CISO
A raid by Russian hackers penetrated deeper than first thought: "Some of these secrets were shared between customers and Microsoft..."
"Almost no information is currently available to indicate how an organization is preparing for future cyber-physical challenges. This has to change."
There are no workarounds that remove the vulnerability, which allows unauthenticated remote command execution on vulnerable systems. A patch is available.
"In every insider threat case, there is a combination of network activity and employee behaviour. The malicious activity crosses both physical and electronic modalities..."
"A storied career in high-scale/high-security, demanding environments"
"Industry has gotten good at identifying vulnerabilities in the supply chain; SBOMs and so on [but not at] at insidious backdoors and logic issues that are built into software, and update mechanisms that could cause implants..."
"You have to be intentional about designing for real people who are not security experts."