🎖️ CISA (US Cybersecurity & Infrastructure Security Agency) pleged continued support of the CVE program, an important message after April’s de-funding scare.

🙂 The AppSec Village at DEFCON33 ran, with many engaging and educational talks. Keep an eye on the YouTube channel, but be patient – it can take a few months.

Runtime security is important. But it's inherently reactive — it's a back up for proactive controls. Get to a point of acceptable risk before deploy; use runtime to deal with risks that are hard to detect before you ship, or that arise after deployment (such as newly-reported vulnerabilities).

Security Champions are empowered to make routine security decisions, educated to help their teams follow the security policies and programs that apply to them, and relied upon to provide valuable feedback to the security teams about places where the program needs improvement or adjustment.

Security Champions aren't "bonus staff" for the security team. They're trusted partners in building a security culture. As a bonus, you get a network of trained rapid-responders when there's a high-priority issue.

And then leaders are confused that this fails, and ultimately decide that champions programs don't work.

A Security Champions Program should work more like a Safety Warden program. The goal is to create a network of people who act as liasons between their teams and the professional security teams.

I went that route last year; even for gaming, Linux has been just solid and very low problems (went Manjaro on my main desktop and Laptop, and the kids’ gaming rigs)

Practically speaking, if you want to do business with the US government, you're still going to want to meet those requirements unless you have a fairly narrow scope of business that only includes agencies that won't adopt such requirements.

Orgs no longer need to universally supply #SBOM docs or produce machine-readable #SSDF attestations. BUT, it doesn't end current requirements or stop agencies from acting on their own. This isn't really surprising given the administration's priorities and related positions.

#InfoSec organizations (and especially #ProdSec and #AppSec) have a big challenge ahead of them to stay out in front of the rapidly-changing threat landscape for #LLM. We can't rely on providers like Hugging Face to solve the problem for us.