# Shostack & Friends Blog Security, privacy, economics and unrelated topics since 2005 This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Application and AI roundup - October DevFeed: [Application and AI roundup - October]() Original publisher: [Read original article]() Author: Adam Published: 2023-11-09T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security](), [Artificial Intelligence](), [Security](), [Vulnerabilities](), [Adversarial attacks](), [Large Language Model](), [browser](), [okta](), [solarwinds]() Tags: [ai](), [appsec](), [article](), [attacks](), [browser](), [large-language-models](), [okta](), [security](), [solarwinds](), [vulnerabilities]() ### AI overview An October roundup covering the SEC's case against SolarWinds and its CISO, research on vulnerabilities in large language models and adversarial attacks, AI policy and model behavior, and threat-modeling issues involving browser privacy, Okta's support system, and bug hunting. ### Source excerpt Exciting news from the SEC, lots of AI, and lots of threat modeling. ## Security Principles in 2023 DevFeed: [Security Principles in 2023]() Original publisher: [Read original article]() Author: Adam Published: 2023-10-27T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design]() Tags: [analysis](), [design](), [developer](), [security](), [security-engineering]() ### AI overview The author reflects on how their view of security design principles has changed. Although many principles remain valid, they are harder to learn, apply, teach, and assess consistently than threat modeling techniques because they require abstraction, careful analysis, and comparison of possible designs. ### Source excerpt Principles are lovely, but do they lead us to actionable results? ## Adversarial Thinking and Wargames DevFeed: [Adversarial Thinking and Wargames]() Original publisher: [Read original article]() Author: Adam Published: 2023-10-12T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Cybersecurity](), [Learning]() Tags: [cybersecurity](), [strategy]() ### AI overview The article examines how military wargames teach strategy and adversarial thinking, then compares that approach with commercial cybersecurity. It argues that cybersecurity teams primarily enable business goals rather than defeat an enemy. ### Source excerpt Thinking about adversarial thinking ## Threat Modeling on Sale DevFeed: [Threat Modeling on Sale]() Original publisher: [Read original article]() Author: Adam Published: 2023-10-06T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security]() Tags: [books](), [security]() ### AI overview A one-day Amazon sale offers Threat Modeling: Designing for Security for $4.99, which the author describes as the lowest price they remember. The author also asks readers who enjoyed the book to leave a rating or review. ### Source excerpt Best price ever for Threat Modeling ## Application and AI roundup - September DevFeed: [Application and AI roundup - September]() Original publisher: [Read original article]() Author: Adam Published: 2023-10-04T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security](), [Memory Safety](), [c/c++](), [open-source-security](), [Zig](), [Artificial Intelligence](), [cisa]() Tags: [appsec](), [c-c-plus-plus](), [c-plus-plus](), [cybersecurity](), [development](), [memory-safety](), [open-source-software-security]() ### AI overview A September roundup covering application security developments involving memory safety, C and C++, Zig, hardware memory tagging, secure-by-design AI guidance, cybersecurity policy for medical devices, and open-source software security. ### Source excerpt September was a big month in appsec for both memory safety and policy ## FDA Releases Final Cybersecurity Guidance for Medical Devices DevFeed: [FDA Releases Final Cybersecurity Guidance for Medical Devices]() Original publisher: [Read original article]() Author: Adam Published: 2023-09-26T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Cybersecurity](), [Security](), [Architecture & Design](), [Security & Privacy]() Tags: [cybersecurity](), [medical-devices](), [product-security](), [sdl](), [security]() ### AI overview The FDA released final cybersecurity guidance for medical devices, replacing guidance that was nearly nine years old. The article says it is detailed and product-focused, and discusses its expected effects on medical device submissions, other regulatory guidance, and product liability litigation. ### Source excerpt The FDA has released their new guidance, which will be broadly impactful. ## Comparing Retrospectives DevFeed: [Comparing