Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Zack Tollman
How network professionals deal with attacks and disruptions
Reliability and response time are always pressing concerns for internet services. We’ve known for a long time that people on desktop or laptop computers have scant patience for slow websites, and the growing move to mobile devices makes the demands on internet services even worse.
Strengthen your digital defenses with AI and supervised machine learning
In the context of security, there are many discussions on how artificial intelligence (AI) and machine learning (ML) can be leveraged for malicious purposes. For example, in the recently released report The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation, you will find a list of scenarios where AI and ML have the potential to be used to attack business assets physically, politically, and digitally.
Stephen Gates on the growing risks posed by malicious bots
In this episode of the O’Reilly podcast, I spoke with Stephen Gates of Oracle Dyn. Gates joined the Oracle Dyn Global Business Unit from Zenedge, the web application security company recently acquired by Oracle. Gates and I discussed how growing malicious bot activity impacts organizations. Here are some highlights: One of the factors driving the current proliferation of malicious bots is the Mirai malware.
Modernizing cybersecurity approaches
Cybersecurity incidents are among the greatest concerns of businesses, government agencies, and private citizens today. In the modern world, protecting our data and information assets is nearly as important as maintaining the security of our physical assets. It should not be surprising, then, that data analytics play a key role in cybersecurity.
How to tune your WAF installation to reduce false positives
Site administrators put in a web application firewall (WAF) to block malicious or dangerous web traffic, but at the risk of blocking some valid traffic as well. A false positive is an instance of your WAF blocking a valid request. False positives are the natural enemy of every WAF installation. Each false positive means two bad things: your WAF is working too hard, consuming compute resources in order to do something it shouldn't, and legitimate traffic is not being allowed to go through.
Choosing a tool to track and mitigate open source security vulnerabilities
Open source is amazing, and is here to stay, but it’s also a complicated beast when it comes to ownership, trust, and security. Unlike purchased software, once you download an open source library you are on your own. There is no vendor to notify you about issues, no commitments that vulnerabilities will be found or fixed, and nobody to sue to if you got hurt. If you’re using open source (and you most certainly are), you need to take on the responsibility of keeping it secure.
Responding to new open source vulnerability disclosures
The techniques to find, fix, and prevent vulnerable dependencies are very similar to other quality controls. They revolve around issues in our application, and maintaining quality as the application changes. The last piece in the vulnerable library puzzle is a bit different. In addition to their known vulnerabilities, the libraries you use also contain unknown vulnerabilities.
Integrating continuous testing for improved open source security
Once you’ve found and fixed (or at least acknowledged) the security flaws in the libraries you use, it’s time to look into tackling this problem continuously. There are two ways for additional vulnerabilities to show up in your dependencies: To protect yourself, you need mechanisms to prevent vulnerable packages from being added, and to ensure you get alerted and can quickly respond to new vulnerability disclosures.
Mitigating known security risks in open source libraries
Finding out if you’re using vulnerable packages is an important step, but it’s not the real goal. The real goal is to fix those issues! This chapter focuses on all you should know about fixing vulnerable packages, including remediation options, tooling, and various nuances. Note that SCA tools traditionally focused on finding or preventing vulnerabilities, and most put little emphasis on fix beyond providing advisory information or logging an issue.
What defines a known open source vulnerability?
This is an excerpt from Securing Open Source Libraries , by Guy Podjarny. See the full report here . Open source software—the code of which is publicly available to scrutinize and typically free to use—is awesome. As consumers, it spares us the need to reinvent the wheel, letting us focus on our core functionality and dramatically boosting our productivity.
2017 O'Reilly Defender Awards
Allison Miller works in product management at Google, mitigating risks to Google and end-users. Prior to her current role, Allison held technical and leadership roles in security, risk analytics, and payments/commerce at Electronic Arts, Tagged.com, PayPal/eBay, and Visa International. Miller is a proven innovator in the security industry, and regularly presents research on risk analytics, cybersecurity, and economics.
Building a culture of security at the New York Times
Runa is the Director of Information Security for the Newsroom at The New York Times. She helped launch nytimes.com/tips in 2016 and has lead numerous digital security trainings to educate journalists about how to protect their data, communications and sources. She is an advisor to Freedom of the Press Foundation and a member of the review board for Black Hat Europe. more
An infinite set of security tools
Window Snyder is Chief Security Officer at Fastly. She previously spent five years at Apple working on security and privacy strategy and features for OS X and iOS. A security industry veteran, Ms. Snyder was the Chief Security Something-or-Other at Mozilla, responsible for security engineering, communication, and strategy. As a senior security strategist at Microsoft, she owned security sign-off for Windows and the outreach strategy for security vendors and security researchers.
