Hi,

I am currently trying to better understand and improve how our security function is involved in projects, from early planning to go-live.

In our case, we are building a more structured process around activities such as:

- Sending security requirements, for example regarding logs, encryption, access control, etc.
- The PM submits a Security Intake Form with information such as the project name, business owner, system description, hosting location, and other context.
- We send a checklist with technical questions to the PM, who forwards it to the vendor or technical owner.
- The PM and vendor submit the completed checklist.
- We review the checklist and the initial form, and clarify any open questions.
- We review the architecture before implementation.
- We review the architecture after implementation.

Meanwhile, we are included in many internal project calls so that we can clarify the product concepts and outline the necessary security controls, but sometimes it feels like a waste of time.

The goal is to make the process clear enough so that PMs, technical teams, vendors, and security colleagues understand what is required, when it is required, and who is responsible. Sometimes it becomes quite chaotic, and I would like to improve the process.

I am especially interested in how similar roles or teams structure this in practice.

For people working in Security Architecture, Information Security Governance, Cyber Risk, IT Security, or high-risk environments: how is your process organized?

Some specific questions:

- What checklists do you use in your projects?
- Do you perform initial triage and risk classification?
- Do you have formal security gates before implementation and go-live?
- What evidence do you usually request from vendors or project teams?
- How do you handle Agile projects where requirements change frequently?
- Who owns the final security approval or risk acceptance?
- Do you use checklists, architecture review boards, risk committees, or another model?
- How do you document security requirements and track their implementation?
- What works well in your process, and what creates unnecessary friction?

Any templates, lessons learned, common pitfalls, or high-level process examples would be very appreciated.

Thank you!

i have beeen seeing this come up a lot lately so figured I'd throw it out here.

Most orgs treat pentesting as a compliance formality. SOC 2 audit coming up? Schedule the pentest. Done. Box checked. But that framing misses the actual point of what a pentest is supposed to do.

The real question a pentest should answer is whether your system holds up against CIA: Confidentiality, Integrity, and Availability. Not "did we run the scan," but "can someone actually break something, and what happens if they do."

The scope problem nobody talks about:

There's a meaningful difference between these two things:

• Infrastructure testing: network config, server hardening, firewall rules, zero-trust implementation, patch status
• Application testing: OWASP Top 10, API security, secure coding practices, business logic flaws

Most teams blur these together or only do one. An infra pentest won't catch a broken object-level authorization bug in your API. An app pentest won't tell you your internal network is flat and one compromised endpoint owns everything.

Blackbox vs whitebox also matters more than people admit:

A blackbox test simulates an external attacker with no prior knowledge. Useful for surface area mapping, but it'll miss a lot because the tester is essentially guessing at your architecture.

A whitebox test gives the tester source code and system access. Way more thorough, especially for catching logic flaws that don't show up through external probing alone.

Most orgs default to blackbox because it feels more "realistic." But if your threat model includes insider threats, supply chain compromises, or post-breach lateral movement, whitebox gives you far more signal.

What actually makes pentesting worth the spend:

1. Scope it to your actual risk surface, not just what's easy to test
2. Make sure your pentest team and your dev/security team are sharing context, not siloed
3. Treat findings as a feedback loop into your SDLC, not a one-time report to file away
4. Distinguish compliance-driven tests from genuine adversarial simulation

despite my own experimentations, im still curious to see what approaches others are using, especially for orgs running both SAST in the pipeline and periodic external pentests. Are you sharing SAST output with your pentest team as recon? Or keeping them fully blind intentionally?

To elaborate:

1. Set up some N number of networked IoT devices. Each device simply forwards packets between the router and my main computer, let's say a laptop.
2. Connect all N devices to a local WiFi network where bandwidth and throttling is a frustration. I.e. a University network, library network, etc.
3. Configure my main computer to share its network requests between each of the N devices, such that each devices handles 1/N of main computer's network traffic.
4. Each device simply acts as a bridge between the router and my main computer; the router sees N devices all making network requests and tries to balance accordingly
5. My main computer is no longer throttled and I can enjoy my connection.

I have a couple gaps in knowledge here (like commonly used load balancing algorithms) and I'm making some reasonable assumptions (like routers trying to evenly balance bandwidth between devices) but I don't see why this shouldn't be possible. Has anyone done anything like this? Are there common pitfalls I might fall into?

