-success incentives designed to reduce information asymmetry) predate cybersecurity’s modern interpretation of the term by hundreds of years. I’m a huge nerd for the history of information bounties as a model, and this post started off as simply sharing a fascinating chapter…Bug Bounty4 min readBug Bounty4 min read
Published indisclose.io·Sep 24, 2020Response to Voatz’s Supreme Court Amicus BriefSeptember 14, 2020 On September 3, 2020, Voatz — a blockchain voting company with a publicly documented track record of hostility towards security research[1] — filed an amicus brief with the U.S. Supreme Court in Van Buren v. United States arguing in favor of a broad interpretation of the Computer…Vulnerability Disclosure11 min readVulnerability Disclosure11 min read
Sep 3, 2020Online-voting company pushes to make it harder for researchers to find security flawsThis story is part of Elections 2020, CNET’s coverage of the run-up to voting in November. Cybersecurity experts and lawmakers have little faith in online voting, thanks to the high potential for hacks, as well as worries about vulnerabilities, either of which could affect an election’s outcome. …3 min read3 min read
