Ed Bailey retweeted
I MADE IT! ❤️🙏🏾
This morning started with heartbreak after waking up to find my van broken into, two windows shattered, and two lawnmowers stolen. For a moment, I thought I wouldn’t make it to the Louisiana Book Festival. But I reminded myself that one bad moment doesn’t have to ruin an entire day. Despite everything, I made it! Standing here surrounded by the five children’s books I’ve worked so hard to bring to life means more to me today than ever before. They may have taken my lawnmowers, but they couldn’t take my joy, my purpose, or my determination. Thank you to everyone who reached out with love and encouragement. Today, I’m choosing gratitude over frustration. ❤️
Ed Bailey retweeted
The Vulnpocalypse - Good News and Bad News
- The bad news is we are inundated with new vulnerabilities due to the increased volumes discovered by AI tooling.
- The good news is many organizations are starting to handle this with increased speed, prioritization, and existing methods of defense in depth.
- The bad news is there are also many organizations not doing this, and worse, are sitting on a whole ton of software, configuration, and structural/policy vulnerabilities from prior years.
- The good news is many of these targets have not been exploited due to attacker’s resource constraints.
- The bad news is that this might not hold as attackers industrialize their capabilities to turn more targets of opportunity into actual victims.
- The good news is, apart from scams, crypto/Web3, and some parts of the ransomware kill chain, it appears that such industrialization is not helping monetization (yet).
- The bad news is attackers are an innovative bunch and not likely to give up and go set up a bakery, or go back to drug dealing. Besides, chaos may still ensue as agent swarms simply exploit vulnerabilities anyway.
- The good news is defenders can use all this AI capability for defense. We are seeing the potential that many significant code bases will have dramatically lower vulnerabilities levels than ever before due to the “deep cleaning” (h/t @argvee) with the very same tools we are concerned attackers will use.
- The bad news is getting a code base “clean” doesn’t mean the updated packaged software will arrive quickly in all the places where attacks will target.
The good news is……..?
philvenables.com/post/the-vu…
Ed Bailey retweeted
I think the era of rapid detection and response to keep incidents small & contained is going to draw to a close with agentic attacks.
We’re going to have to security engineer our way forward instead. Limit blast radius by design. Brilliance in the basics. It will be more about hardening and configuring what you have (which is hard and slow and boring) vs. reaching for some shiny new product that will solve all your issues
Ed Bailey retweeted
Tyrese Maxey on whether he changes his baby's diaper:
"I'm a big diaper changing guy. I take pride in the speed that I'm able to change a diaper and keep her from crying. So I'm a big diaper change guy, big feed guy, big nap guy. I'm all of it, wake up in the middle of the night, go get it. I do it all man. I try to cherish these moments, cause it feel like already now she trying to crawl and do different things. So she's already moving too fast for me"
Changing the subject slightly and I am sure this makes me the simpleton here. Why use the term ‘invariants’? I am a fan of simple clear language and I am not sure this is a good way to communicate something important. Seems something basic like ‘standard’ might work better. @anton_chuvakin
Ed Bailey retweeted
When it comes to real tasks that IT and Security practitioners undertake, you can see open weight outperform on both performance AND price.
This quoted post is unavailable.
Ed Bailey retweeted
Somewhere in Bavaria, a 900 year old bloodline just ended because a man in a suit decided to baptize a woman's feet with a pint of lager.
Security teams need on-demand access to non-traditional security data.
This week’s security drama stressed already overworked SOC teams. It’s one thing to have SIEM content for php2shell; it’s another to have the right data so the detection actually fires.
So many teams I worked with last week didn't have the right logs and were frustrated by the process of getting them quickly.
I encourage teams to pre-wire their environment so it's easy to get what you need on demand. Call it adaptive logging: baseline logging all the time, with the ability to turn on new logging with an API call into @cribl_io Stream and Edge. This gives you access to what you need, when you need it, without paying the ‘logitall’ price every day.
Access to the right data now gives you the coverage needed to understand the scope of exposure to the latest issue. BTW, this is not slowing down.
cribl.io/blog/from-cve-to-co…
Ed Bailey retweeted
Charlize Theron completely destroys Zach Galifianakis on Between Two Ferns
She leans in and whispers:“My thighs are so sweaty right now… it’s dripping all the way down to the back of my knees.