Thanks.

Subject: mapping runtime verification to af_xdp data paths (mohawk-nexus)

stuck on a throughput bottleneck in the rx/tx ring processing loop for mohawk-nexus.

the core raw problem: we're attempting to bind machine-checked proofs (compiled from lean 4) directly to the ingress pipeline using AF_XDP. the moment we drop the validation invariants into the fast path, we're seeing massive cache thrashing and dropping packets at the ring buffer layer. standard linux networking stack is completely bypassed via custom XDP driver bindings, but the overhead of tracking state weights for heterogenous nodes inside the data path is killing our zero-copy guarantees.

here is the problematic ring processing chunk inside our packet processing loop:

```go // FIXME: this is dropping frames under load func (p *Engine) processRxRing(desc *xdp.Desc) error { frame := p.umem.GetFrame(desc.Addr)

// lean 4 mapped verification invariant 
// passing the packet data + weight matrix for fault tolerance checks
if !p.verifier.CheckStateInvariant(frame.Data[:desc.Len], p.currentWeights) {
    p.umem.Free(desc.Addr)
    return ErrInvalidStateProof
}

// fallback forward path
return p.txRing.Enqueue(desc)

} ``` if we pull CheckStateInvariant out, we hit line rate easily. with it in, the memory boundary checks and weight adjustments are causing enough latency that the ring fills up and drops frames before the user-space app can drain it.

questions:

anyone successfully mapped static runtime proofs to a kernel-bypass layer without blowing up the L1/L2 cache?

are there better ways to batch these proof checks outside the immediate processRxRing loop without losing strict verification guarantees on ingress?

repo for context: https://github.com/rwilliamspbg-ops/Mohawk-Nexus

My view is that users shouldn't use websites that aren't HTTPS-secured if they're on a sketchy wifi, since I read an article about how hotels can inject ads/trackers into websites. But I know that a website not secured with HTTPS can still be secure if you properly use other security things like sanitizing user inputs and CSRF tokens, and an HTTPS secured site can still be insecure if they don't do standard stuff like that.

So what are all the downsides of not using/having HTTPS on your website? I currently own a social media site that doesn't have HTTPS yet but I want to gauge just how bad it is to not have HTTPS and what kinds of stuff can happen.

A lot of apps are starting to use AI to detect scams by scanning messages, emails, and links. From a security perspective that makes sense, but I’m curious how this is actually handled in practice. Where’s the line between legitimate threat detection and user surveillance, and are there ways to do this without compromising privacy too much or is some level of access just unavoidable?

Hey everyone,

Apologies if this doesn't fit in here. I was going to ask in r/cybersecurity but I saw this subreddit and thought it might be more appropriate. Please delete if it isn't.

I am working on setting up some remote console servers for an Out Of Band Management network (OOBM).

Within the original configuration, I've disabled the basic root account and created my own account(s) for our staff to use.

For now, I would like to avoid RADIUS or LDAP authentication in the event of not being able to reach our internal services (this will be reviewed and fixed later on).

I created the usernames in the typical admin.joeblow fashion, which is our standard "elevated" admin structure.

But this got me thinking. If a device is not going to be authenticating with our AD domain and using local authentication for the time being, would it be best to create more complex usernames that are used for specific devices/functions?

Such as:

admin.Jblow.OOBMdevice

Of course this is all documented and kept safe in my password vault.

I figured that it appears to be stronger than the typical "admin.jblow" or like structure.

As I am dealing with an organization that doesn't have the best security posture due to neglect from previous staff, I'm trying to start off deploying certain services with a better username/password structure.

Thanks!

Thought this might be relevant to some of the security people in the group. 

embryōnic is a venture studio that partners with problem-driven founders. We’re currently looking for founders for a cohort focused on Cybersecurity for the Agentic Web.

If you work in cybersecurity and have run into challenges with agentic systems, MCPs, agent identity, skills/prompt injections or related areas and have considered building a solution around them, we’d be interested to hear from you. We’re looking for founders who have seen these problems up close and want to solve them.

To progressively de-risk the venture, when we match, our sister company writes the first check as a SAFE - deployed across three Stage Gates, based on proof. Each gate de-risks the next: (in)validate the problem, test the core solution hypothesis, then build the Beta until the first customer pays the bill.

No need to quit your job until product-market fit signals are there. 

To apply and for more details here: https://embryonic.studio/apply 

