Resilience
- small developer orgs that don’t have time or expertise to deal with common security needs
- large developer orgs that need consistency, scale, and governance of their security capabilities
-
Point north.
-
What time is sunset today?
-
Trace the water you drink from rainfall to your tap.
-
When you flush, where do the solids go? What happens to the waste water?
-
How many feet above sea level are you?
-
What spring wildflower is consistently among the first to bloom here?
-
How far do you have to travel before you reach a different watershed? Can you draw the boundaries of yours?
-
Is the soil under your feet, more clay, sand, rock or silt?
-
Before your tribe lived here, what did the previous inhabitants eat and how did they sustain themselves?
-
Name five native edible plants in your neighborhood and the season(s) they are available.
-
From what direction do storms generally come?
-
Where does your garbage go?
-
How many people live in your watershed?
-
Who uses the paper/plastic you recycle from your neighborhood?
-
Point to where the sun sets on the equinox. How about sunrise on the summer solstice?
-
Where is the nearest earthquake fault? When did it last move?
-
Right here, how deep do you have to drill before you reach water?
-
Which (if any) geological features in your watershed are, or were, especially respected by your community, or considered sacred, now or in the past?
-
How many days is the growing season here (from frost to frost)?
-
Name five birds that live here. Which are migratory and which stay put?
-
What was the total rainfall here last year?
-
Where does the pollution in your air come from?
-
If you live near the ocean, when is high tide today?
-
What primary geological processes or events shaped the land here?
-
Name three wild species that were not found here 500 years ago. Name one exotic species that has appeared in the last 5 years.
-
What minerals are found in the ground here that are (or were) economically valuable?
-
Where does your electric power come from and how is it generated?
-
After the rain runs off your roof, where does it go?
-
Where is the nearest wilderness? When was the last time a fire burned through it?
-
How many days till the moon is full?
-
What species once found here are known to have gone extinct?
-
What other cities or landscape features on the planet share your latitude?
-
What was the dominant land cover plant here 10,000 years ago?
-
Name two places on different continents that have similar sunshine/rainfall/wind and temperature patterns to here.
🔒 The 2024 edition of CWE Top 25 is published:
Most Dangerous Software Weaknesses
“But what about the OWASP Top 10?” Think of the OWASP list as more of an engagement and learning tool.
The CWE 25 can more effectively be used as a target list to build your evaluation, mitigation, and prevention.
🔒 Big improvements to calls in Signal: call links
🔒🥃 Hey, you know how security teams are the worst and nobody wants to work with them?
Anyway, this is a signed going away present from the engineering platform and architecture leaders.
Definitely a keeper, even after it’s empty.
🔒 I’m at the CSO Conferencece and Awards.
Tomorrow, my team will be accepting a CSO50 award for our security automation platform that supports 4000 engineers and 7000 applications.
I’ve since left the company, but am here supporting my previous team. Proud of them!
🔒 Banks: practice internet safety!
Also banks: we won’t let you login if you are blocking junk in your browser or using a VPN
🔒 The opportunity: application threat modeling & secure design review is one of the highest value appsec/prodsec activities, but is hard to implement efficiently and at scale.
A bad solution: provide a long list of controls that need to be checked each time
A better solution: generate relevant security requirements automatically based on what’s being built
Met with primesec yesterday, and this is what they are trying to do! They are using LLM to read what’s in your user stories (etc.), summarizing the work for the security team, and injecting specific security control requirements.
If this catches even a small portion of the real requirements, it would be a major uplift for teams both from a security and efficiency perspective. Looking forward to checking it out.
🔒 Met with the folks from Pangea yesterday.
Looks like it could be an interesting solution for:
🔒 Just left Silicon Valley Bank.
Did not know they still existed!
I’m at AppSec San Francisco this week.
Mute that “🔒” tagmoji if you don’t want to hear about it.
Send me a message if you want to meet up.
📚 The Coddling of the American Mind
Read: The Coddling of the American Mind by Greg Lukianoff and Jonathan Haidt
Recommended
My Reading Highlights and Notes
INTRODUCTION The Search for Wisdom
🔒 OSS backdoors: the folly of the easy fix - lcamtuf’s thing
Even when it comes to lesser threats, the bottom line is that we have untold trillions of dollars riding on top of code developed by hobbyists. The companies profiting from this infrastructure can afford to thoroughly vet and monitor key dependencies on behalf of the community. To be sure, a comprehensive solution would be a difficult and costly undertaking — but it’s not any harder or costlier than large language models or self-driving cars.
🔒 Guest lectured again. Had to be remote because COVID. The professor has a habit of getting a shot when I have a funny line on the slides.
Last time I was doing code/bug examples and my slide said “what could go wrong?”
This one is talking about rules of engagement and responsible disclosure.
🔒 23andMe wants us to accept new terms that change their “Dispute Resolution and Arbitration” process. I wonder what might have spurred that change?
How many of these can you answer about the bioregion where you live?
It seems appropriate that these questions came up (during my daily highlights review) on a colonial holiday. May we re-orient ourselves to deep connection over superficial exploitation.
The Bigger Here Bonus Questions:
Indiana lawmakers could further dilute state wetlands protections following SCOTUS decision
As our weather gets worse, politicians do, too?
🕊️♻️ Good workshop on Climate Anxiety, Hope, and Resilience this morning. #MennoCon23
Once again I made the call to reorient our conferences and districts to our watersheds.
The White River Alliance is issuing an urgent action request to protect Indiana wetlands. This is important for flood & drought management, ecosystems, biodiversity, and much more.
Positive legislative update courtesy of White River Alliance, regarding HB1639.
