Adam Shostack

OCTOBER 9, 2019

Continuum has a blog and a spreadsheet on threat modeling lambdas (as a category, not specific to Amazon Lambda), and also a post on threat modeling with CAPEC. Disclosure: I’m on advisory boards for Continuum and Ntrepid. There’s some context from Aaron Small, who made the project happen.

189

189

The Last Watchdog

AUGUST 29, 2022

We’ve shared some helpful guidance on password security at Zigrin Security blog. Unauthorized access via default, shared, or stolen credentials constituted more than a third of the entire Hacking category and over half of all compromised records. He is also a member of the GIAC Advisory Board. .

Hacking 201

Hacking Passwords Password Management Data breaches 201

Security Affairs

JUNE 12, 2022

By using the manufacturer’s built-in ports, we were able to manipulate on-board components and interact with the device.Combining both known and novel techniques, we were able to achieve root access to the device’s operating system and pull its firmware for emulation and vulnerability discovery.” ” reads the advisory.

Firmware 97

Firmware Penetration Testing Manufacturing Authentication 97

ForAllSecure

MAY 18, 2021

I did did some ones I got more into bug bounty and so these were things to do but that wasn't how I got into it, really most of what I did was just looking at different bug bounty programs across the board, seeing what I can find. The way I was hired, I still can work in a kind of hard time advisory capacity for DDS.

Hacking 52

Hacking Ransomware Cryptocurrency Engineering 52

ForAllSecure

MAY 18, 2021

I did did some ones I got more into bug bounty and so these were things to do but that wasn't how I got into it, really most of what I did was just looking at different bug bounty programs across the board, seeing what I can find. The way I was hired, I still can work in a kind of hard time advisory capacity for DDS.

Hacking 52

Hacking Ransomware Cryptocurrency Engineering 52