Profile picture
Daniel Cuthbert
@dcuthbert
, 4 tweets, 3 min read Read on Twitter
Unpopular opinion: you will not buy you way into being secure. No matter what any vendor says or promises, throwing money at a solution rarely gives the results you think. Invest in people. Invest in engineering and build build build.
Yes, some commercial tech helps and if you build your own, and that tech is modern and uses an API, then you build that in as a cog in the machine, NOT build your security around that.
For example: osquery.io + kolide.com/fleet/ + ossec.net --> elastic.co/what-is/elk-st… then automate it into a slack bot. By empowering security/engineering teams to explore/play, you end up with teams who *know* the org and not pass to vendors
A perfect reason why @dinodaizovi's Keynote at @BlackHatEvents is going to be rather epic blackhat.com/us-19/briefing…

"software teams need to own their own security now and security teams need to become full-stack software teams"
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Daniel Cuthbert
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @dcuthbert see all

Profile picture
Daniel Cuthbert
@dcuthbert
As someone who’s had to strip and rebuild numerous looms in the cars I’ve restored, this patent by Tesla is actually pretty damn cool, but I’ve some reservations electrek.co/2019/07/22/tes…
Yes, it’s true that most wiring looms are a mess of wires and different networks, ECUs, sensors, clips, modules, mhell you name it and it’s mostly there. All hidden and twisted beneath seats, bulkheads and guaranteed to cut you when not expecting it.
This subject confuses a lot of new car hackers as you seemingly have so many possible networks. This is by design, having a single CAN network does introduce a single point of failure, harder troubleshooting and security concerns.
Read 9 tweets
Profile picture
Daniel Cuthbert
@dcuthbert
I'm hoping this thread helps anyone who wants to be a trainer and submit training for a conference. First up, as I've said before, training is very hard to get right. It's no longer just some slides and a vulnerable virtual machine. What I look for is structure and planning
First up is a lesson plan. or trajectory. This helps you guide your instruction so you can maximize classroom time.
1: Necessary tools/materials
2: Objective
3: Background Knowledge
4: Direct Instruction
5: Student Practice
6: Demonstration of Learning
The objectives are really vital here, I'm a huge fan of METL (Mission Essential Task List) as I saw the benefit when delivering training to special forces and it has stuck with me since. What is the task and what do you need to do in order to support it.
Read 6 tweets
Profile picture
Daniel Cuthbert
@dcuthbert
I've tried to keep this bottled up, but seeing as we've a whole wave of new people to our industry, maybe it's time to help rather than stand silent.

0hday/Zeroday/0-day exploits should be the least of your worry. Adversaries mostly wont be using them*
Vendors have loved the term and jumped on it like a tourists at a free buffet breakfast. It sounds sexy, I mean a cyber weapon/pathogen that's mythical and unknown. My gaaawd how cool. Oh we can detect it and stop it. SIGN ME UP!!
Thing is, ask any good attacker today in 2019 and they won't be burning 0hday for most things. Mostly because it has become a damn valuable asset. Zerodium (market broker leader for exploits today since our resident Bangkok dude retired) just updated their pricing
Read 8 tweets

Related threads

Profile picture
BookdiggerJim: Half Man, Half Robot... All Man
@goodoldcatchy
It bugs me that Sarah Sanders is proud of her performance as Press Secretary. She lied or misrepresented the truth every time she opened her mouth, all to advance her own career at the expense of the American people and the state of the Earth. She defended an administration that
is committing human rights abuses against children, dirtying the planet, and practically throwing money at the rich assholes that need it least, all while ordinary people struggle to make ends meet by working multiple jobs. She's exactly the kind of heartless shill that
shouldn't be proud of herself, let alone try to run for a position as an important public servant. Citizens of any country need honest representatives to tell them the cost-benefit dynamic involved in policy and legislative decisions, not twist everything to fit the agenda
Read 6 tweets
Profile picture
DawsonSField
@DawsonSField
Are they starting to drain the Swamp in Mexico?
The Brazilian construction company Odebrecht, which is linked to several of the US & Latin American corruption investigations has been banned from Mexican govt. contracts. #ButNothingsHappening afp.com/en/news/15/mex…
In addition they also may not work with state-run companies either for at least the next 3 years!
Odebrecht has been linked to corruption in at least a dozen countries, with Mexico making it lucky 13!

Several Presidents from South America are already in jail & one killed himself last week when the police showed up to arrest him.
Read 7 tweets
Profile picture
Gautam Chikermane
@gchikermane
1/n
 Far too much energy has been depleted in condemning how the rich and the famous spend their #money (legally inherited and/or legally earned) on weddings. In one straight piece @monikahalan makes mincemeat out of them – and forces an introspection livemint.com/Money/Tzr7GQyG…
2/n
 How many of those calling such high-decibel weddings “vulgar” opt for a simple registered wedding for their children, asks @monikahalan – scathing observation on #money!
3/n
 Rather than condemning those who spend their earned/inherited #money, we need to look at how taxpayers’ money is spent on the personal upkeep of ‘public servants’ in acres-large bungalows in prime locations, argues @monikahalan
[We don’t because so few of us pay income tax.]
Read 6 tweets
Profile picture
Hugo Nguyen
@hugohanoi
1/ Emin again with the BS that PoW’s role is merely a “Sybil-controlled mechanism”. (And therefore PoS is a reasonable drop-in replacement.)

It’s the classic mistake domain experts make when analyzing systems purely from their Point-of-View.
2/ Here is Emin’s original “lecture” for reference

I seriously hope Emin is not the only one teaching blockchain at @Cornell. Because he is dead wrong.
3/ Reducing PoW’s role to Sybil control is like an alien looking at cars and conclude that their main purpose is for protecting people from external objects. When they try to create the same thing, they might end up with something like the Flintstones’ car. 🙄
Read 12 tweets
Profile picture
Seth Abramson
@SethAbramson
(THREAD) I have what may be an unpopular opinion regarding Steve Bannon and the New Yorker Festival, which is that, while I respect the *hell* out of those who are pulling out of the Festival, I think they're wrong and Bannon should stay in. This thread is about why I think that.
2/ If you're followed the Trump-Russia case for 18+ months, as I have, and written a book on the case, as I have, you no longer have any serious doubt about who the targets are in the Mueller probe. In fact, I can list them for you right now, and I will do so in the next tweet:
3/ Here are Mueller's likely targets—some already confirmed:

Trump Sr.
Prince
Manafort
Flynn
Bannon
Kushner
Trump Jr.
Cohen
Gates
Sessions
Gordon
Page
Schmitz
Papadopoulos

Maybe: Barrack, McFarland, Phares, Miller, Lewandowski, Dearborn
Unlikely: Conway, McGahn, Pence, Priebus
Read 20 tweets
Profile picture
Liana Naima
@LianaNaima
Growth is discomfort.
Your old shell is cracking.
It's very powerful the moment you recognize you've been holding your own freedom and joy hostage.
There is a part of you that sees through the cracks of your own self-inflicted suffering. You're tired of your thoughts, you're tired of your habits and how you treat others. You're craving intimacy, honesty, and vulnerability, and that requires breaking the walls down.
Read 11 tweets

Trending hashtags

#debunked #Imagine #online #2ndAmendmentMilitia #WRWY #IrregularWarfare #post #DigitalAge #Education #fun #lies #Intelligence #videos #Protecting #time #DigitalSoldiers #Military #billion #QSoldiers #IndependenceDay #Intel #mic #FactsMatter #million #TheyCantStopUs
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!