# infosec Information security (INFOSEC) is the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction to provide confidentiality, integrity, and availability. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64 DevFeed: [Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64]() Original publisher: [Read original article]() Author: Axel "0vercl0k" Souchet Published: 2023-05-05T15:00:00Z Content type: article Language: en Sources: [Diary of a reverse-engineer]() Topics: [Exploit](), [vulnerability](), [infosec](), [Windows]() Tags: [0-click-remote-code-execution](), [cve-2022-33318](), [exploit](), [exploitation](), [genbroker64-exe](), [genesis64](), [iconics](), [iconics-genesis64](), [ics](), [icsa-22-202-04](), [memory](), [memory-corruption](), [paracosme](), [pwn2own](), [pwn2own-2022](), [pwn2own-miami](), [remote](), [zdi-22-1041](), [zero-click]() ### AI overview A participant recounts preparing for and demonstrating a winning zero-click remote entry at the 2022 Pwn2Own ICS competition in Miami. The article focuses on exploiting a memory-corruption vulnerability in ICONICS Genesis64 software running on Windows. ### Source excerpt 🧾 Introduction After participating in Pwn2Own Austin in 2021 and failing to land my remote kernel exploit Zenith (which you can read about here), I was eager to try again. It is fun and forces me to look at things I would never have looked at otherwise. The one thing I ... ## Threat Modeling for UX Designers: Human-Centered Security DevFeed: [Threat Modeling for UX Designers: Human-Centered Security]() Original publisher: [Read original article]() Author: Adam Published: 2022-12-14T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [User experience (UX)](), [Security](), [Usability](), [infosec](), [MFA](), [Mastodon]() Tags: [mastodon](), [mfa](), [security](), [usability](), [ux]() ### AI overview Adam Shostack discusses human-centered security and threat modeling for UX designers on Heidi Trost's podcast. The article argues that usability expertise can improve security, including the discoverability and default setup of MFA and 2FA. ### Source excerpt Threat Modeling for UX Designers with Adam Shostack on Heidi Trost's podcast ## (Technical) Infosec Core Competencies DevFeed: [(Technical) Infosec Core Competencies]() Original publisher: [Read original article]() Published: 2021-06-10T03:08:05Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [infosec](), [Security]() Tags: [core](), [information](), [infosec](), [technical]() ### AI overview An incomplete list of technical competencies that people working in information security would benefit from knowing. ### Source excerpt An incomplete list of things just about anybody working in Information Security would benefit from knowing. ## Lost Infosec Battles DevFeed: [Lost Infosec Battles]() Original publisher: [Read original article]() Published: 2020-11-06T15:44:27Z Content type: opinion Language: en Sources: [Signs of Triviality]() Topics: [infosec]() Tags: [infosec]() ### AI overview The article discusses seven information-security battles that have been lost but continue to receive effort. ### Source excerpt 7 battles #infosec has lost but we keep wasting efforts on trying to fight again and again nonetheless. ## The Uber CSO indictment DevFeed: [The Uber CSO indictment]() Original publisher: [Read original article]() Author: Adam Published: 2020-08-28T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [infosec](), [data]() Tags: [breach](), [ciso](), [department-of-justice](), [disclosure](), [ftc](), [infosec](), [law]() ### AI overview An analysis of the Uber CSO indictment and Mark Rasch's essay on concealing and failing to report a data breach. The article emphasizes due process for Joe Sullivan and argues that the case may make organizations and lawyers more cautious about breach disclosures, potentially reducing their usefulness for learning from mistakes. ### Source excerpt Thoughts on Mark Rasch's essay, Conceal and Fail to Report - The Uber CSO Indictment ## Threat Modeling Thursday: The Human Element DevFeed: [Threat Modeling Thursday: The Human Element]() Original publisher: [Read original article]() Author: Adam Published: 2020-01-09T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [infosec]() Tags: [infosec](), [podcast]() ### AI overview The author joined Caroline Wong on the Humans of Infosec Podcast to discuss the human element of threat modeling. ### Source excerpt I joined Caroline Wong on the Humans of Infosec Podcast to discuss The Human Element of Threat Modeling. ## Resources for Infosec Skillbuilding DevFeed: [Resources for Infosec Skillbuilding]() Original publisher: [Read original article]() Author: Adam Published: 2018-12-12T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [infosec]() Tags: [book](), [featured](), [infosec](), [list](), [resources]() ### AI overview The author thanks Digital Guardian for featuring The Threat Modeling Book in its list of resources for InfoSec skillbuilding and notes that the book has remained useful over time. ### Source excerpt The Threat Modeling Book has been featured on a list of resources by Digital Guardian. ## Threat Modeling and Architecture DevFeed: [Threat Modeling and Architecture]() Original publisher: [Read original article]() Author: Adam Published: 2017-09-18T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [infosec](), [Architecture & Design](), [software-architecture]() Tags: [architecture](), [engineering](), [infosec](), [software-architecture]() ### AI overview The article examines how threat modeling and software architecture both use system models to reason about properties, tradeoffs, design choices, and potential problems. It presents a four-step threat-modeling process and discusses how the two practices can inform each other. ### Source excerpt [no description provided]