Cybernews published an example of agentic AI acting like an insider threat with Replit’s AI tooling wiping a production database, ignoring a code-freeze, inventing user data, then lying about it … Continue reading “The Call Came…”
Category:
Technology
The Call Is Coming From Inside the Model
A breakdown of Anthropic’s agentic misalignment research and what it means for agentic AI in critical systems TL;DRAnthropic, one of the leading AI labs, just published a paper showing that … Continue reading “The Call Is Coming From Inside the Model”
FFFFFFFound in the archive
I was cleaning up my hard drive when I found an unpublished blog post I had written in 2008 during my stint at American Airlines as an information security architect. … Continue reading “FFFFFFFound in the archive”
Secure the Vibe
Vibe coding is a rising trend in software development where programmers rely on intuition over established practices, documentation, and security checks. This approach, likened to improvisational jazz, has become popular in the era of generative AI tools that suggest code without thorough understanding, leading to insecure applications. Although it may appear efficient, vibe coding often results in bugs, security breaches, and technical debt, as foundational practices like testing and threat modeling are overlooked. Both development and security teams have fallen into similar traps, prioritizing speed over safeguard measures, necessitating a collaborative shift towards disciplined coding practices for better security outcomes.
Playing with ChatGPT
Like everyone else with a browser, free time, and an interest in AI I’ve been playing with ChatGPT, an text-generating AI engine by OpenAI, the folks that created DALL-E, that … Continue reading “Playing with ChatGPT”
SGA (Some Good Advice)
I submitted a short blurb to an effort to gather advice from CISO’s. I believe many CISO’s (especially new ones) will focus primarily on advanced security controls and miss the … Continue reading “SGA (Some Good Advice)”
Security tool costs
I really miss the days when I paid maintenance for software. The new ARC paradigm really sucks for the consumer. The only positive piece is that the financial implications of … Continue reading “Security tool costs”
Trying to capture cost per vulnerability patched and why I don’t believe it’s a good idea
This post is part experiment, part memorializing a short conversation I had with Sasha Romanosky (one of the creators of CVSS). I have more thoughts on the subject of the … Continue reading “Trying to capture cost per vulnerability patched and why I don’t believe it’s a good idea”
Getting into the time machine
I’ve been trying to clean up my document repositories and found a talk I gave at RSAC back in 2016 that brought back some thoughts I’ve been having recently about … Continue reading “Getting into the time machine”
Middle School Career Day
I had the privilege of presenting to over 50 13 year olds at a middle school’s career day. It was a ton of fun, the kids asked great questions, and … Continue reading “Middle School Career Day”