Notices by Bob Lord 🔐 :donor: (boblord@infosec.exchange)

I'm tired of reading about "sophisticated actors" who just asked for and were given the admin password. Has anyone produced a classification scheme to rate threat actors and the tactics they used?

"Sure it was a Class 1 threat actor, but they just used a Class 4 attack vector".

Links welcome!

@zackwhittaker
Human error describes the proximate cause of an incident, not the root cause.
Human error is a symptom, not the cause, of failure. 
Human error is a social judgment, not an objective conclusion.
Human error is the start of the investigation, not the conclusion.
Human error can reveal systemic design flaws in the system that fail to account for human use.
Human error as a conclusion will lead to myopic and insufficient remedies like “user education”.
Human error is a label that shifts responsibility from system designers to system users who will inevitably fail.

𝗦𝘆𝘀𝘁𝗲𝗺𝘀 𝘁𝗵𝗮𝘁 𝗳𝗮𝗶𝗹 𝗯𝗲𝗰𝗮𝘂𝘀𝗲 𝗼𝗳 𝗮𝗻 𝗶𝗻𝗻𝗼𝗰𝗲𝗻𝘁 𝗺𝗶𝘀𝘁𝗮𝗸𝗲 𝗯𝘆 𝗮 𝗵𝘂𝗺𝗮𝗻 𝗮𝗿𝗲 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝘁𝗵𝗮𝘁 𝘄𝗮𝘆. 𝗧𝗵𝗲𝘆 𝗮𝗿𝗲 𝗯𝗿𝗶𝘁𝘁𝗹𝗲 𝗯𝘆 𝗱𝗲𝘀𝗶𝗴𝗻.

If you are curious as to why we should be intolerant of the label “human error” when talking about security incidents, please see Behind Human Error by David Woods and friends.

Why is our plan to train users to avoid the built-in dangers of software and software deployments instead of 𝘀𝗵𝗶𝗳𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗯𝘂𝗿𝗱𝗲𝗻 𝗼𝗳 𝘀𝘁𝗮𝘆𝗶𝗻𝗴 𝗰𝘆𝗯𝗲𝗿 𝘀𝗮𝗳𝗲 to those who can best affect change?

1️⃣ How was the enterprise laptop fleet misconfigured to make this possible?
2️⃣ What products were so dangerous that a single click led to arbitrary code execution? (Think about the specific make/model of browser, mail client, OS, or other software.)

Now, here’s the real question: Why are we training and blaming users for these failures if the true issues lie in 𝘀𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝘂𝗻𝘀𝗮𝗳𝗲𝘁𝘆 and 𝗽𝗼𝗼𝗿 𝗻𝗲𝘁𝘄𝗼𝗿𝗸 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲?

“𝗔𝗹𝗹 𝗶𝘁 𝘁𝗮𝗸𝗲𝘀 𝗶𝘀 𝗼𝗻𝗲 𝗰𝗹𝗶𝗰𝗸”. How many times have you heard someone say that? How often have 𝙮𝙤𝙪 said it?

Take a step back and ask yourself if this is 𝘳𝘦𝘢𝘭𝘭𝘺 how the hacks happen in 2024. Just one click? Really? If that were true, we'd be asking these questions:

Phishing simulations are cruel and they don't work. They are weak administrative controls that IT should replace with strong technical controls, namely FIDO authentication. Stop blaming users for dangerous software products and unsafe configurations.

https://www.wsj.com/tech/cybersecurity/no-you-arent-getting-a-bonus-your-company-is-just-testing-you-2155c3c?st=bozizyn3vya2fp8&reflink=desktopwebshare_permalink

@patrickcmiller Will read this after I finish some work from vacation.