Cat Easdon

Tomorrow is the #NISDUC conference on NIS2, and we would like to share how the Vulnerability-Lookup software can support NIS2 requirements and best practices. https://lnkd.in/e4kGBySt Vulnerability-Lookup is an open-source platform developed to help organizations identify, track, and manage software vulnerabilities. It aggregates data from multiple trusted sources, allows collaborative input, and supports processes aligned with vulnerability disclosure standards. The NIS2 Directive (Directive (EU) 2022/2555) establishes a high common level of cybersecurity across the EU. This document outlines how Vulnerability-Lookup helps stakeholders meet the directive’s key requirements, especially Articles 11, 12, 21, and 29. The following paragraphs analyse these articles and contextualise Vulnerability-Lookup’s feature support capabilities. #nis2 #cybersecurity #vulnerabilitymanagement #vulnerability CIRCL (Computer Incident Response Center Luxembourg)

111

Many European organizations rely on U.S. communication platforms like Microsoft Teams, SharePoint, or WhatsApp — assuming they're secure because of certifications or encryption claims. But technical measures aren’t the whole story. In my guest article for DIGITAL BUSINESS Magazin, I outline three structural problems that are often overlooked: 1️⃣ Lack of transparency: Proprietary platforms can’t be independently verified. Without open source, no one outside the provider knows how security is actually implemented. 2️⃣ Limited encryption: Even if data is encrypted in transit, many services don’t encrypt data at rest — or hold the keys themselves, leaving a critical gap. 3️⃣ Legal access risks: Under laws like the U.S. CLOUD Act, American providers can be compelled to hand over data, even from servers in Europe — and they are legally prohibited from disclosing this. Tools like Wire or Pydio take a different approach: open source, end-to-end encryption, and independence from U.S. jurisdiction. For public institutions and companies handling sensitive data, these structural differences matter. Read the full article about “How insecure are Microsoft Teams & Co.?” here https://lnkd.in/eFPjPsTs

39

1 Kommentar

In DeepSeek's whitepaper they claim the cost of a training run is $6m. This figure is calculated based on how many hours a single training run takes, how many GPUs are required, and how much those GPUs cost per hour to rent. The estimate seems accurate based on similar estimates from other open source models. The people claiming it actually cost $1.3bn because the company outright purchased the GPUs are being deliberately misleading. It's like if I calculating the cost of my cross-country train trip by including the cost of building the entire train and rail network. It's pretty standard to estimate computational cost based on rented compute time. If you outright purchase hardware, you aren't just buying it and throwing it away after each use. You also likely aren't using it for a single purpose and letting it sit idle the rest of the time. That's why companies use the cost to rent compute instead. The people writing these posts/articles 100% know the difference between capital expenditure and operational expenditure, they're just hoping you don't. By conflating the two and adding them together, they can attempt to convince you that DeepSeek didn't just make a hugely impactful leap when it comes to LLM training costs, which it absolutely did.

179

18 Kommentare

I’ve released a new version of promptmap. Now, it doesn’t just check for prompt injection attacks, it also detects issues like hate speech, harmful content generation, distractions, and more. It’s very easy to use and should be your go-to tool when deploying any LLM-based application. Just provide your system prompts and the model you want to use. It will automatically run attacks and show you which ones were successful. https://lnkd.in/e-pDDE7s

160

1 Kommentar

Introducing SOC/ISO Lite, because Startups need Security, not Compliance Theatre 🎭 The reality nobody wants to discuss about security for startups: - Your SOC is a Slack channel with CloudWatch alerts - Your security team is whoever drew the short straw this quarter who ends up with one OKR called "secure the infra plz" - Your CISO is the CTO who read a security blog once a month and put a meeting in your calendar to push a different vendor's narrative each time - Your incident response plan is "our SRE is starting next week" - Your disaster recovery strategy is "pray it auto-scales" - Your access review is removing people after they announce their new job on LinkedIn - Your security architecture diagram was last updated when you hosted the production environment on Vercel - Your endpoint security strategy is "everyone uses Macs, right? Amazing, let's use FileVault then" - Your vulnerability management program is dependabot notifications - Your asset inventory is "check the AWS bill, I think it's all in there" - Your "security awareness training" is sharing HackerNews articles in Slack Let's be honest - early-stage startups (1-100 employees) have different security needs than enterprises: - You're building and shipping fast - Your infrastructure changes daily - Everyone's wearing multiple hats - You can't afford a dedicated security team - You need security that scales with you This is why we need SOC/ISO Lite: Because effective security beats effective documentation. Instead of rushing your SOC 2 or ISO 27001 to close deals while building security debt, why not focus on good foundations on the areas that matter. Use those scarce resources to protect your crown jewels. A standard that would accompany that would be an amazing incentive for the industry. What it could the Lite version look like: 1. Core Technical Controls: - SSO + MFA that people actually use - As much security built into your CI/CD as possible (limit gates at first) - Infrastructure as code with security baselines - Automated access management tied to HR - Basic monitoring that alerts the right people - Backups that are actually tested 2. Vendor-Managed Security: - Use your current tool stack to do the heavy lifting - Focus on configuration, not implementation - Use built-in compliance reporting - Leverage vendor security features 3. Documentation That Matters: - Focus on "how we fix things" not "how we look compliant" - Keep it in version control where engineers live - Automate evidence collection through APIs - Write docs that help, not impress. Write things you actually do - Update when things change, not when auditors ask The shared responsibility model we need: - Vendors: Handle the complex security stuff - Your team: Configure, monitor and govern - Auditors: Accept API evidence please - Everyone: Core focus on security that matters If your startup spends time documenting stuff you don't do, you might need SOC 2 Lite 🎯 #GRCEngineering

