It's CRITICALLY important for us to step into NEW ENVIRONMENTS and meet new people, because great ideas won't just interrupt us. 🛑 They MUST be PURSUED. 💫🏃

We are absolutely stoked to finally share videos from CYBERWARCON ‘22! We took heavy losses to the lawyers, so almost half of the talks won’t be available online. The only way to see everything is to attend! 1/2 youtube.com/@cyberwarcon

The program for the 9th LangSec IEEE Security & Privacy Workshop on May 25, 2023 is now posted: langsec.org/spw23/workshop… Join us for two great keynotes, research paper presentations, industry research reports, and work-in-progress discussions.

Snuck in a hiking mini-break before ICSJWG in SLC, I got into Kodachrome Basin State Park (underrated & few people), Bryce Canyon NP (amazing, but crowded until remote trails), & will try Willis Creek Slot Canyon today before driving up to SLC. See many of you tomorrow.

The only true competitor in an infinite game is yourself.

Mandiant’s COSMICENERGY report shows that the IEC-104 module ”LIGHTWORK” sets the output to OFF at the following hardcoded addresses (IOAs): ❌ 34 ❌ 84 ❌ 134 ❌ 184 ❌ 234 ❌ 284 ❌ 334 ❌ 384 These IOAs might be power line switches, circuit breakers or something else.

"Thus far, we haven't seen a single incident response where AI played a role” says Sandra Joyce. A good reminder not to get too caught up in the hype. reuters.com/technology/ai-…

The loss of Tweetdeck / X Pro got me to buy Blue.

If a chatbot writes a complete essay from a short prompt, the entropy of the essay will be exactly that of the initial prompt, no matter the length of the final product.

most of my career has been weathering this reaction tbh. I’ve long agreed with Heather Adkins - Ꜻ - Spes consilium non est’s answer that the cybersecurity industry shouldn’t exist, because it needs to be solved in design/arch. I also think the industry will resist Secure by Design/Default for this very reason…

It’s clear that the MITRE Engenuity ATT&CK is a dead testing criteria / evaluation and more about gaming the scores. MITRE ATT&CK however is still an amazing framework for evaluating coverage and effectiveness. Lots of great things there still even if Engenuity is a hot mess.

S4x24 tickets on sale now at universe.com/events/s4x24-t… 1st 100 tickets sold in the first two hours, but we keep the ticket #1 - #100 price until noon EDT on Tuesday, Oct 3 to be fair to all time zones. Ticket also gets you coveted hotel block info.

The September 13 meeting summary for Cybersecurity and Infrastructure Security Agency’s cybersecurity advisory committee includes a blurb about the recommendations from the technical advisory council re: the agency’s work to protect high-risk communities. cisa.gov/sites/default/…

We are at the last open ticket block for #S4x24, 751-1000. Tickets 1001 - 1100 will be limited to asset owners. S4x24 is March 4 - 7 in Miami South Beach. s4xevents.com/ticket-block-7…

Kence’s Keynote was great. Video will be available this month. Buy the book.

Q1 ICS Security In Review x.com/i/broadcasts/1…

The S4x26 Call For Presentations is open. See s4xevents.com/cfp

POC Pavilion OT System Reveal x.com/i/broadcasts/1…