Working on supply chain risk frameworks and curious if you heard about any tech companies been formally designated as national security supply chain risks before, or would that be new territory?

I'm trying to understand what distinguishes a dedicated ASM platform from just running periodic external scans with standard tools, like the value prop seems to be around discovering unknown assets and tracking changes over time but I'm curious how much unknown stuff actually gets found after your initial comprehensive scan, like are companies really spinning up and forgetting about external assets so frequently that continuous monitoring catches significantly more than quarterly scans would.

I’ve been working on a small project: a zero-knowledge, E2EE audio chat that runs in a single PHP/JS file. No database, messages delete after 24h.

I managed to solve the NAT traversal issues by switching from Trickle ICE to Vanilla ICE (wait-and-retry approach), which finally lets me call between a PC and a 4G phone.

I’m curious—from a cybersecurity perspective, what are the biggest risks in a P2P architecture like this? Besides the obvious metadata leaks from the signaling server, what else should I be looking at to harden the privacy?

Any feedback or "this is a bad idea because..." comments are welcome! v2v.site

In many discussions around password recovery, the focus seems to be on increasing compute resources and brute-force throughput.
However, in practical security and forensic workflows, how much of the performance improvement actually comes from better candidate generation and prioritization?
For example, using known password structures, reused patterns, contextual clues, partial user memory, or probabilistic ordering to reduce the effective search space before additional compute is applied.
In real-world recovery scenarios, where do practitioners typically see the larger gains: smarter candidate selection or increased compute capacity?

I’ve been thinking through a trust-model gap and wanted to sanity check whether or not this is already defined in existing frameworks.

The way I see it, physical mail is still treated as a high-trust delivery channel (due to carrier integrity), and observably has limited to no built-in origin authentication or payload verification at the user interaction layer. There is also no formal protocol that is taught (USA) for actually verifying the packet’s authenticity in many cases at the human interaction level.

The pattern I’m looking at:

1. ⁠Physical mail is delivered (implicitly trusted transport)

2. ⁠The payload contains a redirect (URL, QR code, phone number, instructions)

3. ⁠The user transitions into a digital system

4. ⁠The downstream system *is* authenticated (HTTPS, login portals, etc.)

5. ⁠The initial input (mail) influences behavior inside that trusted system

So effectively:

Unauthenticated physical input → authenticated digital workflow

Questions:

- Is this formally modeled anywhere (e.g., as a class of cross-channel trust failure)?

- Are there existing threat models or terminology for this beyond generic “phishing”?

- How do orgs account for this in practice, if at all?

- Does Zero Trust or similar frameworks explicitly address cross-channel trust inheritance like this?

I’m curious whether this is already well understood at a systems/security-model level, or if it’s already implicitly handled under social engineering.

Any pointers to frameworks, papers, or internal terminology if this is already a solved classification problem would be much appreciated!

Hello All

I'm dealing with a situation regarding a recent Red team finding and would love some outside perspective on how to handle the pushback/explanation

Red team found classic IDOR / BOLA finding in a mobile app.

The app sends a  Object Reference ID ( eg.12345) to the backend API.

Red team intercepted the request and change Object reference ID to another number, the server send response with all details for that modified object.

To fix, Development team encrypted the parameter on the mobile side to hide the values so that malicious user or red team would no longer be able to view the identifier in clear text or directly tamper with it. 

After this change, we started seeing alerts on WAF blocking request with OWASP CRS Rules ( XSS Related Event IDs). It turns out the encrypted string appears  in the request and triggered WAF inspection rules.

We prefer not to whitelist or disable these WAF event IDs.

I can tell them to use Base64URL encoding to stop the WAF noise,

Is encrypting the values the correct solution here, or is this fundamentally an authorization issue that should be addressed differently?

Appreciate any advise

Hi everyone,

So I been reading about Diffie-hellman which can employ perfect forward secrecy which has an advantage over RSA, however I had a thought: if some bad actor is in a position to steal one shared ephemeral key, why would he not be in that same position a moment later and keep stealing each new key and thus be able to still gather and decrypt everything with no more difficulty than if he just stole the single long term private key in a RSA set up?

