Compliance using NIST controls #MTC
U.S.A.
Joined July 2009
- Tweets34K
- Following3.5K
- Followers1.9K
- Likes50.6K
Pinned Tweet
I’m on @buymeacoffee. If you like my work, you can buy me a coffee and share your thoughts 🎉☕ buymeacoffee.com/DipPd86sJc
mininatechsec retweeted
Since people are yelling at threat intelligence professional for "downplaying the severity of the PHP vulnerability" (communicating clear concise information about what they're actually seeing). It feels necessary to explain what threat intelligence actually is.
Consider a hypothetical hospital or a power company. A lot of systems are built using very old PHP versions. It's not uncommon for PHP to add/remove/change features from version to version. So if you're a certain number of versions behind, updating to the latest version will break your software by removing or changing functionality it needs.
In that case, the provider has two options:
1) take their software offline until they can update the code to match the latest PHP version.
2) panic install the patch and break their software, leading to a massive outage.
In both cases, that is basically a 100% chance of an outage. On the other hand, maybe they get hacked, maybe they don't. Maybe that hack causes an outage, maybe it doesn't. Realistically, under these circumstances, the chance of an outage is actually higher with patching than with not patching.
If that outage would result in the hospital having to shut its doors or a power company's infrastructure going offline, what is the correct move? Chance being hacked, or knowingly cause an outage that threatens lives?
Cybersecurity is important and all, but there are risks far greater than being hacked. I would absolutely love it if I could just log onto IDontKnowWhyTheyRenamedThisSite dot Com, be like "vulnerability bad, pls patch" and everyone installs the patch. That is not the world we live in.
Now, if I start seeing people building ransomware that can copy itself from system to system using the PHP vulnerability, and I communicate that, it changes a lot of people's risk calculations. Their option shift towards either a 100% chance of an outage, or an extremely high chance of an outage + catastrophic data loss. In this case they would most likely pull the trigger on patching or taking their software offline.
While the hypotheticals I gave are extreme cases, many organizations accept being hacked as a cost of doing business. Taking offline software that's critical to organizational function is not an easy decision to make, and does not get taken lightly.
We don't live in LaLa land where every org installs every patch for every vulnerability the day it goes live. Cybersecurity is expensive and time consuming. Getting people to even patch systems at all is an endless uphill battle.
Most orgs know that something like 1 out of ever 10,000 critical vulnerabilities actually gets exploited. And probably less than 50% of these "this is the worst of the worst vulnerability ever, the sky is falling" type vulnerabilities leads to significant damages.
It takes a lot of time to build trust, and very little time to lose it. Overhype a couple of vulnerabilities and people will very quickly stop listening to you. It's extremely easy to end up being the boy who cried wolf. There's only so many times you can spin security teams into a frenzy before they stop listening to you entirely.
Orgs also have limited resources, so when you yell fire, there is a good chance they're committing resources they don't have. Making people stay up all night, pulling people off other issues, bringing in outside help. You probably don't want to be responsible for some org getting ransomwared because they redirected all their security resources to some vulnerability you think is really cool.
Nobody is downplaying anything. They are communicating exactly what they see/know about the issue so that organizations can make the most informed risk management decisions possible. That is the game, and that is what threat intelligence exists for.
If you want to handle an organization's security for them and personally take on the risk of potentially costing them billions or killing their customers, join an MSSP or a critical infrastructure provider. I can promise you it's way more stressful than you think.
It's not our job to decide organization's own risk models for them. It's our job to give the most information possible to the people who do. And just because some vulnerability researcher thinks we're not hyping up the vulnerability enough doesn't make them right.
Last I checked, only something like 9.3 million out of 42 million systems had installed the patch. This is the reality we live in. If we yell fire, then maybe we can bump that number up to 10 million, but if nothing happens, it'll be at the cost of maybe 2 million less systems getting patched next time around.
These are real risks we have to live with. These aren't one-off incidents. People will remember how accurate our advice was the next time around. And more or less people may decide to install security fixes based on how accurately we communicated the risks during previous incidents.
