Please enjoy this encore of Word Notes.

A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.

Audio reference link: "⁠OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)⁠." by Pravir Chandra, OWASP MSP, 2009.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.

Cyberwire Glossary link: ⁠https://thecyberwire.com/glossary/u2f⁠

Audio reference link: “⁠Rise of the Machines: A Cybernetic History⁠,” by Thomas Rid, Published by W. W. Norton Company, 21 November 2017.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops. 

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/bsimm⁠

Audio reference link: “⁠OWASP AppSecUSA 2014 - Keynote: Gary McGraw - BSIMM: A Decade of Software Security⁠.” YouTube Video. YouTube, September 19, 2014.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version. 

Audio reference Link: "⁠The Panama Papers: A Closer Look⁠," Late Night with Seth Meyers, YouTube, 12 April 2016

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

Code and data repositories that don't protect against unauthorized changes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

The absence of telemetry that could help network defenders detect and respond to hostile attempts to compromise a system. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

Ineffectual confirmation of a user's identity or authentication in session management.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/owasp-identification-and-authentication-failure⁠

Audio reference link: “⁠Mr. Robot Hack - Password Cracking - Episode 1⁠.” YouTube Video. YouTube, September 21, 2016.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

An open source Java-based software tool available from the Apache Software Foundation designed to log security and performance information. 

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/log4j⁠

Audio reference link: “⁠CISA Director: The LOG4J Security Flaw Is the ‘Most Serious’ She’s Seen in Her Career⁠,” by Eamon Javers (CNBC) and Jen Easterly (Cybersecurity and Infrastructure Security Director) YouTube, 20 December 20 2021.

Learn more about your ad choices. Visit megaphone.fm/adchoices