The only thing that could cool me off is to jump naked into a pool.”Zach: “Are you asking me to go with you?”Charlize:
“The image of me and you… me naked in a pool with a fat garden gnome.”Zach’s final line:
“I hope your dog dies.”
“I just pissed myself.”
Ed Bailey retweeted
Project Swarm from @GreyNoiseIO let's you get ground truth on exploitation in the wild. You can deploy your own honeypots to collect reconnaissance, exploitation, and post-exploitation artifacts. It's a dollar.
greynoise.io/project-swarm
Ed Bailey retweeted
Things that aren’t security controls:
- thoughts and prayers
- alignment
- prompts prohibiting action
- saying “not my circus not my monkeys”
- “it is what it is”
Feel free to add 😂
Ed Bailey retweeted
#php #PHP2Shell find all the details here and how to threat hunt and harden and more!
tti.truv.is/reports/TT-20261…
Ed Bailey retweeted
Just back from 3 weeks on the road with customers in the US and Europe. Quick observations:
1) Everyone is preparing to defend every dollar, especially token spend. Most can't tell you what their token spend actually is yet.
2) Big enterprises are ruthlessly standardizing. One put it as "you're not special, fit yourself in." Open source and open standards wherever they can.
3) Sovereignty concerns are very real in Europe. Teams want their data and models running fully on their own inside air gapped environments, and they're looking hard at open weights.
4) One CISO told me the security version of a model costs them about 4x the regular one. The security tax is alive and well ;-)
5) Most of the data isn't in their SIEM/analytics storage. One customer said 75% lives outside their hot tier and only a few knew they could use Search to access it without moving it first.
6) The builder streak is strong. Teams are writing their own detections, building their own agents, and one even rebuilt their whole case management system themselves - on top of a purchased SOAR.
7) Security and observability teams still mostly live in separate worlds, even when they're looking at the same data. They get along better than I’ve seen in the past tho.
8) Getting agents to actually deliver outcomes is still hard. Lots of experimenting, fewer finished jobs.
The mood has shifted from "show me the demo" to "show me the math." Although my demos were pretty effing cool 😎
Ed Bailey retweeted
Security is a Team Sport
…but if you have no idea who the players and positions are, you are probably going to lose most of your games.
All roles in an organization have a critical part to play in avoiding the next cybersecurity crisis, including YOU! 🙂
👇
Ed Bailey retweeted
Nice news: #rsyslog just got accepted into the Claude for Open Source Program by @AnthropicAI, with Claude Max 20x for 6 months. 🎉
I'll use it to further strengthen security and to add new features. Having multiple AI agents available is a big plus, also for resilience. Very curious how this works out, and I'll share what I learn. Thanks, Anthropic, for backing open source maintainers! #opensource #AI #ClaudeAI
Ed Bailey retweeted
We say this...a lot...but that's because it's true: You cannot get value out of data that you don't have, and neither can your agents.
Hear more hot truths from the #CriblCon 26 keynote: bit.ly/4zdUcH3
Ed Bailey retweeted
Yesterday we released cribl-decision-1.0. This is our first crack at a Jev-style decision model. Obviously, we're seeing these crop up everywhere, but we have a very focused market: Telemetry. I think this highlights the pattern we'll see continue, which is a proliferation of models fine-tuned for specific domains. Cribl has over 1500 customers, many processing data at gigabytes per second. Latency and cost are paramount, and we will continue to enhance our models for processing telemetry, which is the highest volume and highest variability data in the world.
Introducing cribl-decision-1.0!
Every telemetry event is a decision: where to route it, how to enrich it, and what needs attention. Today, we're releasing a 4B parameter, open-weight model that returns probabilities for your supplied choices in a single forward pass - a foundation for bringing AI decisions into telemetry pipelines.
The weights are available on huggingface: huggingface.co/cribl-ai/crib…
Read more: cribl.io/blog/cribl-decision…
Ed Bailey retweeted
Introducing cribl-decision-1.0!
Every telemetry event is a decision: where to route it, how to enrich it, and what needs attention. Today, we're releasing a 4B parameter, open-weight model that returns probabilities for your supplied choices in a single forward pass - a foundation for bringing AI decisions into telemetry pipelines.
The weights are available on huggingface: huggingface.co/cribl-ai/crib…
Read more: cribl.io/blog/cribl-decision…