Retrospectives]() Original publisher: [Read original article]() Author: Adam Published: 2023-09-19T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [retrospectives](), [Security](), [Architecture & Design](), [Microsoft]() Tags: [design](), [forensic](), [investigations](), [logs](), [microsoft](), [report](), [retention](), [retrospectives](), [security]() ### AI overview The article compares Microsoft's retrospective on the Storm-0558 key acquisition with Thornton Tomasetti's forensic investigation of the Arecibo Telescope collapse. It argues that retrospectives preserve authoritative accounts, support organizational learning, and reassure stakeholders, while contrasting the reports' length, authorship, and treatment of evidence. It also examines log retention as a security design choice. ### Source excerpt We can learn a lot from comparing retrospectives ## Open training: Threat Modeling for Champs (October) DevFeed: [Open training: Threat Modeling for Champs (October)]() Original publisher: [Read original article]() Author: Adam Published: 2023-09-14T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design]() Tags: [course](), [security](), [skills](), [training]() ### AI overview An October Threat Modeling for Security Champs course offers five instructor-led discussions over one week alongside self-paced work. The training is intended for technology professionals with prior threat-modeling experience and includes a skills assessment to gauge readiness. ### Source excerpt Seats are available in our October training ## Application and AI roundup - August DevFeed: [Application and AI roundup - August]() Original publisher: [Read original article]() Author: Adam Published: 2023-08-30T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [LLMs](), [Application Security](), [Artificial Intelligence](), [OpenSSH](), [Security]() Tags: [ai](), [amazon](), [application-security](), [cybersecurity](), [llms](), [openssh](), [security]() ### AI overview An August roundup of articles and developments covering large language models, AI product development, AI threats, application security, threat modeling, OpenSSH sandboxing, regulatory requirements, and Amazon's Threat Composer tool. ### Source excerpt Lots of interesting work in LLMs (again) ## ML Sec Ops: Feature with Diana Kelley DevFeed: [ML Sec Ops: Feature with Diana Kelley]() Original publisher: [Read original article]() Author: Kris Published: 2023-08-18T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Machine Learning & Artificial Intelligence](), [Security]() Tags: [ai-ml](), [ml-security](), [podcast]() ### AI overview Adam appeared on the ML Sec Ops podcast with Diana Kelley, CISO at Protect AI, to discuss the state of AI and ML security, major threats, and current priorities for the machine learning security field. ### Source excerpt Adam featured on ML Sec Ops podcast ## Use the Defcon Wifi DevFeed: [Use the Defcon Wifi]() Original publisher: [Read original article]() Author: Adam Published: 2023-08-02T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Networks](), [TLS (Transport Layer Security)](), [Bluetooth](), [Microsoft]() Tags: [bluetooth](), [defcon](), [microsoft](), [networks](), [security](), [tls](), [wifi]() ### AI overview The article argues that using the official Defcon Wi-Fi can be reasonable when devices are fully patched, users join the official networks, and applications use TLS. It contrasts this with the risks of cellular infrastructure and notes that airplane mode does not disable Bluetooth or Wi-Fi; a Faraday cage provides stronger isolation. ### Source excerpt Why it's ok to use the Defcon wifi ## SEC Cybersecurity Rules DevFeed: [SEC Cybersecurity Rules]() Original publisher: [Read original article]() Author: Adam Published: 2023-08-01T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security & Privacy](), [incident](), [Security]() Tags: [cybersecurity](), [incident](), [reporting](), [security]() ### AI overview This commentary reviews the SEC's new cybersecurity rules, including a requirement to disclose material cybersecurity breaches within four days. It discusses the rule's focus on incident impacts, prompt investor reporting, aggregation of incidents, and the author's concerns about limiting technical details and failing to learn from past events. ### Source excerpt The SEC has important new cybersecurity rules ## Chuck, Acme, and Remediation Avoidance DevFeed: [Chuck, Acme, and Remediation Avoidance]() Original publisher: [Read original article]() Author: Adam Published: 2023-07-27T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Automation]() Tags: [automation](), [cost-savings](), [integration](), [reporting](), [security]() ### AI overview The article discusses how automated threat modeling may reduce remediation costs and improve efficiency, using findings from a Forrester report and a hypothetical company, Acme, to illustrate the challenges of discovering security issues late through penetration testing. ### Source excerpt Threat modeling really CAN save you money, just ask Chuck! ## Threat Modeling and Secure by Design DevFeed: [Threat Modeling and Secure by Design]() Original publisher: [Read original article]() Author: Adam Published: 2023-07-19T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [cisa]() Tags: [complex](), [secure-by-design]() ### AI overview The Threat Modeling Manifesto team published feedback to CISA responding to its Secure by Design Guidance. The feedback takes the form of a detailed letter, which was also covered by Infosecurity Magazine. ### Source excerpt Our feedback to CISA is now public ## A proposal to rate-limit Windows' CreateFile API to slow ransomware DevFeed: [A proposal to rate-limit Windows' CreateFile API to slow ransomware]() Original publisher: [Read original article]() Author: Adam Published: 2023-07-05T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Microsoft](), [ransomware](), [API](), [Security](), [Windows](), [App]() Tags: [api](), [microsoft](), [ransomware](), [security](), [windows]() ### AI overview The article argues that Microsoft could reduce ransomware's impact by rate-limiting Windows' CreateFile API, which ransomware uses to open files before encrypting them. The proposed limit could slow attacks and give defensive tools more time to detect them. ### Source excerpt My latest at Dark Reading draws attention to how Microsoft can fix ransomware tomorrow. ## Worthwhile Books Q2 2023 DevFeed: [Worthwhile Books Q2 2023]() Original publisher: [Read original article]() Author: Adam Published: 2023-06-28T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Cybersecurity](), [Machine Learning, Security Attacks](), [passwords](), [Zero Trust]() Tags: [attacks](), [books](), [cybersecurity](), [machine-learning](), [password](), [security](), [zero-trust]() ### AI overview A quarterly reading list covering books about cybersecurity, passwords, machine-learning security attacks, zero trust, technology history, and technical writing, along with memoirs and other nonfiction. ### Source excerpt Books that I read in the second quater that are worth your time include two memoirs, a great book on the security of ML, and more! ## AI-assisted programming can speed development while increasing abstraction and technical debt DevFeed: [AI-assisted programming can speed development while increasing abstraction and technical debt]() Original publisher: [Read original article]() Author: Adam Published: 2023-06-16T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Artificial Intelligence](), [GitHub Copilot](), [ChatGPT](), [jupyter notebooks](), [Application Security](), [Python](), [pair\_programming](), [Programming]() Tags: [ai](), [appsec](), [chatgpt](), [copilot](), [jupyter-notebooks](), [pair-programming](), [programming](), [python]() ### AI overview The author reflects on using ChatGPT, GitHub Copilot, pair programming, and Jupyter Notebooks while learning Python and producing graphs. The experience accelerated development and debugging, but raised concerns about code quality, application security, abstraction, and the faster accumulation of technical debt. ### Source excerpt AI will be the high interest credit card of 2023 I haven't done a lot of work in Python, and I've never used it to produce graphs. But after an hour of pair programming and then using Chatgpt and Github Copilot got me quite far in writing a set of Jupyter Notebooks, and dramatically shrunk the effort to use and debug a new tool. I wanted to record some thoughts on the experience, and what it means for programming and for application security. ## AppSecPNW 2023 DevFeed: [AppSecPNW 2023]() Original publisher: [Read original article]() Author: Adam Published: 2023-06-12T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security]() Tags: [appsec](), [event](), [keynote]() ### AI overview The author reports delivering the opening keynote at OWASP's AppSec PNW 2023 in Portland and provides the presentation slides. ### Source excerpt Adam's AppSecPNW 2023 keynote ## Phishing Defenses DevFeed: [Phishing Defenses]() Original publisher: [Read original article]() Author: Adam Published: 2023-06-07T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [Architecture & Design](), [Users](), [Testing]() Tags: [cost](), [defense-in-depth](), [email](), [people](), [phishing](), [security](), [training]() ### AI overview This commentary examines phishing defenses and argues that telling users to avoid bad links and relying on defense in depth may impose costs without necessarily being effective. It considers user behavior, suspicious-email reporting, and the value of security training. ### Source excerpt Phishing behaviors, as observed in the wild. ## Application Security and AI Roundup - May DevFeed: [Application Security and AI Roundup - May]() Original publisher: [Read original article]() Author: Adam Published: 2023-05-30T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security](), [Artificial Intelligence](), [Large Language Model](), [Vulnerabilities](), [Security](), [Encryption](), [passwords](), [ChatGPT](), [OpenAI]() Tags: [ai](), [application-security](), [chatgpt](), [cybersecurity](), [encryption](), [large-language-models](), [openai](), [passwords]() ### AI overview A May roundup covering AI safety and security developments, application security concerns, vulnerabilities in DNA sequencing devices, and Google Authenticator's planned end-to-end encryption. It also discusses risks in LLMs, ChatGPT Enterprise, GPT-4, and AI-assisted code analysis. ### Source excerpt This month runs quite heavy on AI, but the CISA Safe by Design and Default document is going to be important for the next several years. ## The Cyber Safety Review Board Should Investigate Major Historical Incidents DevFeed: [The Cyber Safety Review Board Should Investigate Major Historical Incidents]() Original publisher: [Read original article]() Author: Adam Published: 2023-05-25T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [incident](), [solarwinds](), [Open Source]() Tags: [incident](), [open-source](), [report](), [security](), [solarwinds]() ### AI overview The article argues that the U.S. Cyber Safety Review Board should investigate major historical cyber incidents, beginning with SolarWinds, to build a respected shared history of cyber incidents. It notes that the board has not investigated SolarWinds and highlights its report on the open source Log4Shell vulnerabilities as clear and helpful. ### Source excerpt Tarah Wheeler and Adam write in CFR ## Star Wars Day Security Content and Discounts DevFeed: [Star Wars Day Security Content and Discounts]() Original publisher: [Read original article]() Author: Adam Published: 2023-05-04T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Security](), [digital](), [email]() Tags: [digital](), [email](), [security](), [video]() ### AI overview A Star Wars Day announcement highlighting security-related video and podcast content, including material about email and threat modeling, along with discounts. ### Source excerpt Celebrating Star Wars Day in style! ## Layoffs in Responsible AI Teams DevFeed: [Layoffs in Responsible AI Teams]() Original publisher: [Read original article]() Author: Adam Published: 2023-04-21T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [responsible-ai](), [ai-ethics](), [Artificial Intelligence](), [Microsoft](), [Twitch]() Tags: [ai](), [ai-ethics](), [microsoft](), [responsible-ai](), [twitch]() ### AI overview This opinion examines layoffs in responsible AI teams at companies including Microsoft and Twitch. It argues that ethical AI work may need to become more actionable for software development, while also noting the need for transparency, accountability, and regulation of AI systems. ### Source excerpt Some inferences from layoffs in responsible AI teams ## Five Threat Model Diagrams for Machine Learning DevFeed: [Five Threat Model Diagrams for Machine Learning]() Original publisher: [Read original article]() Author: Adam Published: 2023-04-13T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Machine Learning, Security Attacks](), [Machine Learning & Artificial Intelligence](), [Training AI Models](), [Data Quality](), [data]() Tags: [ai-and-cybersecurity](), [cybersecurity](), [data-quality](), [diagram](), [machine-learning](), [training-data]() ### AI overview This article presents five threat-model diagrams for machine learning systems. The diagrams distinguish threats to and from ML systems, illustrate data flows and responses, and examine how training-data sources and system-design decisions can create risks. The author emphasizes that the diagrams are illustrative rather than complete and notes uncertainty about the model of how Twitter content reached Microsoft's Tay. ### Source excerpt Some diagrams to help clarify machine learning threats [Next page]()