The Dao of defense: Choosing battles based on the seven chakras of security
Katie is the founder and CEO of a new security start-up company called Luta Security, where they specialize in helping businesses and governments work with hackers to better defend themselves from digital attacks. Katie is a noted authority on vulnerability disclosure & bug bounties. Katie advises companies, lawmakers, & governments on the benefits of hacking & security research to help make the internet safer for everyone.
Great software is secure software
Chris Wysopal, co-founder and chief technology officer of Veracode, is responsible for the security analysis capabilities of Veracode technology. Mr. Wysopal is recognized as an expert and a well known speaker in the information security field and was recently named one of InfoWorld's Top 25 CTO's and one of the 100 most influential people in IT by the editorial staffs of eWeek, CIO Insight and Baseline Magazine.
Enterprise security: A new hope
Haroon Meer is the founder of Thinkst, the company behind the well loved Thinkst Canary (https://canary.tools). Haroon has contributed to several books on information security and has published a number of papers on various topics related to the field. Over the past decade (and a half) he has delivered research, talks, and keynotes at conferences around the world. more
Highlights from the O'Reilly Security Conference in New York 2017
Defenders from across the security world are coming together for the O'Reilly Security Conference in New York. Below you'll find links to highlights from the event. Chris Wysopal explains how defenders can help developers create secure software through coaching, shared code, and services. Katie Moussouris explains how to turn the forces that resist defense activities into the biggest supporters.
Why cloud-native enterprise security matters
Matt is a technical product manager at Pivotal. He is a 15 year veteran of the enterprise IT industry, with experience spanning numerous business domains.
Empowering through security
"Flee" is the Head of Information Security at Square. He has a history of solving security problems for a range of organizations all the way from large enterprises (Bank of America) to small startups (Twillio). He's experienced in building and leading global security teams and specializes in application security. He's passionate about all things security, but finds time to indulge in other hobbies including road cycling, mountain biking, rock climbing, snowboarding, backpacking, and photography.
Harnessing the power of conversational interfaces in security
I recently sat down with Bobby Filar and Rich Seymour, Senior Data Scientists at the Endgame, to discuss the benefits, challenges, and value of using a chatbot interface in modern security operation centers. In talking with SOC managers, they breakdown challenges into three distinct areas. First, they lack sufficient staffing personnel resources. Everyone is well aware of the workforce shortage, and so recruiting and retaining quality, experienced personnel is difficult.
Criminal cost modeling
Register for the O'Reilly Security Conference 2017 in New York, October 29-30. In this full conference talk from the O'Reilly Security Conference in New York 2016, Chris Baker shows how we can mitigate platform abuse by reducing a criminal's profitability of common attacks.
Speak security and enter
Register for the O'Reilly Security Conference 2017 in New York, October 29-30. In this full conference talk from the O'Reilly Security Conference in New York 2016, Jessy Irwin provides real-world, actionable strategies for positive, proactive security education that will help build bridges with nontechnical colleagues and stakeholders.
Recognizing and evaluating scientific claims in security
I recently sat down with Josiah Dykstra, Senior Security Researcher at the Department of Defense, to discuss the topics of both accidental and intended misleading communications in security, common pitfalls made in evaluating scientific claims, and the questions you should ask when evaluating scientific claims and third-party vendor solutions. People and companies use a variety and spectrum of truly scientific, possibly-scientific, and unscientific statements to talk about products and services.
Kelly Harrington on the current state of web malware.
Register for the O'Reilly Security Conference 2017 in New York, October 29-30. In this full conference talk from the O'Reilly Security Conference in New York 2016, Kelly Harrington discusses the current state of web malware, what Google is doing about them, and how other defenders can leverage the SB APIs to protect their own end users from malware, phishing, and deception on the Web.
Improving security through data analysis and visualizations
I recently sat down with Charles Givre, Data Scientist currently, to discuss the characteristics of successful security analytics programs, principles for effective data visualizations, and how effective data visualizations can reduce response time. Here are some highlights from our talk. In my opinion, it isn’t enough for a company to simply have a security analytics program.