160

67 Kommentare

Are #cybersecurity incidents growing more costly? Cyentia Institute's recent Information Risk Insights Study points to a 15-fold increase in the cost of #incidents and #databreaches over the last 15 years. The chart on the left shows the distribution of known/reported financial losses from incidents across the time period of study. The typical (median) incident costs about $600K, while more extreme (95th percentile) losses swell to $32M. Note that the chart uses a log scale, so the tail of large losses is a lot longer than it appears. The chart on the right trends the escalating costs of cyber events over time. Median losses from a security incident have absolutely exploded over the last 15 years, rising 15-fold from $190K to almost $3 million! The cost of extreme events has also risen substantially (~5x). So, yeah—cyber events are definitely growing more costly. That said, this picture looks a lot different among different types and sizes of organizations. How are cyber losses trending for orgs like yours? Download the full IRIS 2025 to find out! Link in the comments.

102

15 Kommentare

You’re spending $100K on ISO 42001. NIST and CSA cover more, cost nothing, and you can start today. National Institute of Standards and Technology (NIST) published a risk management framework for AI governance. Cloud Security Alliance published security controls that actually stop attacks. Both are publicly available. Both implementable now. Together they might be better than ISO 42001. NIST AI RMF covers governance. Risk identification, accountability, lifecycle management. Integrates with existing NIST frameworks you’re probably already using. No separate management system or audit cycle. CSA AICM covers security. Two hundred controls across eighteen domains. Prompt injection defences. Model security. Data poisoning prevention. Agent boundaries for agentic AI. The technical controls ISO 42001 mentions but never defines. ISO 42001 tells you to “implement appropriate security measures.” CSA tells you which measures and how. ISO 42001 tells you to “govern AI systems.” NIST tells you how to actually do it. The combination gives you governance and security. ISO 42001 gives you governance and a certificate. ISO 42001 was built to be certifiable. NIST and CSA were built to be implementable. Different purposes. You can implement NIST and CSA in weeks. ISO 42001 requires months of documentation first. Question is whether you need governance now or certification eventually. Most companies choose certification because boards and customers recognise ISO standards. Fair. But don’t confuse the certificate with actual protection. You’re paying for credibility, not capability. NIST AI RMF has been tested across US federal agencies. CSA AICM is based on their Cloud Controls Matrix. Both address current threats including agentic AI. ISO 42001 is newer, lighter on technical controls, doesn’t cover agents. Worth asking: do you need the certificate or the controls? If both, implement NIST and CSA first. Add ISO 42001 later if you need the badge. Or build with NIST and CSA and skip the certification theatre. Are you implementing governance or pursuing certification? They’re not the same thing. #AISecurity #AIGovernance #NIST #ISO42001 #CISO #RiskManagement #SecurityFrameworks

273

35 Kommentare

If you look at the MITRE ATT&CK matrix overlaid on attack data (circle size = % of attacks in category), you instantly see the problem areas. Remote services, predominantly RDP and SSH, are _the_ way attackers move laterally towards their real target, over 80% according to 4 different data sources. There are three major implications: 🚨Lateral movement is undefended: the data says clearly that we're not defending this highway for attackers with existing solutions. That's unsurprising: PAM/EDR/MFA etc. all fall short once an attacker has remote access to a device because they all actually _trust_ the compromised device (!). 🚨Lateral movement is underinvested. In an attack chain, it is closest step to the critical data; if you want to protect jewelry, sure you can lock the doors of the building, but wouldn't you also put it in a safe? 💡Lateral movement is a chokepoint: there aren't many strategies available to attackers to stealthily pivot from less-important into critical systems. This is a massive opportunity for defenders! In the spirit of true #defenseindepth and #zerotrust, we must invest more resources into blocking EXPAND than just preventing the initial LAND -- and the data supports it. #cybersecurity

58

10 Kommentare

I'm a few days late, but last week's haul for VulnCheck Initial Access Intelligence customers included new #exploits, detections, PCAPs, and more for Tenda AC15 AC1900 devices, Flowise, and LG Simple Editor. The team also shipped a scanner for F5 BIG-IP management interfaces (plus ASM queries) and signatures for Redis CVE-2025-46818 (privesc) and CVE-2025-49844 (use-after-free). Notably, despite the news cycle, none of the public PoC for Redis manages to successfully trigger a crash, let alone get code execution. VulnCheck's research team assesses that the UAF is unlikely to be exploitable at scale, which isn't super surprising. More details and #threat context in the team's release notes! https://lnkd.in/ezJb-FXq

29