Compliance using NIST controls #MTC
U.S.A.
Joined July 2009
- Tweets34K
- Following3.5K
- Followers1.9K
- Likes50.7K
Pinned Tweet
I’m on @buymeacoffee. If you like my work, you can buy me a coffee and share your thoughts 🎉☕ buymeacoffee.com/DipPd86sJc
mininatechsec retweeted
I think Cybersecurity+AI knowledge is going to be the deadliest combination in the coming years
Before I can renew my self-certification as a professional hacker, I must complete the following:
Tell a story on X Live, made up, on the spot, regarding information security, data privacy, and/or compliance, like @comedysportz , but for #infosec.
It has to sound so good, it keeps everyone listening in a public space on the edge of their seat, waiting to hear what happens next.
Ready? Go!
mininatechsec retweeted
Cyber insurance renewal coming up? Know what you can honestly say yes to before you sign.
Free check: 18 questions based on real insurer applications, a score and a fix list. Your answers stay in your browser.
renewal-ready.moprofitz.work…
Is MFA really on everywhere? 👇
mininatechsec retweeted
We need more people in cybersecurity.
Whether you:
- Create content
- Report vulnerabilities
- Raise security awareness
- Perform security audits
- Respond to incidents
Just by being a white hat, you will help protect everyone in the coming years, from your family to the biggest companies.
That's also our mission at @opsek_io
mininatechsec retweeted
Exclusive: OpenAI says it is stepping up efforts to block Chinese labs from extracting its models’ reasoning, even as Astra becomes a major distillation target.
Full story: thein.fo/4A0y9UI
mininatechsec retweeted
Wrapping basic pathology classifiers in recursive agent loops burns a hundred times more compute just to produce hallucinations and zero proven clinical benefit. Entropy with extra steps.
link.springer.com/article/10…
mininatechsec retweeted
I got an interesting realization when talking with @csima the other day at @unpromptedconf.
I was talking about the work we are doing @SecurityBreakAI on AI Threat Intelligence. And he asked “where AI Threat Intel becomes Threat Intel only?”
And I think this is interesting, because until now I have been advocated for AI Threat Intel as I’ve been working very early on tracking how attackers are targeting, using and abusing AI.
I think it needed to become a separate field because the technology was different and we introduced a completely new ecosystem in our organizations.
But today attackers are relying on more AI to conduct operations which means previous way to operate will slowly disappear. Which means AI Threat Intel will become the new threat Intel.
I still believe we need this differentiation for now simply because the operating methods are changing and evolving but eventually AI CTI will be the norm.
I'm doing the thing until I can convince people that focusing on whether or not AI is being used in intrusions is a waste of time. What will be figured out is that virtually every cyber threat is using AI, because AI these days is as generally available as the internet. Imagine back when the requirement was "threats using the internet." AI isn't an emerging threat anymore. It's the norm.
mininatechsec retweeted
Strong agree to all of this:
Text messages with a machine, in and of themselves, are not criminal, immoral, or dangerous, for there is no victim, whatever the content. It is the very same thing as with thoughts—regardless of the content, no thought can be said to create a victim.
• If someone steals info and feeds it into an LLM, it was the theft itself which created the victim, not the subsequent text message.
• If someone uses the output of an LLM to hack a system, it is that subsequent hack which creates the victim, not the text message preceding it.
• If someone threatens harm to themselves or others through messages into a machine, here still the messages themselves cannot be said to have created any victim.
Imagining otherwise inappropriately reorients blame from its rightful place: the action of harm actually done by a perpetrator. Thinking harm =/= harm.
As humans integrate AI as an extension of their mind, policing at the message layer means to increasingly police thought itself.
Which company, which committee, do you trust to police your thoughts? Or do you simply want the thoughts of others policed, and not your own?
mininatechsec retweeted
"we are aware of reports of a potential security issue and we are actively investigating."
that's binance's statement right now.
Oonchain data shows: somewhere between $3.3 billion and $5.8 billion moved out of binance hot wallets on ethereum, arbitrum, and avalanche. tether froze $1.567 billion in USDT. circle froze more.
Binance hasn't confirmed a hack. The blockchain has.
This is a developing story. numbers are unconfirmed i'm writing from what's verified so far.
Onchain analysts flagged large suspicious outflows from binance hot wallets earlier today, wallets on ethereum, arbitrum, and avalanche. blockaid is investigating approximately $3.3 billion in suspicious transfers. coinbase's conor grogan put the figure higher, up to $5.8 billion, based on separate onchain tracing.
hot wallets are exchange-held wallets connected to the internet, used for day-to-day withdrawals. They're the most exposed part of any exchange's infrastructure.
Tether CEO Paolo Ardoino confirmed tether froze more than $1.567 billion USDT linked to a wallet that received the suspicious outflows, circle froze additional USDC combined, $1.79 billion in stablecoins was frozen based on onchain data. aave reportedly paused its lending markets to prevent the suspected attacker from using the platform, no official statement from aave yet.
market reaction: BNB dropped more than 5.5%.
CZ, binance's former CEO who stepped down as part of a 2023 guilty plea posted saying he no longer manages binance but expects user funds to be fully covered.
We still haven't known what actually happened, the full scale of losses, who is behind it or whether user funds are at risk.
This is North Korea's Lazarus group type shii just like the bybit case.
mininatechsec retweeted
The classic C macro # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) has a nasty problem.
pass it a pointer instead of an actual array, and it can silently return the wrong element count.
older Linux kernels had a clever solution.
They used a compiler type check inside a negative-width bit-field: int:(-!!(e)).
Pass a real array, and the check adds zero. Pass a pointer, and the bit-field width becomes negative, causing compilation to fail.
Here's the macro chain used in older Linux kernels:
mininatechsec retweeted
After a few years in beta, the V8 Sandbox is now considered a real security boundary! (Just announced at OffensiveCon Tokyo together with @mlippautz). This is less about reaching a particular software milestone than about two things:
mininatechsec retweeted
I don't think security researchers identifying vulnerabilities one-by-one will provide as much value as security *engineers* who can proactively prevent every vulnerability alert from being a SEV-0 or turning into a security incident.
mininatechsec retweeted
Same here … I hear the same from pretty much everyone I talk to. People are also reaching out to ask whether we still have IR capacity available.
WTF. Cybersecurity firm Sophos says its incident-response team handled SEVEN major incidents in SEVEN days, a workload that normally takes THREE MONTHS.
The WSJ reports security firms are overwhelmed by what insiders call 'Black October.' MoxFive says newly breached companies may have to wait up to FIVE DAYS for help.
Security executives say AI is helping attackers exploit vulnerabilities faster than defenders can respond.
mininatechsec retweeted
Everyday is Zeroday
BREAKING: Binance has been hacked with wallets across the Ethereum, Bitcoin, and TRON networks seeing outflows of -$5.7 billion.
The hack includes $1.45 billion worth of Bitcoin and $875 million worth of ETH.
If confirmed, this would mark the biggest hack in crypto history.
We expect more information shortly.
mininatechsec retweeted
“X is a cesspool.”
TikTok degenerates saw a Michigan dad stocking pizzas late at night and decided to humiliate him.
The people on here saw a father working his ass off to provide for his kids.
They made him a punchline. We paid off his mortgage and bullied his employer into backing him.
I’ll take this cesspool every fucking time.