Announcing the Rebecca Bace Pioneer Award for Defensive Security
In her keynote at O’Reilly Security Conference in New York 2016, Rebecca “Becky” Bace shared her vision for the future of cybersecurity. Within her talk, Becky encouraged defenders to study analogous safety industries in history and heed the lessons learned. She urged defenders to recognize the importance of understanding the context of the challenges we face today by considering historical parallels and our shared goals for the future.
Operationalizing security risk
In this full conference talk from the O'Reilly Security Conference in New York 2016, Bruce Potter outlines the necessity of risk assessment and presents a pragmatic risk assessment process that you can use immediately to do your own assessment.
A human-centric trust model for the Internet of Things
For IoT security to be successful, there needs to be an effective way to reason about how humanity can trust the security, safety, and privacy of this massive transformation of the world. Most importantly, “ordinary people,” whether they are consumers or workers, must be able to safely, reliably, and intuitively interact with vast, complex, interconnected systems of IoT devices.
Fast and safe frontend fixes
Security and Performance are both considered to be two separate goals, as one can often negatively impact the other. We see various security solutions — whether implemented at the frontend or backend — slowing down the performance of sites. And vice versa: we see certain performance techniques leaving sites more vulnerable to security threats. In the face of these challenges we need to make sure that our sites are adapting to the needs of the customers.
Balancing frontend security and performance with HTTP Strict Transport Security
As an industry, we’re seeing a trend towards more secure end user experiences. Service workers and HTTP/2 working strictly over HTTPS demonstrates this movement. Additionally, Google announced in late 2015 that their indexing system would now prefer indexing HTTPS URLs over HTTP URLs to motivate developers to move to HTTPS.
The economic rationale for insecure software
This is a highlight from Fernando Montenegro's talk The economics of cybersecurity. What the full version of this talk on Safari.
What are some common pitfalls when using enterprise cloud computing solutions?
Cloud computing has taken the world by storm due to its reliability, low cost, and ease of access. However, this level of accessibility also provides plenty of opportunities for data leakage. Follow along with Ric Messier as he outlines some of the potential security pitfalls that enterprises could encounter when using popular cloud services. After watching this video you will be able to: Get 10 days of access to network and cloud security training on Safari.
How can multi-factor authentication protect your cloud computing accounts?
The protection that passwords alone offer your enterprise data is weak at best. When choosing a cloud computing service, security should be a primary consideration. Ric Messier explains how multi-factor authentication protects cloud-stored data from attacks and offers some tips on which services currently offer this feature. In this video, you will learn how to: Identify the different types of authentication factors. Explain the importance of multi-factor authentication in protecting information.
How to build your own threat intel data model
This is a highlight from Grecs' talk Hello to the dark side: Understanding your adversaries without all those expensive threat intel tools. What the full version of this talk on Safari.
WIRED Had a Potential Infosecurity Problem. Here’s What We Did About It.
On February 26th, WIRED’s security reporter Andy Greenberg received an email from Sophia Tupolev, the head of communications at the security firm Beame.io, saying she’d found a security issue on WIRED.com. Tupolev’s company had discovered sensitive data in the source code on many pages on our site, including obfuscated, “hashed” passwords and email addresses for current and former WIRED writers. We corrected the problem right away.
A vision for future cybersecurity
This video was originally recorded in November 2016 at the O'Reilly Security Conference in New York. Visit Safari for full access to sessions, training, and keynotes from this event.
Know-nothing authentication
I was intrigued by an article about behavioral authentication on the Fast Forward Labs blog. Behavioral authentication is a kind of biometric authentication based on aspects of your behavior: timings while typing, for example, but conceivably much more fine-grained, like whether your fingers are centered on the touchscreen's virtual keys when you press them, how hard you press, how you perform multi-fingered gestures, and much more.
Optimizing IOC-based detection with data science
This is a highlight from Alex Pinto's talk Beyond matching: Applying data science techniques to IOC-based detection. Visit Safari to view the full session from the 2016 O'Reilly Security Conference in Amsterdam.
4 ways to harden Microsoft Windows infrastructure
Public and private infrastructures both small and large across the world use Microsoft, despite it being the bane of many security professionals’ existence. It is by far the most widely used operating system and also the most commonly misconfigured. Misconfigurations in Windows operating systems and software contribute to a vast number of security issues and compromises. In fact, Exploit Database currently has over 8,000 exploits running under the Windows platform.