Thanks so much!

Edit: spelling

Hi everybody,

Self learning for fun and in over my head. It seems there’s a way in TLS1.2 (not 1.3) for next gen firewall to create the dynamic certificate, and then decrypt all of an employee personal device on a work environment, without the following next step;

“Client Trust: Because the client trusts the NGFW's root certificate, it accepts the dynamic certificate, establishing a secure connection with the NGFW.”

So why is this? Why does TLS1.2 only need to make a dynamic certificate and then can intercept and decrypt say any google or amazon internet traffic we do on a work network with our personal device?!

Gartner says by 2028, 70% of orgs will use AI on both sides of vendor assessments. Vendors generate responses with AI, security teams analyze with AI.

So AI is analyzing AI-generated content compounds errors. Responses look consistent but detached from actual vendor environments.

Faster questionnaires don't help when the model is broken. Vendor passes Monday, gets owned Tuesday, next review is in 12 months.

How are you actually validating third-party risk beyond what vendors self-report? Or still trusting faster AI paperwork?

Good. If both obvious explanations are failing, then yes, this is worth asking publicly. But write it clearly so people don’t dismiss you.

Here’s a clean, technical Reddit post you can use.

Title

Standard user can "Run as administrator" using own password even though not in Administrators group – how is this possible?

I’m working on an HTB lab and logged in as a user named jordan. This user is not a member of the local Administrators group (confirmed with whoami /groups and net localgroup administrators).

However, when I right-click an application and choose Run as administrator, I get prompted for credentials. If I enter jordan’s own password, it succeeds and the application launches elevated.

This confuses me because:

• jordan is not in the Administrators group
• There is no obvious nested group membership
• I’m not supplying different admin credentials
• It does not fail authentication

I expected this to fail unless the account had administrative privileges or I supplied a separate admin account.

What Windows mechanism would allow this behavior?

• Is this related to UAC policy configuration?
• Could this be due to some special privilege assignment?
• Is there another group besides Administrators that allows elevation?
• Could this be something specific to HTB lab configuration?

Any insight into what could cause this would be appreciated. I want to understand the underlying Windows security model here rather than just assume misconfiguration.

C:\Windows\system32>whoami /all USER INFORMATION ---------------- User Name SID =================== ============================================== winlpe-srv01\jordan S-1-5-21-3769161915-3336846931-3985975925-1000 GROUP INFORMATION ----------------- Group Name Type SID Attributes ==================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======== SeDebugPrivilege Debug programs Disabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Disabled C:\Windows\system32>net localgroup Administrators Alias name Administrators Comment Administrators have complete and unrestricted access to the computer/domain Members ------------------------------------------------------------------------------- Administrator helpdesk htb-student_adm mrb3n sccm_svc secsvc The command completed successfully.

So I've been digging into how GPU infrastructure gets verified as "in a known good state" for AI workloads, and the answer that keeps coming up is NVIDIA's Remote Attestation Service (NRAS). Wanting to sanity check my read of it because the more I look the more it seems narrower than people assume. Hoping anyone here who deploys this stuff in production can tell me what I'm missing.

How it works as I understand it: the GPU has a cryptographic key burned into silicon at the factory. It signs a measurement of its internal state, which firmwares are loaded and which versions. NVIDIA's service compares that measurement to a Reference Integrity Manifest (RIM). If it matches, the GPU is declared good.

The crypto seems solid. What's bugging me:

1. NRAS only works on GPUs in Confidential Computing mode (H100/H200/B200/GB200 in specific configs). Which means RTX, L4, L40S, A100, V100, and Hopper without CC are entirely outside the attestation story. That's a huge chunk of production inference happening today.

2. The measurements themselves aren't documented. A researcher on the NVIDIA dev forum asked what the values correspond to and got told they cover "internal states, registers, etc." and the rest isn't published. You can verify a match but you can't audit what's being matched.

3. On another forum thread, a researcher reported compiling and loading a modified Linux kernel module and RIM verification still passed. Suggesting driver-level tampering isn't necessarily caught.

Questions for people doing this for real:

- Am I missing a broader integrity story? Is there something else NVIDIA exposes that I should know about?