Threat intelligence is an extremely complex numbers game where there is never any right answer.
mininatechsec retweeted
If Discord is only paying $5k for an RCE in their desktop client, it's probably time to uninstall it
mininatechsec retweeted
Exclusive:
Social media companies will be required to implement “hard checks” on people’s ages such as demanding passports or driving licences under plans to stop children from using their platforms
The government is due to announce plans for a social media ban for under-16s in the coming weeks amid concerns that children are being exposed to harmful content
Ministers want to take a harder line on age verification to ensure that children are not using the platforms after concerns that a similar social media ban in Australia has had little impact
Under plans being considered by ministers, those using the sites will be required to submit their passports or driving licences or undergo credit checks to verify their age
The Australian government admitted this year that more than 70 per cent of under-16s still had “some access” to platforms three months after the law changed in December 2025
Children reported that it was “easy” to circumvent the ban. They are only required to undergo basic screening — where users take a selfie and artificial intelligence estimates their age — to access platforms if they do not wish to upload official documents. In the most brazen cases, children were able to bypass the restrictions by drawing beards onto their faces
Others have resorted to using virtual private networks (VPNs) to bypass checks by pretending they are based in another country, or pointing their phone’s camera at a screen showing an adult-looking face
thetimes.com/article/9a7f374…
mininatechsec retweeted
The only thing blocking our AI lead right now is the toxicity created by the by the large memory manufacturers. Deciding to screw the consumer in favor of the large contracts. Here's the thing. Most people would like to have nice new gadgets. and connecting to AI would be part of that. But as our computers get older and slower because of gargantuan OS's or poorly managed packages.. Our solution has always been to go buy a new computer. Well, now we can't. Not anything recent/decent. Thank you so much. So we will find other things to do like touch grass.
You can build all the data centers you want, but if you're not selling products to consumers that allow them to connect to those data centers? Well, it Self-fulfilling prophecy.
Amazon warns $68 billion in blocked data centers threatens US AI lead tomshardware.com/tech-indust…
mininatechsec retweeted
What would make you stop and verify an “interview request” before clicking?
#OSINT #Phishing #CyberSecurity
mininatechsec retweeted
New Blog:
Real Calendly link. Claimed Bloomberg interview. Phishing chain.
I followed a targeted X DM from a tailored #OSINT/#AI pitch to OAuth abuse and a fake login page—and mapped 99 publicly approached accounts.
Checking the first domain isn’t enough. Follow the chain. 🧵 > Link in post below
#phishing
Yeah, you don't want to know but if you work in tech, you gotta know....
mininatechsec retweeted
He genuinely believed he was helping his coworkers prove they were being underpaid.
Management decided to terminate him because he had deliberately accessed confidential records and distributed private employee information.
When I sat across from him during the termination meeting, he kept asking the same question.
“But did I actually steal anything?”
I couldn't give him the full answer.
There was another reason the company had decided to move immediately, and HR had been instructed not to disclose it.
After he left, I asked my manager why we couldn't simply tell him everything.
She said, “Because if we tell him exactly what we found, we could expose someone else who came forward during the investigation.”
That was the part I couldn't tell him.
Another employee had reported Darren months earlier because he had been pressuring coworkers to give him access to their pay information. That employee had asked to remain anonymous because they were afraid Darren would retaliate.
Darren never knew who reported him.
He left believing he had simply been fired for looking at salaries.
I still think about that meeting sometimes.
He kept asking, “What exactly did I do?”
And I had to sit there knowing there was a perfectly good answer I wasn't allowed to give him.
mininatechsec retweeted
One afternoon, IT noticed something unusual happening on his laptop.
He had been opening an internal folder that contained employee salary information.
At first, we assumed it was an accident.
Then we discovered he had downloaded several files.
HR joined the investigation.
When we asked Darren why he had accessed the folder, he said he was looking for an old document for his manager.
The access logs told a different story.
Eventually, he admitted he had been checking other employees' salaries because he felt the company was underpaying him.
By itself, that wasn't enough to fire him.
The more troubling question was what he had done with the information.
He had been sending screenshots of coworkers' salaries to a private group chat that included several employees.
He wasn't selling the information.
He wasn't threatening anyone.
mininatechsec retweeted
I worked in HR for a company that had a clear rule: employees were only supposed to use their work laptops for business.
Most people bent that rule a little. They checked personal email, paid bills over lunch, or watched YouTube with headphones on.
Then we discovered that one employee was using his laptop for something entirely different.
His name was Darren. He had been with the company for nearly six years, kept to himself, received solid performance reviews, and had never gotten into trouble. Honestly, he seemed like the last person we would have suspected....
mininatechsec retweeted
Breaking news: AI agents with full access to your computer can modify files on your computer.
U.S. Customs And Border Protection Grabs Canadian Driver Minutes From Canada Over $6 Million Vehicle Contents share.google/OUiXtMLRUErItsz…
