Hack The Planet

Well, someone hacked the planet. Or, more precisely, someone hacked Hack the Planet. Luckily it was a friend who had read about the vulnerability while I was engaged in some family time. He hacked it, and then he patched it, and then, because I have good friends, he wrote up exactly how he did it so the rest of us could learn from my mistake. His guest post is up here, and you should read it before or after this one. It is a better technical writeup than I would have given you, mostly because I was the target and not the operator this time.

Let me sit in that for a second, because it is uncomfortable and it should be.

I have spent twenty-nine years in this industry. I have delivered more executive briefings than I can count on exactly this kind of thing. I have walked into SOCs and watched alerts pile up unread, and I have written on this very blog about how best practices are rarely practiced and how the fundamentals are the fundamentals for a reason. Patch your systems. Know your assets. Reduce your attack surface. I know the sermon. I wrote the sermon. I can be preachy… 

And my site sat unpatched for two days on a critical with a working exploit in the wild, because I was unaware and living my life.

That last part is the part I actually want to talk about, because “just patch faster” is true and useless in equal measure.

Here is what happened, and my friend lays out the timeline better than I will. WordPress shipped the fix on 17 July. A public proof-of-concept existed about a day later. He was in on day two. At no point in that timeline was I outsmarted. I was out of position. There is a difference, and the difference is the whole point. The vulnerability did not require a genius to exploit (my friend is brilliant though). It required a calendar. The patch dropped, the clock started for everyone at the same instant, and I lost the race because I was at a dinner table instead of a dashboard.

This is the trend that has been eating our field alive for years, and it is getting worse. The window between “patch is public” and “exploit is public” used to be measured in weeks. Then days. Now, increasingly, hours. When a fix ships, it ships to the defenders and the attackers at the same moment, and the attackers have a structural advantage. They only have to win faster than a defender can discover and get approval to patch the vulnerability. 

Now add AI to that timeline. I want to be careful here, because the exploit that got me was not some novel machine-generated superweapon. It was a garden-variety patch-to-PoC sprint that we have seen a hundred times. But the step in that sprint that used to require real skill and real hours, diffing the patch and building a working exploit from it, is exactly the kind of task that AI is getting frighteningly good at compressing. Things that used to take a skilled researcher an afternoon are starting to take a moderately clever person with the right tooling a coffee break. AI did not invent the patch race. It is pouring gasoline on it. The trend was already bad. The accelerant is new.

So the defensive requirement is speed. Hear about the fix fast, act on it fast, beat the scanners to your box. My friend lays out the playbook in his post and it is correct. Subscribe to the right feeds, turn on automatic updates, keep good backups, know your manual override, know your stopgap. None of it is complicated. I could have written it in my sleep. I have written it, in various forms, for years.

Here is the part the sermon always leaves out.

The speed the threat demands and the speed a human life allows are not the same speed. I was not ignoring my responsibilities. I was fulfilling different ones. I was present with my family, which is the thing this entire career is supposed to be in service of, and while I was present, a patch dropped and a two-day clock started and I never heard it tick. That is not a discipline failure. It is a physics problem. There are more critical patches, dropping faster, with shorter fuses, than any individual human can personally track while also being a person.

We do not talk about this honestly enough, and it burns people out. We tell practitioners to stay current as if staying current were a matter of willpower, and then we act surprised when they are exhausted, when the home lab goes dark, when the side project blog sits two days behind on a patch because its owner was being a father instead of an administrator. The always-on expectation is not sustainable, and pretending it is does not make it so. I say this as someone who preaches the fundamentals and just got caught by them.

So what is the actual answer? It is not “try harder.” It is “need less.”

The most resilient thing I took away from getting popped is the least glamorous. Reduce what has to be defended in the first place. My friend makes this point sharper than I will in his post, and he is right. This blog is, at the end of the day, some pages of text I wrote for people to read. It does not need a database, a REST API, and a PHP runtime standing guard over a pile of essays. The machinery I was running had an attack surface that my actual content did not require. The bug that got me had somewhere to live because I gave it a home.