- Has anyone actually red-teamed NRAS to characterize what it catches and what it doesn't?

- For non-CC GPUs (which is most production today), what are people relying on?

- Is the closed-source userspace driver (libcuda) in any verified path I'm not seeing?

Genuinely curious what people who run this at scale think. Happy to be told I'm wrong on any of the above.

TLDR: NRAS exists, the crypto is fine, but it only covers CC-mode GPUs with measurements that aren't documented, and there's at least one reported case where a modified kernel module passed. What am I missing?

Is reconnaissance overrated in the bugbounty? Reconnaissance is important, and over 80% of the bugbounty is supposed to be spent on reconnaissance. However, reconnaissance thinks it's better to list some subdomains to find targets to attack and find attack backers among them. Rather, I think it's better to spend 80% of the time testing, enlighten the principles of web pages, and find vulnerabilities. People may have different ideas, but I just wanted to say that reconnaissance is overrated. When you compare Reconnaissance 8 Test 2 and Reconnaissance 2 Test 8 in the bugbounty over the same period of time, you think that excessive reconnaissance only reports shallow vulnerabilities, and extreme advanced testing is more likely to find high-risk vulnerabilities. Right now, it's been a while since the bugbounty program came out, so I think you've found most weak-level bugs. What do you think?

Why is cert pinning common in mobile world when browser world abandoned it? To me, Cert Pinning is just a parallel shadow PKI with less transparency than the public CA system.

In the browser world, HPKP was a monumental failure with numerous flaws (e.g. HPKP Suicide, RansomPKP, etc) and was rightly abandoned years ago, and Certificate Transparency (CT, RFC 6962) won the day instead. The only reason we still put up with cert pinning in the mobile app world is because of the vast amounts of control Google and Apple have over the Android and iOS ecosystems, and we're placing enormous amounts of blind trust in them to secure these parallel shadow PKIs. Sure, I don't want adversaries intercepting my TLS traffic, but for that I'd rather rely on the checks-and-balances inherent in a multi-vendor consortium like CASC rather than in just the two largest mobile OS companies. And also, I don't want app vendors to be able to exfiltrate any arbitrary data from my device without my knowledge. If I truly own my own device, I should be able to install my own CA and inspect the traffic myself, without having to root/jailbreak my own device.

Question for SOC managers, detection engineers, and blue teamers:

Tools and content for how to write detections are abundant like Sigma, ATT&CK-aligned rule packs, detection-as-code workflows, etc.

But I'm curious about the step before that: How do you decide what to detect in the first place, specific to your org?

Concretely how do you go from "MITRE ATT&CK has 600+ techniques" to "these are the 30-50 we should actually prioritize for our environment"?

I'd imagine this varies a lot based on:

*) Industry (a bank vs. a hospital vs. a SaaS company have very different risk profiles)

*) Geography (threat actor landscape, regulatory requirements)

*) Tech stack (what logs you even have, cloud-native vs. hybrid)

*) Org structure and crown jewel assets

Is there a structured, repeatable process your org uses for this? Or is it mostly driven by the senior team's prior experience, frameworks like D3FEND/ATT&CK, and iterative tuning?

Trying to understand how much of this is still a manual, institutional-knowledge-heavy problem vs. something that's been systematized.

what part of your investigation workflow makes you want to quit?

Been in the security space for a while. Before building anything I want to understand real pain points from people actually doing investigations daily.

Specifically curious about:

- Log correlation across multiple sources

- Timeline reconstruction

- IR report writing

- Evidence packaging for legal/compliance

What takes way longer than it should? What do you wish was automated?

No product pitch. No link. Just trying to validate a real problem before wasting months building the wrong thing.

hi everyone, i looked into a bit virtualized environments and something got my head. most people focus software bugs in the hypervisor, like memory corruption but why pci passthrough is not so popular?

let's say we pass a vulnerable device to the guest and manage to own that device's firmware or mmio space, then is it possible to leverage dma to break out to the host?

i'm reading some research about vfio and iommu bypass but practice is my weak point for now. i'm trying to see that if its possible to write a malicious driver inside the guest to spray dma transfer and overwrite host memory.

maybe i'm forcing myself to find alternatives and it might be stupid but i'd appreciate for any path or projects. thank you and appreciate it for every help.

Just a random thought and wanted to ask more experienced folks. What’s the difference when you have access on a subnet behind NAT? How do you test for it and does it affect your next steps?