Hacker quantified security
In this session highlight from the O'Reilly Security Conference in New York City 2016, Alex Rice explains the benefits of working with hackers and measuring what you learn. Watch the full version of this session on Safari. You can also access additional sessions and keynotes from the event.
Compliance as code
This is an excerpt from "DevOpsSec: Securing Software Through Continuous Delivery," by Jim Bird. Read or download the full ebook for free. DevOps can be followed to achieve what Justin Arbuckle at Chef calls “Compliance as Code”: building compliance into development and operations, and wiring compliance policies and checks and auditing into Continuous Delivery so that regulatory compliance becomes an integral part of how DevOps teams work on a day-to-day basis.
Automating XSS detection in the CI/CD pipeline with XSS-Checkmate
Integrating cross-site scripting (XSS) tests into the continuous integration and continuous delivery (CI/CD) pipeline is an effective way for development teams to identify and fix XSS vulnerabilities early in the software development lifecycle. However, due to the nature of the vulnerability, automating XSS detection in the build pipeline has always been a challenge.
5 trends in defensive security for 2017
When we started planning the inaugural O’Reilly Security Conference, we did so with a unique focus on defensive security. There are many excellent researchers and leaders working to solve the problems of security today, but what we wanted to do was to get down to the nuts and bolts of building better defenses across the board. The Security Conference and our newsletter have received an enthusiastic welcome from our audience—the defenders.
The state of Linux security
In the last 10 years, GNU/Linux achieved something some foresaw as almost impossible: powering both the smallest and biggest devices in the world, and everything in between. Only the desktop is not a conquered terrain yet. The year 2016 had an impact on the world, from both a real life and digital perspective. Some people found their personal details leaked on the internet; others found their software being backdoored. Let’s have a look back on what happened last year regarding Linux security.
Ransomware: When to pay (and when not to)
Ask any security professional whether or not a victim should pay the ransom, and the answer will almost assuredly be a loud no. Unfortunately, as covered briefly in Chapter 1. Introduction to Ransomware, in the wake of a ransomware incident, the answer can be more complicated and may depend on the amount of advanced planning the organization has done. Before diving any deeper into this topic, take a step back and remember what ransomware does.
Better security starts and ends with humans
O'Reilly's Mac Slocum speaks with Scout Brody, Executive Director at Simply Secure. They discuss: How an interest in the intersection of society and technology moved her into security. (00:04) Brody asks: "If we aren't building systems that are meeting the needs for the humans, why are we building systems at all?" (01:02) Why security developers need to get outside of the security bubble.
Threat intelligence and ransomware
Threat intelligence is a great guide to responding to the continuous evolution we see attackers undergoing today as part of their criminal schemes. Simply put, by understanding the types of attacks your peers and partners are experiencing, you can learn about what you should be looking for on your network and in your information systems.
Strengthening defenses against human-centric vulnerabilities
I recently sat down with Andrea Little Limbago, chief social scientist at Endgame, to discuss how social scientists can help with an organization’s overall security strategy, tips for integrating data scientists into security teams, and thoughts on improving human-machine interactions. Here are some highlights from our talk. I entered security via the national security path. I have a PhD in political science, focusing on international relations and quantitative methodologies.
"The Internet is going to fall down if I don't fix this"
O'Reilly's Mac Slocum speaks with Susan Sons, Senior Systems Analyst at the Center for Applied Cybersecurity Research at Indiana University. They discuss: Why Susan gravitated toward security (it all started when she broke into a computer at four years old). (00:04) Her work to fix the Network Time Protocol (NTP), an essential part of the Internet's infrastructure. "It was just a moment of panic," she said, recalling her first evaluation of the NTP.
Security application deployments in CI/CD environments
Security application deployments in CI/CD environments Binu Ramakrishnan highlights current security risks and CI/CD threat modeling and presents security patterns-based techniques to mitigate these risks, including a novel idea called auth events to delegate user privileges to CI/CD workflow jobs. November 22, 2016 This video was originally recorded in September 2016 at the O'Reilly Velocity Conference in New York. Article image: Lights (source: carloroberto9 via Pixabay).
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Zack
Contact Zack, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack