Julian Cohen

@HockeyInJune

Risk philosopher and 🐱‍💻.

New York, NY
hake.co
Joined February 2008
71 Photos and videos Photos and videos

Tweets

You blocked @HockeyInJune

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @HockeyInJune

  1. Pinned Tweet
    Apr 24

    I'm tired of mismanaged threat models and wasted efforts on defense teams.

    2 replies 6 retweets 19 likes
    Undo
  2. Retweeted
    Aug 24

    Then I asked the audience to build an attack playbook using infrastructure like Samsung and an Windows XP exploit with the resources of the cyber division of the South Korean military.

    1 reply 2 retweets 2 likes
    Show this thread
    Show this thread
    Undo
  3. Aug 24

    When you do these exercises at work, you don't need to use the diamond model or the Lockheed Martin Kill Chain. I use them in my presentations because they are well understood accepted standards, but you may want to use more and less detail and more or less data in your model.

    Show this thread
    Show this thread
    Undo
  4. Aug 24

    What events may change our adversary's motivation, capabilities, and resources? What events may change our adversary's tools, techniques, and procedures? How confident are we in these predictions?

    1 reply
    Show this thread
    Show this thread
    Undo
  5. Aug 24

    What events may change our set of adversaries? Is our security strategy growing with out organization and with our adversaries? How quickly is our organization getting added to new target lists and being discovered by new adversaries? How confident are we in these predictions?

    1 reply
    Show this thread
    Show this thread
    Undo
  6. Aug 24

    Do we have enough supporting data and threat intelligence (quantitative and qualitative) to justify our work to our CISO and to our board? How confident are we in our adversary simulation? Can we confidently predict future adversary behavior? Do we have enough historical data?

    1 reply
    Show this thread
    Show this thread
    Undo
  7. Aug 24

    Before we can begin to prioritize and execute, we need to review our work. How confident are we that our set of adversaries is complete and accurate? How confident are we that we understand their resourcing, capabilities, motivations, and constraints? Are our defenses effective?

    1 reply
    Show this thread
    Show this thread
    Undo
  8. Aug 24

    Finally, with a carefully understood attack, I asked the audience to design defenses to prevent, detect, and monitor the attack using Lockheed Martin's Intrusion Kill Chain Courses of Action Matrix ().

    1 reply
    Show this thread
    Show this thread
    Undo
  9. Aug 24

    Make sure to sanity check your work.

    1 reply
    Show this thread
    Show this thread
    Undo
  10. Aug 24

    Then I asked the audience to build an attack playbook using infrastructure like Samsung and an Windows XP exploit with the resources of the cyber division of the South Korean military.

    1 reply 2 retweets 2 likes
    Show this thread
    Show this thread
    Undo
  11. Aug 24

    Then I asked the audience to help us design an adversary that a North Korean healthcare organization might encounter. Using the Diamond Model (), I asked them to consider who the adversary might be, their motivation, and their capabilities and resources.

    1 reply
    Show this thread
    Show this thread
    Undo
  12. Aug 24

    Then I asked the audience to design an organization for us to protect. I asked them to pick an industry and consider the size of the org, whether the organization is public or private, what countries the org operates in, and what kind of infrastructure the org needs to operate.

    1 reply
    Show this thread
    Show this thread
    Undo
  13. Aug 24

    First I introduced some concepts that you've probably heard me talk about before on Twitter.

    1 reply 1 retweet
    Show this thread
    Show this thread
    Undo
  14. Aug 24

    Last night I gave the first version of my Threat-Based Risk Analysis Workshop at Open Forum. This workshop is an introduction to using threat-based risk analysis at your organization by working through a contrived demo together.

    2 replies 1 retweet 10 likes
    Show this thread
    Show this thread
    Undo
  15. Aug 21

    What kind of dystopia have we created for ourselves?

    7 replies 65 retweets 98 likes
    Undo
  16. Aug 21

    What's your favorite (read: most effective or best) EPP/EDR/NGAV suite? Things I care about most: * Threat Intelligence to discover the best TTPs/indicators/attacks/events to prevent and detect * Support for macOS/Windows/Linux * Low performance hit * Remediation * Investigations

    1 retweet 1 like
    Undo
  17. Aug 20

    This tastes like someone dropped a couple of lime Skittles into my water.

    3 replies 4 likes
    Undo
  18. Aug 20

    What's the state of the world in Caller ID spoofing for VoIP services? If I have a cloud PBX, should I expect that they should be able to detect CID spoofing by comparing the CID header to the VoIP header? Vendor claims that CID spoofing is impossible suddenly. Is that true?

    2 replies
    Undo
  19. Retweeted
    Jun 29

    Listening to the FM broadcast

    1 reply 5 retweets 42 likes
    Undo
  20. Aug 14

    I found the pot of gold at the end of the rainbow! It's this signals intelligence dish at 33 Thomas Street.

    1 reply 8 likes
    Undo
  21. Aug 14

    Has anyone taken a deep dive into this "backdoor"? It seems like only one not-popular processor is affected. Has anyone seen any Intel or AMD processors affected?

    1 reply 2 retweets 1 like
    Undo

@HockeyInJune hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·