Expert insights. Personalized for you.
Daniel Miessler
JUNE 28, 2022
It’s common to hear that it’s hard to get into cybersecurity, and that this is a problem. That seems to be true, but it’s informative to ask a simple follow-up: The current cybersecurity jobs gap sits at around 2.7 million people. A problem for who?
Daniel Miessler
MARCH 10, 2022
People are starting to get the fact that texts (SMS) are a weak form of multi-factor authentication (MFA). Fewer people know that there’s a big gap between the post-SMS MFA options as well. As I talked about in the original CASSM post , there are levels to this game.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Daniel Miessler
AUGUST 7, 2022
A number of security people have come out against Amazon buying One Medical. It’s to be expected, as most security people are rightly worried about big corporations getting a hold of more personal data.
Daniel Miessler
DECEMBER 18, 2021
If you’re reading this you’re underslept and over-caffeinated due to log4j. Thank you for your service. I have some good news. I know a super-smart guy named d0nut who figured something out like 3 days ago that very few people know. Once you have 2.15
Speaker: William Hord, Vice President of ERM Services
Join us as we discuss the various tangents of data and the change management process that will help you make better risk-based business decisions to save time and money for your organization.
Daniel Miessler
JUNE 8, 2022
If you’ve not heard, there are these things called NFTs. I think they’re simultaneously the future of digital signaling and currently mostly hype. But whatever—that’s not what this post is about.
Daniel Miessler
SEPTEMBER 12, 2021
This post will talk about my initial thoughts on The OWASP Top 10 release for 2021. Let me start by saying that I have respect for the people working on this project, and that as a project maintainer myself, I know how impossibly hard this is.
Daniel Miessler
JULY 21, 2021
There’s a paradox in information security where the community wants two things at once: High quality research and talks, and. Unbiased research and talks. I’ve personally been one of these affiliated speakers countless times.
Daniel Miessler
MARCH 13, 2022
A lot of people, especially in the security industry , are concerned that NFTs are a scam. And that’s for a good reason in many cases, since many of them are. In fact, I’d say it’s something like 95%. That’s not a real number, but that’s where I’d put the ratio.
Daniel Miessler
MARCH 24, 2021
This post is an attempt to create an easy-to-use security model for the average internet user. Basically, how secure is someone’s current behavior with respect to passwords and authentication, and how can they improve? People like moving up rankings, so let’s use that!
Speaker: Ronald Eddings, Cybersecurity Expert and Podcaster
In this webinar, Ronald Eddings, Cybersecurity Expert, will outline the relationship between SaaS apps and IT & security teams, along with several actionable solutions to overcome the new difficulties facing your organization.
Daniel Miessler
MARCH 24, 2021
This post is an attempt to create an easy-to-use security model for the average internet user. People like moving up rankings, so let’s use that! Basically, how secure is someone’s current behavior with respect to passwords and authentication, and what can they do to improve?
Daniel Miessler
JANUARY 25, 2021
There are recon tools, and there are recon tools. tomnomnom —also called Tom Hudson—creates the latter. I have great respect for large, multi-use suites like Burp , Amass , and Spiderfoot , but I love tools with the Unix philosophy of doing one specific thing really well.
Daniel Miessler
APRIL 20, 2021
Casey Ellis (of Bugcrowd fame) had a great post on Twitter today about security terminology. Casey also added that Acceptable Risk would be being willing to get punched in the face.
Daniel Miessler
SEPTEMBER 17, 2021
In a previous post I talked about how security questionnaires are security theater. They were in 2018—and they still are—but pointing this out always raised the same challenge: Fine, but we have to do something. What’s the alternative?
Daniel Miessler
JUNE 4, 2022
I’ve had an idea lingering for years about habits and behaviors and outcomes. If we accept that peoples’ output usually comes from their inputs, what if we just completely copied their inputs? For example, I’m a heavy guy because I eat too much. I have a friend who eats way less. He’s very thin.
Speaker: Karl Camilleri, Cloud Services Product Manager at phoenixNAP
Through a detailed analysis of major attacks and their consequences, Karl Camilleri, Cloud Services Product Manager at phoenixNAP, will discuss the state of ransomware and future predictions, as well as provide best practices for attack prevention and recovery.
Daniel Miessler
JULY 23, 2021
There’s massive confusion in the security community around Security Through Obscurity. In general, most people know it’s bad, but they can’t say exactly why.
Daniel Miessler
AUGUST 5, 2021
I’ve always been fascinated by security that was “just good enough” I think lots of security actually qualifies (see The News), but I think fencing (and maybe bike locks) take first prize. As a kid I used to love breaking into stuff. Nighttime construction sites.
Daniel Miessler
JUNE 2, 2022
When I think about violence caused by young, socially-rejected males, I often wonder how much bullying and mistreatment cause their violent behavior. That doesn’t mean excuse the behavior; I am talking about the proximate cause—or exacerbation—that contributes to the act.
Daniel Miessler
MARCH 20, 2022
I’m starting a new series with this 2022 edition where I think about what Information Security could or should look like in the distant future—say in 2050. The ideas will cover multiple aspects of InfoSec, from organizational structure to technology.
