The views and language below reflect Eric’s thoughts and opinions and do not reflect his employers.

I came back to Phoenix after a week in Baltimore. The Phoenix copium isn’t just cope – I do indeed prefer a dry heat. I’d rather be baked alive by thesun than sweating in moderate temperatures. Perhaps, next time I should dress in moisture-wicking instead.

USENIX Security

I was in Baltimore to attend the USENIX Security conference. For training this year, I opted for an academic focused conference. Since students/professors don’t have significant purchasing power, there were fewer corporate-sponsored minglings which was a nice reprieve. Addtionally, it’s very surprising that though the problem spaces between corporate and academic security concerns have significant overlaps, there isn’t as much crosstalk as I’d expected. Contrast this with the AI/ML cultures where academic concerns come directly out of corporate research or vice-versa ¹

I attended most of the Enigma track (which is more coporate focused). The talks ranged in technicality. I deprioritized the less-technical privacy and society talks. For the most part, we’re in a slow-motion car crash into total surveillance². The talks I had takeaways for:

6 Dev Personas

Enrique Vargas who co-leads the OWASP Security Culture group had an interesting presentation about using behavorial psychology to narrow 6 different personas to consider when trying to implement security in an organization. As always, some heuristics are more useful than others - it’s pretty obvious that treating developers as a monolithic mass isn’t be very accuate³. That said, I would love to see more research about whether the the SECUR-E framework for personas works better than treating developers monolithically. A quick summary of the talk:

• There are 6 dev personas that security organizations. Each of these have a different profile in terms of COM-B (Capability, Opportunity, and Motivation).
• Security organizations should try to shift 5 of these personas (Skeptic, Enthusiast, Compliant, Unaware, Resistant) to the the legendary 6th persona (Embedded). Each of the 5 personas have their own effective carrot and sticks.

Improving Safety with Privacy

Someone from OpenAI proposed a totally private inference infrastructure which was pretty interesting. That said, the open problems listed on the slide mentioned in the presentation seemed to indicate this was still in thought-experiment design phase.

Security Posture Drift with AI and Threat Models

Preeti Ravindra proposed a framework for auto-reconciling Threat Models and Code. It was certainly interesting. Essentially the gist of it is that GenAI isn’t very reliable at sticking to a threat model over time. The proposal was to generate a couple intermediate formats from the codebase. These would be AI-generated and then both AI and mechanically evaluated. One thing that wasn’t exactly clear from the talk was whether they had tried to embed the threat model/controls into the codebase itself (e.g. OWASP ThreatSpec).

Crypto @ Scale at Comcast

Jayati Dev gave a neat talk about how Comcast was trying to inventory all of its crypto assets to prepare for post-quantum. Apparently, the somebody updated their guidance that quantum-computer availability to 2029 from 2035, so there are only a handful of years to upgrade instead of a full decade.

Comcast faces an unique problem in that its physical infrastucture must also be upgraded support post-quantum crypto. However, not only is that hard to enumerate, it may also require a total overhaul of the hardware. In software, this is significantly easier. Their proposal is to generate CBOMs (Cryptography Bill-of-material) with a tool that they have open-sourced a part of.

Security Tools don’t detect attacks

Krupa Brahmkstri from Visa gave an interesting talk about how they were planning to help automate IR with AI. The key conceit of the talk is that an incident alert does not imply an incident detection. An incident is only detected when the IR team investigates and signs off on the incident. Instead the argument is that tools detect observations and/or events. As a result, VISA built a system of GenAI playbooks to respond to alerts providing explainable AI explanations for humans. At the end of the talk, there was an interesting Q&A session where somebody mentioned that their experience at Google indicated that this sort of system had a few risks involved. The most important one is who takes responsibility for incorrect findings and explanations. Analysts were hesitant to sign off on explanations since the explanations could be incorrect compared to the truth⁴.

NPM supply chain

Zach Spielberg from Github research talked about npm issues and their work in terms of trusted publishing and cooldowns. Pretty cool talk but aside from roadmap points, there wasn’t necessarily anything novel. That said the product roadmap points were pretty interesting. Github is looking to implement a few things:

1. Runner network ingress/egress observablity and filtering. Exactly what Step Security does but at the VM level instead of the precess, so that’s pretty neat.
2. Package registry proxy. Github will make a package proxy for its corporate users. Jfrog and Sonatype – y’all better watch out. The package proxy that we currently use at #work is pretty scummy – can’t wait for Github or an open source alternative to make them obsolete. They charge way to much for little service and competency.

Others

There were also a few others, but they were more academic :)

Goal Updates

Short-term goals

1. Add maven to winget. Unfortunately, package rebundling is against community policy, so the MR is blocked and probably will need to be closed. Currently thinking about trying to contribute to winget so that zip installers will be allowed.

Also, I ended up swapping off Hakyll to Hugo. The local setup cost of Haskell on Windows was taking way too long :(