ericalexander3

Peter Senge has a great definition in The Fifth Discipline

> Mental models are deeply ingrained assumptions, generalizations, or even pictures of images that influence how we understand the world and how we take action.

Isn't open source proof that you don't need buts in seats in the same office? If open source projects can do it, why can't most businesses? What's the limiting factor in business? Is it communication? Is it antiquated management practices?

Any organization that designs a system (defined broadly) will produce a design whose structure is a copy of the organization's communication structure.

— Melvin E. Conway

Interested in data on real world impact from these attack vectors? Hackerone has public data on how often they reward each type: https://www.hackerone.com/blog/hackerone-top-10-most-impactf... . You can also browse through findings in Hackerone's hacktivity: https://hackerone.com/hacktivity . I run a project where we try and connect the dots between breaches and the how and why they happened: https://ericalexander.org/SecurityBreach/

>The great ones are a treasure: and they are rare. And in order to stay great, they regularly need to go back to the well to refresh their own hands-on technical abilities.

Similar to principle 9 from the Toyota Way. >Grow leaders who thoroughly understand the work, live the philosophy, and teach it to others.

Keeping up with security news is important for situational awareness, but it can be time consuming. This is a tool I wrote for my own benefit to reduce signal to noise. It runs entirely on Github using pages and actions. Source: https://github.com/ericalexanderorg/SecurityNews

Technology can bring benefits if, and only if, it diminishes a limitation. -Dr. Eliyahu M. Goldratt

Goldratt was critical of ERP systems, not because they couldn't bring benefit; rather, because many businesses adopted through a cargo cult mentality and viewed them as magical silver bullets. Many companies never understood where their bottlenecks were (Theory of Constraints) and would make things worse with an ERP system, with some going bankrupt.

SSRF to metadata service to S3 access was the entry point. There's a lot of focus on the SSRF and metadata service components but the S3/IAM component is possibly more intriguing. Did the role/account follow the principle of least privilege? If not, how did they miss it? This is the company that opened sourced Cloud Custodian. They're capable of identifying risks and creating tooling to reduce lead time on finding those risks.

Possibly more intriguing: I'll bet Capital One deals with more compliance initiatives than 99% of the public sector. Another Heartland Payment Systems example? Did leadership have a false sense of safety after passing an audit?

U2F > TOTP > Any MFA > no MFA

Why? About 23% of the classified breaches in this data set are due to compromised valid accounts and any MFA would probably have prevented the breach. Often security isn't about out running the bear, it's about out running the person next to you.

data set: https://github.com/ericalexanderorg/SecurityBreach

Articles like this inspired this project: https://github.com/ericalexanderorg/SecurityBreach

It's sensational to make a claim that's based on the opinion of a few people in the world, some who are motivated to sell a product. It's plausible criminals are following the path of least resistance (occum's razor) but I'd like to see data backing the claim that "most cybercrime doesn't involve computer hacking". Open data can help security teams make data driven decisions towards the pursuit of reducing risk.

FUD article focusing on DDOS/Stresser/Booter incidents but doesn't share any data to show an upward trend on Christmas.

Using this data on breaches we can see there's more incident/breach activity in October than any other month. https://github.com/ericalexanderorg/SecurityBreach

That's not the Toyota way. From a Westrum "Three Cultures Model" perspective Toyota would fall into the Generative classification, not Pathological or Bureaucratic.

Based on the discussion in the article I think Toyota is saying they've learned EVs are not scalable and are not a solution to all customer needs Toyota currently services. They're betting hydrogen is the solution.

Coding test early in the recruitment pipeline. I've seen plenty of CS degrees on resumes that can't pass basic coding exercises/tests; at the same time, I've been impressed with the capabilities of new grads.

I'm looking for autodidects and could care less what educational format they prefer.