Nice | HySecurity’s Post

It looks like I just got issued my updated Fortinet certificates: FCF, 2x FCP and FCSS. The reason behind the new certificates is that Fortinet have restructured their NSE certification program, which goes into effect from today. It's now more modular with different possible tracks from FCF to FCX instead of the old linear NSE1 to NSE8

GIAC Certification holders like to earn their CPEs a multitude of different ways. What do you find to be the most impactful way to earn CPEs? https://lnkd.in/e72wrpGU Tell us below in the comments ⬇️ #CertifyGIAC #GIAC #GIACRenewal

Another certificate down! It took a short bit to become acclimated with the DHS Trusted Tester website, but I believe that I have found a very efficient way to navigate the site using the NVDA screen reader. Now that I have a good flow, it's full sail ahead. #a11y #accessibility #accessibilityforall #learninganddevelopment

Looking through the RSA sessions, I thought Jennifer Czaplewski's on Tuesday could be very relevant for my Appsec/DevSecOps network. It's called Reducing Toil in Your AppSec Program. "Toil is not just "work developers don’t like to do," toil is work that is boring, repetitive, and does not add value. If left unchecked, the practice of application security becomes rife with toil. This session will provide strategies to reduce application security toil, focusing on practical actions from experiences in large enterprises and start-ups."

Part 4 of an 11 part series on #ACL concepts! In this video, I continue (from Part 3) to explain more about wildcard masks, and how they apply to Access Control Lists (ACLs).

All of our security and verification systems are built around very specific intuitions about things humans can do that machines cannot (& we are still fooled lot). We are very unready for how LLMs will overwhelm these systems. This example of AIs being enrolled in college courses to get grant money is one of many examples we will soon see. https://lnkd.in/e_bT35_U

The consequences of AI in the wrong hands and with the wrong intent are going to be huge. The problem is that it’s done, and it’s out there, and the genie can’t be put back in the bottle. What’s clear from most of these examples I’m reading is that the laws are already there to stop it - but the infrastructure isn’t there for the scale of the potential problem, and the speed of the criminals.

This is a useful view into the #airisk surface. The malfeasance occurs where there are insufficient controls and tests to distinguish a human knowledge agent from an artificial one. The story goes to the importance of #identity as a public good: ordinarily we think of identity about the individual but here it is direct financial loss to the organisation. What's more there is crowding out of human talent, a dent in the #innovation curve and yet more opportunity cost. Yes, this is the race to the bottom and a future akin to the film Idiocracy. Note these scams do have remedy as they are variants on mail fraud, but that won't return the money nor address all the above costs. If now already, folk should turn their minds to reconsidering how to quality assure their funding validation and certification processes

“The scam is for some mastermind to register a fake student to collect financial aid, enroll that spambot student in courses, and let AI handle submitting some of the assignments. This allows the person behind the spambot to collect financial aid money for as long as the spambot is enrolled in the course.” This type of #fraud isn’t limited to educational institutions, but could also be applied to other industries such as insurance. User authentication has always been a #security challenge, and #AI -powered spambots add even more considerations. Undertrained and overworked humans are now tasked with identifying and escalating suspicious behaviors.