Speaker: P. Andrew Sjogren, Sr. Product Marketing Manager at Very Good Security, Matt Doka, Co-Founder and CTO of Fivestars, and Steve Andrews, President & CEO of the Western Bankers Association
In this webinar, we have a great set of panelists who will take you through how Zero Data strategies can be used as part of a well-rounded compliance and security approach, and get you to market much sooner by also allowing for payment optimization. They’ll share how to grow your business faster and minimize costs for both security and compliance
Daniel Miessler
APRIL 8, 2021
I was on Twitter the other day and saw someone suggest that we could fix people paying ransoms by making it illegal for them to do so. I was a bit flippant with my response.
Daniel Miessler
SEPTEMBER 21, 2020
I just came across another post on Hacker News talking about why you shouldn’t move your SSH port off of 22 because it’s Security by Obscurity. There are some good reasons not to move SSH ports in certain environments, such as usability.
Daniel Miessler
DECEMBER 3, 2020
The Lawfare Podcast is one of my few staples, and I just listened to another great episode on espionage against US buisnesses.
Daniel Miessler
SEPTEMBER 27, 2020
Threat modeling is a superpower. When done correctly it gives you the ability to adjust your defensive behaviors based on what you’re facing in real-world scenarios. And not just for applications, or networks, or a business—but for life. The Difference Between Threats and Risks.
Speaker: Mike Cramer, Director of HIPAA & Data Security at The Word & Brown Companies
Now that companies are slowly allowing employees to return to work at the office, it's time to re-evaluate your company’s posture towards privacy and security. Join Mike Cramer, Director of HIPAA & Data Security at The Word & Brown Companies, for a discussion that will focus on compliance and the types of privacy and security measures your company should be aware of, as well as tips and methods for implementing these measures.
Daniel Miessler
NOVEMBER 6, 2020
I think there are four main trends that will play out in the field of information security in the next 20 years.
Daniel Miessler
NOVEMBER 14, 2021
If you’re on InfoSec Twitter You’ve probably seen the recent iteration of the neverending debate around degrees, certs, and InfoSec. Basically, one side argues that you need college to be taken seriously in security, and the other side says nuh-uh!
Daniel Miessler
SEPTEMBER 13, 2020
I think we’ve lost the plot on disinformation. It’s not the attacks that are the problem. It’s the fact that too many Americans are willing to believe almost anything. Ideally we’d reduce both the attacks and the vulnerability. Of course it would be nice to have fewer attacks.
Daniel Miessler
DECEMBER 9, 2020
I am often asked for my thoughts on the Bug Bounty / RECON / Asset Inventory / Attack Surface Management spaces. This is partially because I founded a company, called HELIOS, back in 2016, which I separated from at the end of 2018.
Daniel Miessler
SEPTEMBER 29, 2020
Since 2007 the InfoSec industry has been talking about TheBigOne™—the event that would change cyber threats from annoyances to existential concerns. They called it Cyber Pearl Harbor. This doesn’t mean it can’t still happen.
Daniel Miessler
DECEMBER 22, 2021
I get asked a lot what my go-tos are for security content. My top four recommendations are Darknet Diaries , Risky Business , Unsupervised Learning (yes, my own show), and TL;DRSec. What’s so interesting about these four is how different they are.
Daniel Miessler
APRIL 9, 2020
I’ve been processing my thoughts on the Zoom Security stuff for a couple of weeks now, and I think I finally have an opinion. The hate is silly. Like I said, I sense something strange here. I get there are security issues. And some seem pretty bad.
Daniel Miessler
DECEMBER 12, 2021
We should have a new internet group called The Vigilant—a group of open-source code maintainers that steward and protect our top 1000 open-source applications. Here’s how it could work. Step 1: A group of internet technology and security leaders are elected and put into place.
Daniel Miessler
MAY 19, 2021
Every year I like to look at Verizon’s DBIR report and see what kind of wisdom I can extract. This year they appear to have put in even more effort, so let’s get into it.
Daniel Miessler
MARCH 22, 2020
I’ve thought for a long time that public video feed monitoring would become ubiquitous. My basis for this was looking at humans ultimately desire, not at the tech itself.
Daniel Miessler
APRIL 29, 2020
If you want to have a productive discussion on a difficult topic, start by discarding the extremes. Very few want pure communism, pure market capitalism, zero taxes, or taxes to be doubled.
Daniel Miessler
OCTOBER 28, 2020
I have an unpopular opinion about the security conference scene. Basically, it’s the opposite of what John Strand said here: Can we all agree that pre-recorded Conference talks are horrible? I mean… Why? — strandjs (@strandjs) October 28, 2020.
Daniel Miessler
MAY 22, 2021
Twitter is great for quick ideas that may or may not be useful. I had one the other day: An NTSB, but for ransomware. — ?????? ???ss??? DanielMiessler) May 22, 2021.
Daniel Miessler
MAY 17, 2021
SECURITY NEWS. Darkside, the ransomware group that ransomed Colonial, has largely gone dark after its servers and Bitcoin were seized. Its blog, payments collection site, and its CDN have gone offline.
Daniel Miessler
AUGUST 19, 2020
I’ve been in security for over 20 years now and have received thousands of emails asking for help or mentorship. And throughout that time I’ve also reached out to hundreds of people asking for something similar.
285 
Let's personalize your content