Ed Bailey retweeted
Software engineering != Software development
Engineering was never about writing code. That was the means to the end.
Engineering is using judgment to pick the right tradeoffs to solve a problem given a set of constraints.
Construction is the commodity. Judgment isn't.
Ed Bailey retweeted
If you don’t control how the data is stored on disk you will never be able to offer the user the experience they demand.
Ed Bailey retweeted
The reason these "throw everything at once" style agentic cyberattacks work is because most orgs are chronically terrified of deploying deterministic detection + remediation automations.
Most security products have a "lock out this account" or "disconnect this system" or "block this IP" options that you can set if certain alerts are triggered. But because business function takes precedent, most orgs would rather risk a successful intrusion than an accidental disruption.
There's no reason to believe that "agentic defenders" would be a viable solution. Defenders need to consume many times more context/signals that attackers do, therefore by nature are slower. Defenders win on controlling the playing field, not out-maneuvering attackers like it's some Hollywood style fighter jet battle.
In the same way that reactive human defenses are slower than human offense, reactive AI defense are slower than AI offense (and regular old deterministic automations, too). The whole "fight AI with AI" thing is pretty ridiculous and misunderstands what good defense looks like.
The only answer is proactive defense + fast deterministic detection & response. But nobody is ready for that talk yet, so we're probably just gonna do like 10 years of "agentic AI SOC", until everyone runs out of money and/or figures out it doesn't work.
Ed Bailey retweeted
Tallahassee promised tax relief. City halls must decide what stops getting funded.
State-projected annual losses in FY2028–29 equal 30% of Palm Bay’s FY2024 general fund, 25.7% of Davenport’s and 25% of Deltona’s.
Police and fire generally consume about half a city’s general fund. Protect them, and the shortfall falls entirely on the other half unless replacement revenue is raised. Against that budget baseline, those losses equal 60%, 51% and 50% of everything else: roads, drainage, parks, libraries and inspections.
Growth brings revenue, but also people who need services. Beginning in 2029, the exemption grows with inflation while service costs keep climbing. You cannot spend the same growth dollar twice: replacing lost revenue and serving new residents.
Raise fees, and residents pay another way. Cut services, and they feel it another way. The campaign promised savings. The budget will name the consequences.
As usual, @anton_chuvakin did excellent work. I hear the statement, “I don’t want a SIEM” all the time, but when I ask if they want to detect and respond to threats, the answer is yes.
Working through this has led me to think people don’t want a monolithic SIEM, but they still want all the outcomes. I get it; what SIEM represents today is a giant pain in the ass. An actual four letter word.
We need a new name to change the focus and not get hung up on the word. I want a distributed or decoupled SIEM, but I'm looking for a new term for it.
Thoughts? Being creative isn't my thing, and I need help.
"I replaced a food fight joke with a pillow fight joke, specifically." medium.com/anton-on-security…
Ed Bailey retweeted
Before you do agent activity anomaly detection, perhaps inventory your agents first? #random
Ed Bailey retweeted
Please read my story about how I made a friend by meeting @DavidAFrench's Twitter critic.
(I almost wrote his 'biggest critic,' but I didn't want to offend some of you who are vying for that title.)
nancyjaynefrench.substack.co…
Ed Bailey retweeted
My book Dynamic Incident Response is available on Amazon now for print and Kindle - dynamicincidentresponse.com/
I've set the prices at the lowest Amazon allows. Any proceeds I'll donate to a charity. (Currently $11.23, but fingers crossed.)
Please comment and rate on Amazon, TY!
Ed Bailey retweeted
I MADE IT! ❤️🙏🏾
This morning started with heartbreak after waking up to find my van broken into, two windows shattered, and two lawnmowers stolen. For a moment, I thought I wouldn’t make it to the Louisiana Book Festival. But I reminded myself that one bad moment doesn’t have to ruin an entire day. Despite everything, I made it! Standing here surrounded by the five children’s books I’ve worked so hard to bring to life means more to me today than ever before. They may have taken my lawnmowers, but they couldn’t take my joy, my purpose, or my determination. Thank you to everyone who reached out with love and encouragement. Today, I’m choosing gratitude over frustration. ❤️
Ed Bailey retweeted
The Vulnpocalypse - Good News and Bad News
- The bad news is we are inundated with new vulnerabilities due to the increased volumes discovered by AI tooling.
