Activity
-
1Password's product security team has designed a model-agnostic security review pipeline to evolve alongside the latest frontier models. We built…
1Password's product security team has designed a model-agnostic security review pipeline to evolve alongside the latest frontier models. We built…
Liked by Gregory Ose
-
Something we're working on at GitHub that developer security folks might like… 😇 Secrets don’t respect boundaries and leak across all surfaces;…
Something we're working on at GitHub that developer security folks might like… 😇 Secrets don’t respect boundaries and leak across all surfaces;…
Liked by Gregory Ose
-
Recently got to spend time with my old friend Aaron Mog talking uncomfortable truths in the security industry. Check it out!
Recently got to spend time with my old friend Aaron Mog talking uncomfortable truths in the security industry. Check it out!
Liked by Gregory Ose
More activity by Gregory
-
My team is hiring platform security auditors. This is a strategic role supporting firmware and hardware security assessments, often working with…
My team is hiring platform security auditors. This is a strategic role supporting firmware and hardware security assessments, often working with…
Liked by Gregory Ose
-
When a developer accidentally commits a live API key, it triggers an immediate operational nightmare of rotating tokens and scrubbing Git…
When a developer accidentally commits a live API key, it triggers an immediate operational nightmare of rotating tokens and scrubbing Git…
Liked by Gregory Ose
-
6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close…
6 GitHub security settings every maintainer should enable this week. These won't make your project unhackable. Nothing will. What they do is close…
Liked by Gregory Ose
-
over the past year, I've watched the vulnerability reporting ecosystem change in ways that would have been difficult to imagine just a few years ago.…
over the past year, I've watched the vulnerability reporting ecosystem change in ways that would have been difficult to imagine just a few years ago.…
Liked by Gregory Ose
Other similar profiles
Explore more posts
-
Jamieson O'Reilly
This recent WhatsApp issue is a useful case study because it demonstrates what unsophisticated attacks actually look like in practice. No exploit development, no heavy reverse engineering, just persistent querying of an endpoint that never said no combined with a platform team that never noticed.
2 Comments -
Or Cohen
SIEM has been around for 20 years, yet most people don’t really understand it - even after working with SIEMs for years. A SIEM is not a product. It’s not even a product category. It’s not about tech at all. A SIEM is a reflection of how security is managed and viewed within a company. "Market-leading" SIEMs can fail miserably. So-called "legacy" or "bad" SIEMs can quietly deliver significant, tangible outcomes. A SIEM is a blueprint - on paper, an architectural masterpiece soaring (pun intended) into the sky. It can be just that. More often, the architect’s dream is simply the contractor’s nightmare. Let’s not even mention the maintenance crews who have to deal with it once it’s built. It’s common to spend millions and still have zero meaningful coverage. To centralize all the data only to find it contains nothing of value. To query all day and come back empty-handed. A SIEM is a mirror. Of priorities, decisions, execution capabilities, attention to detail, objective setting, resource allocation, and how well the business, its processes, and its risks are understood. Show me your SIEM, and I’ll tell you who you are. So, what’s being shown in your mirror? #SIEM #SOC #SecurityOperations #cyber
2 Comments -
Stephen Venter
Unpopular opinion: Most MSPs are one major incident away from a serious liability claim. Why? Because "fixing the server" is not the same as "Incident Response." Without forensics-grade processes and a safety net of experts, MSPs are often taking on 100% of the risk for 10% of the reward. It’s time to talk about a model where the MSP keeps the lead, but a platform provides the floor. The Big Questions: • 𝗙𝗼𝗿 𝘁𝗵𝗲 𝗠𝗦𝗣𝘀: If you had a "shadow" expert on-call and a pre-built legal evidence kit, would you lead more IR engagements? • 𝗙𝗼𝗿 𝘁𝗵𝗲 𝗖𝗹𝗶𝗲𝗻𝘁𝘀: When you vet an MSP, do you ask to see their recovery plan, or do you just check if they have a backup solution? What would make you trust their IR capability more? #CyberSecurityStrategy #MSP #BusinessRisk #IncidentResponseAsAService
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content