First Law of Revision: Information necessitating a change of design will be conveyed to the designers after—and only after—the plans are complete. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory.
General “laws” that also apply to security. Fudd’s First Law of Opposition: If you push on something hard enough, it will fall over. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory.
'“The fact that malware was recovered from the network at all, and the fact that it's newer, gives a high confidence assessment that the cyberattack on Ukraine was legitimate,” Lee told Motherboard in a phone interview. Lee said the malware was “unique,” implying that it likely wasn't something that just happened be on the grid network during the outage.' - Robert M. Lee, a former US Air Force cyber warfare operations officer as well as the founder and CEO of Dragos Security, wrote on the SANS ICS Security Blog
Good On Ya! News of mutual cooperation work, undertaken by Argonne National Laboratory and the National Nuclear Security Administration percolated up through the flotsam of mid-winter storms, runs on supermarkets and that ilk, making an impression of positivity in and around Casa Infosecurity this past weekend... Today's Must Read.
He Who’s Name Must Never Be Spoken Maxim: Security programs and professionals who don’t talk a lot about “the adversary” or the “bad guys” aren’t prepared for them and don’t have good security. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory.
DarkMatters takes us down the slippery-slope of poorly configured Databases, and Database Management Systems. Threats abound, yet little is accomplished to remdiate (until after data loss). Today's Must Read.
'As of this writing, there are more than 27,000 instances of MongoDB and approximately 29,000 instances of Redis on the internet that do not have authorization enabled. Misconfigured databases are just as dangerous as vulnerabilities—they provide the bad guys an easy-access, exploitable front door to user data.' via DarkMatters
Essentially, PAWS provisions a workstation to perform high risk-determined activities (SysAdmin work, for example), and permits a user VM on the machine to perform less sensitive, mundane tasks such as normal office tasks.
Seems a might crufty, eh?
'In simplest terms, a PAW is a hardened and locked down workstation designed to provide high security assurances for sensitive accounts and tasks. PAWs are recommended for administration of identity systems, cloud services, and private cloud fabric as well as sensitive business functions.' - via Microsoft Technet