Word Notes

Please enjoy this encore of Word Notes.

An open source email authentication protocol designed to prevent emails, spoofing in phishing, business email compromise or BEC, and other email-based attacks. 

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/pegasus⁠

Audio reference link:"⁠Global Cyber Alliance's Phil Reitinger talks DMARC adoption⁠" “Global Cyber Alliance’s Phil Reitinger Talks DMARC Adoption.” YouTube Video. YouTube, April 27, 2018

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

A condition announced by the US Cybersecurity and Infrastructure Security Agency (CISA) to draw attention to a temporary period of high alert, associated with expectation of a connected wave of cyberattacks prompted by either a widespread vulnerability or an unusually active and capable threat actor.

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/shields-up⁠

Audio reference link: “⁠Star Trek II Wrath of Khan - Reliant vs Enterprise; First Clash⁠” YouTube, YouTube, 11 Apr. 2015,  

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.

Audio reference link: "⁠OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)⁠." by Pravir Chandra, OWASP MSP, 2009.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.

Cyberwire Glossary link: ⁠https://thecyberwire.com/glossary/u2f⁠

Audio reference link: “⁠Rise of the Machines: A Cybernetic History⁠,” by Thomas Rid, Published by W. W. Norton Company, 21 November 2017.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops. 

CyberWire Glossary link: ⁠https://thecyberwire.com/glossary/bsimm⁠

Audio reference link: “⁠OWASP AppSecUSA 2014 - Keynote: Gary McGraw - BSIMM: A Decade of Software Security⁠.” YouTube Video. YouTube, September 19, 2014.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version. 

Audio reference Link: "⁠The Panama Papers: A Closer Look⁠," Late Night with Seth Meyers, YouTube, 12 April 2016

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

Code and data repositories that don't protect against unauthorized changes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Please enjoy this encore of Word Notes.

The absence of telemetry that could help network defenders detect and respond to hostile attempts to compromise a system. 

Learn more about your ad choices. Visit megaphone.fm/adchoices