The problem if you’re USG is something like this: you have good information that attacks are imminent but not enough to prevent attacks outright. What do you do?
US intelligence likely based estimates on a wide variety of sources, such as spies, intercepted comms, even implants of their own. So you could KNOW the orders’ been given but not know specifics. Reading for nuance and details is key
So as USG do you warn? Probably, even if you know it’s somewhat futile. And there’s subtle messaging such as the note on “evolving” intelligence—Likely speaks to fluidity of Russia decision more than uncertainty of intelligence
As for actionable, to paraphrase @RobertMLee, best action now is to get some rest. You prepare for crises ahead of response—unless you’re already nearing the completion of MFA deployment, likely too late to start. Best thing is take care of your ppl: you might need them soon
• • •
Missing some Tweet in this thread? You can try to
force a refresh
I worked counterintelligence from 2003 to 2016 with US military and civilian agencies. In that time, I investigated, taught, and helped build insider threat programs. One big lesson learned: insider threats are usually caught from the outside. But how?
Because insider threat *always* has an external nexus. Whether it’s a foreign gov, LAPSUS$, or even a reporter looking for a scoop, there’s always an external actor washingtonpost.com/national-secur…
LAPSUS$ is the group on everyone’s mind today, having just leaked data around a potential breach of #Okta, a widely-used SSO & identity provider. So let’s take some time to dive into #LAPSUS$, where they came from, how they’ve evolved, and how to defend against them.
LAPSUS$ appeared in only a few months ago, in December 2021. They appear to be Brazilian-based or affiliated, going off of their initial targets and the languages used on their Telegram channels
Notable analysts have described them as “erratic and unusual” (@BrettCallow in Wired) and “competent and incompetent at the same time” because of their seeming inability to monetize their successful breaches