Parabellyx Cybersecurity

Happy Diwali to our teammates, customers, partners and friends!

Why do vulnerabilities come back from the dead? Every morning, I wake up to my LI feed full of stupid memes about vendors whose security vulnerabilities have come back from the dead. Yet, I haven't seen many people ask the how and why questions. While it is sometimes true that a fix is not broad enough to address the root cause, in many cases, those are entirely new vulnerabilities.   Most of these vulnerabilities are not due to a vulnerable 3rd party component - those are results of code weaknesses, whether standalone or chained, exploited to a spectacular result. Security researchers know too well that in complex applications, those code weaknesses tend to cluster – where there is one, there are likely more. This assumption greatly simplifies the job of looking for additional vulnerabilities. Why does the clustering occur? The team that is writing the code, tend to repeat the same security shortcomings across the entire application if not caught and corrected early on. This is very similar to poor hygiene – even after you discover that what you do is bad for your health – you continue doing it due to a force of habit. Why is this so hard to fix? Because conducting a full code review after the fact and correlating the hundreds of code weaknesses to actual application vulnerabilities, especially where chaining is required, is not an easy, and mostly manual task. Avoiding these situations is exactly why you should start with software development security at the inception and avoid getting into a habit of “risk managing” rather than remediating the code weaknesses.

Wishing our employees, customers, partners, and friends a very Happy Thanksgiving!

What a fantastic night! Thank you to all the extraordinary cybersecurity leaders who joined us at the inaugural CISO Open Mic Toronto event. We had over two hours of sessions, dialogues, and collaboration on subjects ranging from third-party risk management to OT security challenges! Thank you, The National Club, for having us and to CyberPlayback, CrowdStrike, Immersive Labs, LightBeam.ai, Palo Alto Networks, Parabellyx Cybersecurity, and Phelps for organizing and supporting the event. The next CISO Open Mic in Toronto will be held in early 2025. The date will be announced in a few weeks. #CISOOpenMic2024 #CISO

Two more days until the inaugural CISO Open Mic in Toronto. Don't forget to register https://lnkd.in/diYrG8kr

Cybersecurity has a lot to learn from political and military strategy. One of the most valuable lessons comes from the late Andrew Marshall, who ran the Office of Net Assessment at the Pentagon for over 40 years until his retirement in 2015. Before the creation of the Office of Net Assessment, the Pentagon’s and the US's strategy to counteract the communist threats was to understand the military capabilities of the adversaries (USSR / China / North Korea) and procure the right tools and manpower to counter those. Andrew Marshall came up with a different strategy. Instead of being reactive, he advised developing the capabilities that would be extremely expensive for adversaries to counteract. In came advances in guided missiles, computer developments, silent submarines, and undersea surveillance systems. All of these contributed to ballooning Soviet military budgets in the 80s, eventually leading to economic collapse. Our current cyber strategies are akin to the Pentagon “shopping list” prior to the creation of the Office of Net Assessment. We buy costly solutions to counteract attack methods that are relatively inexpensive to execute. If you want to turn the tables, you need to make the attacks more expensive to perform. One of the first items on your to-do list should be continuous testing – application, infra, and processes. Elimination of easily exploitable weaknesses is your number one tool for economic warfare against all types of hackers.

Join us at this amazing event. Limited spots available .. please reach out to Alexander Poizner🌸 or myself..

Do you have what it takes to win one of six #CISO Open Mic awards? Topics for talks have been posted.