That is the reframe. The way you win a race you cannot personally run fast enough is to stop entering it. Automate the patching you can. Cut the attack surface you do not need so there are fewer clocks ticking in the first place. Build backups so a bad day is an inconvenience and not a catastrophe. The goal is a setup where being a human being for two days is survivable, because the machine held the line while you were gone.

I got lucky. My attacker was a friend who patched the hole and sent me notes. The next one will not be, for me or for you. Take the free lesson I paid for. Subscribe to the feeds, turn on the auto-updates, cut the surface you are not using, and then go be present with your people, knowing you built a thing that does not need you standing over it every hour of every day.

Reduce your attack surface. Patch what you can. And do not forget to spend time with the people who make all of this worthwhile, and worth fighting for.

Hack the Planet!

*Authorized guest post by aaronott*

If you’re reading this, you read this site, so this is aimed at you, not my friend who runs it, though I did get authorization to post this. I got into their blog on 19 July. Here’s why that’s a story about your blog too.

I didn’t do anything clever. I got in through wp2shell, the WordPress pre-auth bug that had a patch sitting there for two days before I used it. The site wasn’t some abandoned install on a five-year-old version. It was reasonably current. The fix was just two days old and hadn’t been applied yet.

That’s the whole lesson, and it’s the most common one in this business.

On 17 July, WordPress shipped 7.0.2 and 6.9.5 to close wp2shell: a REST API batch-endpoint route confusion (CVE-2026-63030) chained to a `WP_Query` SQL injection (CVE-2026-60137). Together they hand an unauthenticated attacker a blind SQL injection through a single public endpoint, and on a lot of ordinary hosts, a path to running code.

When a fix ships, the clock starts for everyone at the same moment. Attackers diff the patch, build a working exploit, and start scanning within hours. wp2shell went from patch to public proof-of-concept in about a day. I was in on day two. Nobody caught by this gets outsmarted, they just find out too late.

The one thing you actually control is how fast you hear about the fix. Two things cover that:

Subscribe. For WordPress, watch the [WordPress.org news feed](https://wordpress.org/news/), where every core security release gets announced (it has an RSS feed you can drop into a reader), plus a CVE alert scoped to the plugins and themes you actually run. You should find the security feed for your stack, if there isn’t one, choose another stack. That’s enough for most single-site setups.

Have a fast way to act. You don’t need an incident-response binder if it’s just you and one blog. You need four things: have a good set of backups that run daily, turn on automatic security updates so criticals often land before you’re even awake, know how to update by hand for when they don’t, and know one stopgap you can throw up if you can’t patch right away (for wp2shell, blocking the batch endpoint at your host or WAF bought time). That’s it. The point isn’t process, it’s beating the scanners to your box.

Now here is my jab:

Look at what got compromised here: a whole content-management system, a REST API, a database, and a PHP runtime, all standing in front of what is basically some pages of text someone wrote for people to read.

If that describes your blog too, it’s worth asking whether you need the machinery. A static site is Markdown in, HTML out, served as flat files. No database to inject into, no endpoint to confuse, no login to brute-force. Hugo, Eleventy, Zola, Astro: pick one, `git push`, go to bed. The bug I used has nowhere to live in that world, because there’s no SQL for the injection to reach.

You don’t need a content management system. You need content, and a way to manage it. Those turn out to be very different amounts of attack surface.

So: subscribe, turn on auto-updates, and if you’re running a whole CMS to serve flat HTML, give static a look. It only took two days.

Hack the planet. Just patch yours first.

*aaronott*

Over the holiday weekend I had some time to think (which can be a dangerous thing), and one of the things that has been on my mind is the need for real-time information to make quick, accurate, confident decisions. I put a short version of this up on LinkedIn, and the conversation it started was good enough that I wanted to expand it into a full post. When minutes matter, information wins. That lesson has been learned in every conflict this country has fought. It was true when riders carried word that the regulars were out. It was true when the Union cracked Confederate signals, when codebreakers shortened a world war, and when a forward air controller in Vietnam had seconds to sort friend from foe. The technology changes every generation. The requirement never has.

Col John Boyd distilled this into the OODA Loop (Observe, Orient, Decide, Act), and it is no accident that Observe comes first. Every decision inherits the quality of the observation that feeds it. If your observations are late, incomplete, or wrong, the loop doesn’t just slow down. It compounds the error. You orient on a false picture, decide with false confidence, and act on the wrong problem. Garbage in doesn’t just produce garbage out. It produces confident garbage, at speed, which is worse.

Most people who reference Boyd fixate on speed, on “getting inside the adversary’s loop.” But speed is a product, not an input. The input is observation. The fighter pilot who sees first, wins. The watch floor that spots the first sign of an intrusion has options that the one who finds it three weeks later does not. Decision dominance starts with observation dominance. There is no shortcut.

One of the replies to my LinkedIn post pushed on an important nuance, and it deserves space here. Observation is not a clean camera feed. Boyd himself put Orientation at the center of the loop, shaped by our genetics, our culture, and our previous experiences. Our default orientation, built from everything we have seen and done, affects how we observe the world and each engagement with an adversary. Our decisions and actions also impact our future observations, keeping the loop alive for the entire engagement.

This is where the idea of the Bayesian brain aligns nicely with Boyd. Each turn of the loop updates our orientation, and the more reps we have, the better our predictions and the faster our loops. This is why experienced analysts seem to “just know” where to look. They aren’t psychic. They have turned the loop thousands of times, and their orientation has been refined by every one of them. It is also why we need to be honest about the flip side. An orientation built on bad assumptions will filter out the very observations that would correct it. If you have ever watched an organization miss an intrusion because “that system isn’t internet facing” or “we don’t have anything anyone would want,” you have watched orientation defeat observation.

Here is the uncomfortable truth. Most organizations don’t deliberately consider how they observe. They don’t know what data and information is important to what they are trying to achieve. They don’t think about how they collect that information, or what it costs to collect it. And they don’t think about how to sort through the noise to get to the signal.

I have walked into plenty of environments that were collecting everything and observing nothing. Log sources feeding a SIEM that nobody tuned. Alerts covering every screen in the SOC while the analysts sat with their heads down, trained by years of false positives to ignore them all. Plenty of organizations pay to collect and store data they never actually use, which is noise with a bill attached. That is not observation. That is hoarding.

Fixing this doesn’t start with a tool. It starts with three questions, asked in order:

Why?

What is the mission of your organization? What are you actually here to do? This sounds basic, but I have sat in rooms where the security team could not articulate what the business does to make money or accomplish its mission. If you can’t state your why, everything downstream is guesswork.

What?

What do you need to protect to fulfill that why? These are your crown jewels, your critical systems, your data that actually matters. Not everything is critical, and pretending everything is critical is the same as protecting nothing.

How?

How are you going to protect your what? Now, and only now, do tools, telemetry, and collection strategy enter the conversation. Your how should be a direct answer to your what, which is a direct answer to your why.

When you work the ladder in this order, your observation strategy builds itself. You know what data matters, because it maps to what you protect. You know what to collect, because it gives you visibility into those things. You know what is noise, because it doesn’t. And you can finally have an honest conversation about the cost of collection, because every log source either serves the mission or it is a bill you are paying out of habit.

When you skip the ladder, you get what most organizations have. Shelfware, alert fatigue, and a very expensive pile of data that answers no questions.