- The good news is many organizations are starting to handle this with increased speed, prioritization, and existing methods of defense in depth.
- The bad news is there are also many organizations not doing this, and worse, are sitting on a whole ton of software, configuration, and structural/policy vulnerabilities from prior years.
- The good news is many of these targets have not been exploited due to attacker’s resource constraints.
- The bad news is that this might not hold as attackers industrialize their capabilities to turn more targets of opportunity into actual victims.
- The good news is, apart from scams, crypto/Web3, and some parts of the ransomware kill chain, it appears that such industrialization is not helping monetization (yet).
- The bad news is attackers are an innovative bunch and not likely to give up and go set up a bakery, or go back to drug dealing. Besides, chaos may still ensue as agent swarms simply exploit vulnerabilities anyway.
- The good news is defenders can use all this AI capability for defense. We are seeing the potential that many significant code bases will have dramatically lower vulnerabilities levels than ever before due to the “deep cleaning” (h/t @argvee) with the very same tools we are concerned attackers will use.
- The bad news is getting a code base “clean” doesn’t mean the updated packaged software will arrive quickly in all the places where attacks will target.
The good news is……..?
philvenables.com/post/the-vu…
Ed Bailey retweeted
I think the era of rapid detection and response to keep incidents small & contained is going to draw to a close with agentic attacks.
We’re going to have to security engineer our way forward instead. Limit blast radius by design. Brilliance in the basics. It will be more about hardening and configuring what you have (which is hard and slow and boring) vs. reaching for some shiny new product that will solve all your issues
Ed Bailey retweeted
Tyrese Maxey on whether he changes his baby's diaper:
"I'm a big diaper changing guy. I take pride in the speed that I'm able to change a diaper and keep her from crying. So I'm a big diaper change guy, big feed guy, big nap guy. I'm all of it, wake up in the middle of the night, go get it. I do it all man. I try to cherish these moments, cause it feel like already now she trying to crawl and do different things. So she's already moving too fast for me"
Changing the subject slightly and I am sure this makes me the simpleton here. Why use the term ‘invariants’? I am a fan of simple clear language and I am not sure this is a good way to communicate something important. Seems something basic like ‘standard’ might work better. @anton_chuvakin
Ed Bailey retweeted
When it comes to real tasks that IT and Security practitioners undertake, you can see open weight outperform on both performance AND price.
This quoted post is unavailable.
Ed Bailey retweeted
Somewhere in Bavaria, a 900 year old bloodline just ended because a man in a suit decided to baptize a woman's feet with a pint of lager.
Security teams need on-demand access to non-traditional security data.
This week’s security drama stressed already overworked SOC teams. It’s one thing to have SIEM content for php2shell; it’s another to have the right data so the detection actually fires.
So many teams I worked with last week didn't have the right logs and were frustrated by the process of getting them quickly.
I encourage teams to pre-wire their environment so it's easy to get what you need on demand. Call it adaptive logging: baseline logging all the time, with the ability to turn on new logging with an API call into @cribl_io Stream and Edge. This gives you access to what you need, when you need it, without paying the ‘logitall’ price every day.
Access to the right data now gives you the coverage needed to understand the scope of exposure to the latest issue. BTW, this is not slowing down.
cribl.io/blog/from-cve-to-co…
Ed Bailey retweeted
Charlize Theron completely destroys Zach Galifianakis on Between Two Ferns
She leans in and whispers:“My thighs are so sweaty right now… it’s dripping all the way down to the back of my knees.
The only thing that could cool me off is to jump naked into a pool.”Zach: “Are you asking me to go with you?”Charlize:
“The image of me and you… me naked in a pool with a fat garden gnome.”Zach’s final line:
“I hope your dog dies.”
“I just pissed myself.”
Ed Bailey retweeted
Project Swarm from @GreyNoiseIO let's you get ground truth on exploitation in the wild. You can deploy your own honeypots to collect reconnaissance, exploitation, and post-exploitation artifacts. It's a dollar.
greynoise.io/project-swarm
