Shostack + Friends Blog

SEC Cybersecurity Rules

The SEC has important new cybersecurity rules (01 Aug 2023)

Chuck, Acme, and Remediation Avoidance

Threat modeling really CAN save you money, just ask Chuck! (27 Jul 2023)

Threat Modeling and Secure by Design

Our feedback to CISA is now public (19 Jul 2023)

I’ve been reading about Oceangate with increasing horror and anger, and the confusion over the relationship between engineering and — frankly — bullshit. I don’t think anyone has ever told me ‘you are going to kill someone.’ Certainly not ‘way too often.’ If you’re hearing that, the right response is to slow down, not take it as an insult. (17 Jul 2023)

Microsoft Can Fix Ransomware Tomorrow

My latest at Dark Reading draws attention to how Microsoft can fix ransomware tomorrow. (05 Jul 2023)

No guns please

Art imitating life in ways you didn’t think possible (30 Jun 2023)

Worthwhile Books Q2 2023

Books that I read in the second quater that are worth your time include two memoirs, a great book on the security of ML, and more! (28 Jun 2023)

AI will be the high interest credit card of 2023

I haven’t done a lot of work in Python, and I’ve never used it to produce graphs. But after an hour of pair programming and then using Chatgpt and Github Copilot got me quite far in writing a set of Jupyter Notebooks, and dramatically shrunk the effort to use and debug a new tool. I wanted to record some thoughts on the experience, and what it means for programming and for application security. (16 Jun 2023)

AppSecPNW 2023

Adam's AppSecPNW 2023 keynote (12 Jun 2023)

Phishing Defenses

Phishing behaviors, as observed in the wild. (07 Jun 2023)

Application and AI roundup - May

This month runs quite heavy on AI, but the CISA Safe by Design and Default document is going to be important for the next several years. (30 May 2023)