As folks who have been through this process, it is our responsibility to help those who haven’t. Too many people in our industry try to sell the newest widget instead of working with clients to understand their pains and giving them guidance on how to solve them. Even if it isn’t buying your widget. The organizations that achieve decision dominance are not the ones with the most dashboards. They are the ones where accurate, contextualized information gets in front of the right people in time to matter. Whether it is a watch floor spotting the first sign of an intrusion, an analyst trying to remember where they saw that IP before, or a leader deciding whether to wake people up at 0200 for a perceived incident, the loop turns on observation.

Observe deliberately. Orient honestly. Decide with confidence. Act.

That is the work. Everything else is downstream.

As I sit here working, and watching Hackers on the 30th anniversary of its release, I can’t help but feel nostalgic. I watch Hackers every year before DEFCON, and am always amused, that even though the visuals aren’t an accurate representation of hacking, the attacks themselves are. You see social engineering, OT hacking, reverse engineering, and more. It is fun to look back at a movie that shaped my career, and love of computers, the Internet and the chess game that is cyber security. 

There is something about this movie that makes me feel young again. When Razor and Blade come on and talk about Jolt Cola, I can still taste it. When Jolt Cola came back a few years ago I grabbed a bit to experience the memories again (even though I don’t typically drink soda). I have the soundtrack as part of my Hacking playlist, and when “Connected” by Stereo MC’s comes on I can’t help but dance in my chair. There are so many great memories aligned to this film.

In cyber security, I always find it interesting to hear what inspired someone get into the field. If it was a friend that showed them what they were working on, a movie or tv show, a book or some other path in. I have always enjoyed technology, and was lucky enough to have it around as I got into my formative years. I was also lucky to work at a telco startup (and many startups after that), and be able to get in with the information technology team which gave me access to many tools and mentors that helped me along the way. The movie Hackers inspired me through out with the knowledge that we are a community, and after spending the weekend at a wedding of some of my hacker family it still holds true. We are stronger than I.

I even made a shirt for DEFCON this year to honor the movie and the Gibson, which is a reference to one of my favorite authors (and the inventor of the word cyberspace).

So on its 30th anniversary, I raise a glass (or a can of Jolt) to the movie that taught me to see the world not just as it is, but as it could be — a place where a handful of hackers can change everything. Hack the Planet!

Now to get some popcorn and enjoy the rest of this movie. 

It wouldn’t be a holiday if a new vulnerability wasn’t released, causing IT and Cybersecurity practitioners to have to put their plans on hold to scan and patch their systems. I have spent more than my fair share of holidays at my desk, trying to make sure everything was resolved before I joined my family and friends in whichever festivities were going on.

We often speak about burnout at conferences, in blogs, and on podcasts, but we don’t always take the advice given, or have the opportunity not to work long hours when things go sideways. This isn’t always the case though. Sometimes we like to feel important, so we over emphasize an issue, letting everyone know how busy we are. How needed we are. And it is great to feel needed.

This can lead to unhealthy behaviors, and issues in your relationships (even with yourself). So the next time you see a vulnerability published just before a holiday, take the time to ask yourself, “Is this really something urgent, or do I just want it to be?” And depending on the answer, give yourself a break for the fire drill that is our lives sometimes, and enjoy some Fireworks or Eggnog with your tribe.

In the ever-evolving landscape of cybersecurity threats, one that remains constant is social engineering. Despite advances in technology and tooling, social engineering continues to pose significant risks to organizations. We’ve all witnessed the devastating impact that social engineering attacks can have on individuals, businesses, and even governments. It was top of mind with some recent breaches, so I wanted to delve into the nuances of social engineering and explore why it remains one of the most common threats we face in cybersecurity.

Here is a quick description of social engineering for those that are newer to cybersecurity. Social Engineering is a tactic used by cybercriminals to manipulate individuals into divulging confidential information, granting access to sensitive systems, or performing actions that compromise the individual or organization. Unlike traditional cyberattacks that exploit technical vulnerabilities, social engineering exploits human psychology. Whether through phishing emails, pretexting, or impersonation, attackers leverage social engineering techniques to exploit human trust, curiosity, or fear.

One of the primary reasons why social engineering continues to thrive is its adaptability and versatility. Cybercriminals constantly refine their tactics to bypass sophisticated security defenses and exploit human vulnerabilities. Phishing emails, for example, have evolved from crude, poorly written messages to highly convincing replicas of legitimate correspondence from trusted sources, like an email from your bank, travel agency or even a family member. These emails often employ psychological triggers, urgency, or fear-inducing language to trick recipients into clicking malicious links or downloading malware.

Moreover, the widespread adoption of social media platforms, like Facebook, LinkedIn, Twitter, and Instagram has provided cybercriminals with a treasure trove of personal information that can be leveraged for targeted attacks. By profiling individuals based on their online activity, attackers can craft tailored messages that appear genuine and convincing. This personalized approach significantly increases the likelihood of success, as people are more inclined to trust messages that align with their interests, or social connections.

Another reason why social engineering remains a top threat is the inherent human element. No matter how robust an organization’s technical defenses may be, human error or manipulation can circumvent most security measures. Whether it’s an unsuspecting employee clicking on a malicious link, or a well-intentioned individual divulging sensitive information over the phone, human fallibility creates opportunities for exploitation.

The COVID-19 pandemic expanded the threat landscape by creating new opportunities for social engineering attacks. With the widespread shift to remote work, employees are more reliant on digital communication channels, making them susceptible to phishing scams, business email compromise (BEC), and other social engineering tactics. Additionally, the uncertainty and fear surrounding the pandemic has heightened emotional vulnerabilities, making individuals more susceptible to manipulation.

As cybersecurity professionals, it’s important that we remain vigilant and proactive in our efforts to combat social engineering threats. Education and awareness training are vital components of any organization’s defensive strategy. By educating employees about common social engineering tactics, red flags to look out for, and best practices for safeguarding sensitive information, organizations can empower their workforce to recognize and resist manipulation attempts.

Implementing robust technical controls such as email filtering, multi-factor authentication, and endpoint security solutions can also help mitigate the risk of social engineering attacks. Regular security assessments, including simulated phishing exercises, can also help identify vulnerabilities and gauge the effectiveness of security awareness training programs. Though phishing exercises need to be done carefully, to educate employees and not punish them, so that the right lessons are learned.

To wrap this post up, social engineering remains a pervasive and real threat to organizations of all sizes. By understanding the tactics employed by cybercriminals, raising awareness among employees, and implementing comprehensive security measures, organizations can strengthen their defenses against social engineering attacks. As cybersecurity professionals, it’s our collective responsibility to stay ahead of the curve and safeguard against this ever-present threat.

In the ever-evolving landscape of cybersecurity, the concept of Zero Trust Architecture (ZTA) has emerged as an incredible buzzword, but also as a beacon of hope in the battle against sophisticated cyber threats. The fundamental premise of ZTA is to distrust everything, both inside and outside the organization’s perimeters, and to verify every user and device attempting to connect to the network before granting access. However, the journey towards implementing ZTA has significant challenges, and one of the most significant obstacles organizations face is the lack of visibility.

Visibility, in the context of cybersecurity, refers to the ability to monitor and understand all activities and traffic within an organization’s network, including user behaviors, device interactions, and data flows. It is the cornerstone of effective security operations, enabling analysts and engineers to detect anomalies, identify potential threats, and respond quickly to incidents. However, achieving comprehensive visibility has become increasingly difficult in today’s complex, and bloated cybersecurity environments.

The proliferation of cloud services, the adoption of remote work, and the rise of IoT devices have expanded the attack surface and blurred the boundaries of traditional network perimeters. As a result, organizations struggle to gain real-time insights into their digital assets and activities, making it challenging to enforce the principles of ZTA effectively.

