#DFIR with a lot of focus on the IR part.
Cellist, NASA Alum, Parrot lover, USAR & EMS do-er.
My other car is @amuse@infosec.exchange
Jan 30, 2019 • 13 tweets • 3 min read
How could #Apple have missed this escalation to their PSIRT, you're asking?
Today, lets talk about "Analyst Fatigue".
Analyst Fatigue is a term to describe a bias which begins to set in after a long period in a type of job where you receive many escalations to triage.
Think about "vulnerability reporting" email addresses for a company that size. Do you know how many issues they get daily? Probably a LOT. Many, if not most, of these will be poor quality. For example:
Sep 21, 2018 • 9 tweets • 2 min read
>I am Sam.
>Sam I am.
>Would you like big bugs in RAM?
I would not like them, Sam I am!
>Would you like them in PC’s?
>Would you like some ECC?
I do not like them in PC’s,
I do not want some ECC.
I do not like big bugs in RAM,
I do not like them, Sam I am.
>Would you like them when unmapped?
>Would you like them under wraps?
NO!
I do not like them in PC’s,
I do not want some ECC,
I do not like them when unmapped,
I do not want them under wraps!
I do not LIKE big bugs in RAM,
I do not like them, Sam I am.
Feb 23, 2018 • 7 tweets • 2 min read
I am Sam.
Sam I am.
Would you like me on your LAN?
I would not like that, Sam I am!
Would you like me in PC’s?
Poking at use_after_free?
I do not want you in PC’s,
stop poking at use_after_free.
I do not want you on my LAN,
I do not want that, Sam I am!
Would you like your zip unpacked?
Would you like your DB hacked?
No!
I do not want you in PC’s,
Stop poking at use_after_free,
I do not want my zip unpacked,
I do not want my DB hacked,
I do not want you on my LAN,
I do not want that, Sam I am!