Here are some key ways in which the lack of visibility impacts organizations’ moves to Zero Trust Architectures:

1. Incomplete Asset Inventory: This has been an issue for as long as I have been in the IT and cybersecurity space. Without full visibility into all devices and assets connected to the network, organizations cannot accurately assess their security posture. Shadow IT, where employees use unauthorized applications and devices, further complicates the situation. As a result, implementing ZTA becomes akin to building a fortress without knowing all the entry points.
2. User Behavior Analysis: Zero Trust relies heavily on continuous monitoring of user behaviors to detect and prevent unauthorized access. However, without visibility into user activities across different platforms and applications, organizations cannot effectively distinguish between legitimate users and potential threats. This lack of insight increases the risk of insider threats and credential-based attacks going undetected.
3. Network Traffic Monitoring: Effective ZTA implementation requires granular visibility into network traffic to identify anomalies and potential security breaches. However, the distributed nature of modern IT infrastructures, with data flowing between on-premises systems, cloud environments, and remote endpoints, makes it challenging to monitor and analyze network traffic comprehensively.
4. Data Protection: Zero Trust aims to protect sensitive data by enforcing strict access controls and encryption mechanisms. However, without visibility into data flows and usage patterns, organizations cannot effectively identify and classify their critical data assets. This blind spot hampers their ability to apply appropriate security controls and encryption measures, leaving valuable data vulnerable to theft or manipulation.
5. Incident Response: Timely detection and response are essential components of any ZTA strategy. However, without real-time visibility into security incidents and breaches, organizations struggle to contain and mitigate the impact of cyber attacks effectively. Delayed or inadequate incident response can result in prolonged downtime, financial losses, and reputational damage.

Some Ideas to Address the Visibility Gap:

To overcome the challenges posed by the lack of visibility and facilitate the successful implementation of Zero Trust Architectures, organizations must adopt a holistic approach to cybersecurity that integrates advanced technologies, robust processes, and skilled personnel. Here are some strategies to consider:

1. Comprehensive Endpoint Protection: Deploy endpoint detection and response (EDR) solutions to gain visibility into endpoint activities and behaviors. Implementing advanced threat hunting capabilities can help proactively identify and mitigate potential threats before they escalate.
2. Network Traffic Analysis: Invest in network monitoring tools that provide deep packet inspection and behavioral analytics capabilities. By analyzing network traffic patterns and anomalies, organizations can detect and respond to suspicious activities in real-time.
3. User and Entity Behavior Analytics (UEBA): Leverage UEBA platforms to analyze user behaviors across multiple IT systems and applications. By establishing baselines of normal behavior and flagging deviations indicative of potential threats, organizations can enhance their ability to detect insider threats and account compromise.
4. Data-centric Security: Implement data loss prevention (DLP) solutions to classify and protect sensitive data wherever it resides. Encrypt data both at rest and in transit to ensure confidentiality and integrity, regardless of the visibility into underlying network infrastructure.
5. Continuous Improvement: Regularly assess and update security policies, controls, and technologies to adapt to evolving threats and business requirements. Foster a culture of cybersecurity awareness and collaboration across the organization to empower employees to play an active role in defending against cyber threats.

While Zero Trust Architecture offers a promising shift in cybersecurity, its effectiveness hinges on an organizations ability to leverage visibility into their environments. By addressing the visibility gap through a combination of technology, process, and skilled personnel, organizations can strengthen their security posture and navigate the complexities of today’s threat landscape with confidence.

Remember, in the realm of cybersecurity, what you can’t see can hurt you. Embrace visibility to illuminate the shadows and move towards a more secure future.

As I prepare for another year of BlackHat and Defcon, this being the 15th year or so that I have attended, it has a completely different feeling than previous years. Last year, when the COVID pandemic was still in full swing, the conferences went virtual and I was relieved that both conferences were taking it seriously. I wanted to be onsite with my friends and hacker family, but it was the right thing to do to remain virtual and wait for the next year when we could be together.

Now we are in another upswing of the COVID pandemic, after it has started to tail off, and both conferences are in a hybrid mode. I scheduled myself to be onsite, after being vaccinated and taking extreme precautions for the last 18 months. I keep telling myself, I am taking the precautions necessary to attend and be safe. I am vaccinated, wear a mask, and have plenty of hand sanitizer. I still have concerns, but my desire to see my hacker family is overriding my fear.

With the time I have had to prepare, I think that I will be safe, but understand the number of folks that are cancelling their trips. Everyone needs to do what they feel is right, and with the COVID numbers spiking around the country, it is hard to feel safe anywhere.

So, this year at Defcon, will be like no other year, and hopefully like no future year. I will be in person, meeting up with the folks that are still going to be in person, and giving elbow bumps when appropriate and missing the folks that aren’t there with us in person, though I know they are there in spirit.

Hopefully next year we will be through the spikes of this pandemic and can all be together in person. Until then, Hack the Planet!

As the clock struck 00:00 on January 1st, 2021, I felt a sense of hope. The year 2020 will be in our history books as one that tested the human spirit, and saw the best and worst of mankind. From a global pandemic, to some of the largest, and most high profile hacks, how could 2021 not be better? Well, I guess this is where the hold my beer meme should go.

Within a week we are not just talking about hacks, or politics, but full blown insurrection in the USA. When the armed mob of right wing domestic terrorists stormed the Capitol, it put an end to the idea that 2021 would be the gentler year that the previous. There continues to be more and more information being released on this attack on democracy, so we will see what these next few weeks bring.

One of the threads on this attack that has received attention on the InfoSec Twittersphere is that there were many unlocked workstations in pictures taken by the insurrectionists, and a laptop was stolen that may have included sensitive information. While there were a lot of takes on this, Jack Daniel made the most important one, pointing out that the safety of the people was the priority. We can sit back behind our keyboards thinking, “If an angry mob was storming my building I would definitely lock my workstation”, but let’s not kid ourselves, we would be fleeing.

There are measures that can be taken to get the human out of the loop, and with our threat model severely modified after the Capitol attack, here are a few to think about. Faster inactivity locks, so that if you aren’t actively working on the computer it will lock itself in a shorter time frame. This isn’t perfect, but it is easy and low impact. There is also proximity devices, that automatically lock a computer once the device is out of range. There are other options as well, and I am sure we are going to see them becoming more normal after Jan 6th.

When we look forward to the rest of the year, I think it is important to make sure we are trying to find ways to make security easier, to make it a default state.

Stay safe out there.

I have not kept up with my writing as much as I would have liked, and I thought maybe with a world changing pandemic I would finally find the time. Well a few months into social distancing and I am just now sitting down to write. #covidlife

It seems like a long time ago, but it was just March when I had my wings clipped and was no longer traveling. At the time admittedly I didn’t think it would be too long until I was back in the air and to business as usual. Now I see that we will won’t be going back to “usual”. It is good though, because we can find a better way to move forward and not rely on doing things a certain way “because that is how it has always been done.”

There have been many blogs and write-ups on how to work in our new, fully remote environments. We weren’t great at defending our networks when they were within our walls. Just looking at all of the breaches we’ve suffered tells us that much. How were we going to handle going remote?

Well, luckily George at Splunk put together a nice list of things we can do today to help protect our workers and our organizations while we adjust to this brave, new world of work. From monitoring our endpoints, to monitoring who is moving data they shouldn’t, it is a good guide for those that are looking for something that they can start doing today.

Dark Reading also put out an article on patching in a pandemic. Many of the ideas, like making sure you have a solid asset inventory, and patch prioritization are things that I think we should have been doing before we were thrust into this remote world world. Sadly, I think this has shown many that the IT Emperor had no clothes, and we are being forced to change our behavior and really start protecting our orgs because the light has been shined on us.

As we all work together on this journey, let’s remember that this is a trying time for everyone. So be kind, be safe, and Hack the Planet!