Avi Shua

In this Root Causes Podcast episode, Jason Soroko and I define Cryptographic Bill of Materials (CBOM), which is more than a list of your cryptography and where it is. A CBOM need also include information about the PQC readiness of environments, availability of updates, and the importance of secrets.  Audio: https://lnkd.in/gJC5y3at Video: https://lnkd.in/gHuXd69B

22

2 Comments

Adjacent to the RSAC talk I'm delivering tomorrow alongside 😷 Adam Shostack, The Defenders Initiative has posted the first in a series of deep dives on how breaches happen. The first one is on MGM's 2023 breach. We usually know how attackers got in. We usually know what they got away with. But what about everything in-between? Why didn't the security team detect the attack? Why didn't they prevent it? Which security controls failed? What happened to defense in depth? These are just some of the questions we aim to answer with this series. Obviously, this level of breach detail isn't common place, but there are more details out there than you would think (if you know where to look). Oh, and I'll tell you where to look for breach details in tomorrow's RSAC talk as well. Link to the post in the comments.

24

1 Comment

It's amazing how innovative Australia's tech industry is and how many are expanding globally. If global expansion is on your agenda - the Frankie team would be keen share insight on common pitfalls and how to make the expansion a success.

7

Some interesting experimentation today... spun up an Elastic container and tested out the UDRL/Sleepmask combo from my new ZPS course. I was expecting to trigger this (https://lnkd.in/gei3CYZE) rule concerning suspicious networking DLL's like Wininet.dll being loaded into a process with a call stack containing unbacked memory, as commonly found when shellcode is injected into memory allocated with things like VirtualAlloc. This was the case for my test scenario, where I used a simple loader program to execute my UDRL, which in turn maps the Cobalt Strike Beacon DLL into memory and resolves its imports, to include loading Wininet.dll into the process. Strangely, the alert did not fire. After attaching a debugger and setting a breakpoint on the NtMapViewOfSection call made by LdrLoadDll to map Wininet.dll into the process, the call stack was examined in Process Hacker. While unbacked memory addresses were present in the call stack, there was also an entry for gpvsvc.dll- this is a random address leaked from the stack as a result of the underlying code residing in unbacked memory, not an actual return address. All the same it is enough to break the detection rule's logic, which expects the matching call stacks to begin either with an ntdll address or an unbacked one- not an address from another DLL that happens to be mistakenly parsed as part of the call stack. While the tooling currently bypasses this detection rule by sheer luck / random chance, it's better to have a reliable method for doing so- one that is currently being engineered and will be added to the UDRL and Sleepmask course as part of the first update. Had a great conversation with Joe Desimone about this who confirmed my suspicions. Huge shoutout to the Elastic team, their open-sourcing of detection rules provides an incredible resource to develop offensive tooling around and otherwise generally does a lot to push the security industry forward. Hope others find things like this interesting too! #malware #edr #cobaltstrike #cybersecurity #Windows #redteam

212

2 Comments

Catching up on Zscaler's Q2'26 earnings report... This was a solid report all around, but the market took their stock price for a ride. It was immediately down ~9% (even after a beat-and-raise), but has corrected nicely since January. Analysts are mostly bullish, too. The headline narrative was all about AI (naturally), but the current growth engine is a lot more meat-and-potatoes. AI revenue is still immaterial (for a company of Zscaler's size). Totally fine, but the market priced its their skepticism over the timeline. The real driver of Zscaler's business right now is Zero Trust Everywhere. Philosophically, they're betting architectural coherence can beat out portfolio breadth as we get further into the AI era. Several thoughts: → Zero Trust Everywhere is the current growth engine. Customers adopting Users, Branch, and Cloud grew from 130 to 550 in one year (4x growth), which drives 2-3x ARR uplift on conversion. This is the Zscaler-flavored way of platform building: A very specific vision of architecture gets adopted across large, complex customers and displaces established networking products. Zero Trust Branch replaces SD-WAN and MPLS, Zero Trust Cloud replaces virtual firewalls...you get the idea. Good quote from Jay Chaudhry that sums this up nicely: "I don't find any Zscaler customer who says 'I love my SD-WAN.' They all want to replace SD-WAN for cost reasons and for security reasons." → Z-Flex creates multiyear commitments with built-in upsell mechanics. Zscaler has continued to make pretty good progress on Z-Flex: $290M TCV in Q2 alone (up 65% QoQ), $650M total since launch ~1 year ago, average deal is 8-figure TCV, ~4-year term. The point of tension people picked up on was that Z-Flex deals are back-weighted. Revenue ramps over 6-12 months, creating short-term ARR headwinds even as long-term visibility strengthens. This is just part of the deal when you're in a relatively mature market segment trying to displace entrenched incumbents. Zscaler is doing what it has to do, even if investors don't love it right now. → Good news for everyone on AI budgeting? Brian Essex asked a great question, summarized as: where is AI security money coming from? Jay Chaudhry's answer was that it's coming from both existing security budgets *and* new AI project budgets. He specifically mentioned $4-6 on security per $100 AI spend. If AI security revenue is partially incremental (pulled from AI budgets) rather than entirely reallocated (competing for flat security budget share), this is excellent news for all of cybersecurity, not just Zscaler. --- Zscaler did exactly what they needed to do for the midpoint of their fiscal year. This was a clean beat-and-raise quarter with strong execution. The theme to watch for the rest of the year is how their AI story materializes (and SecOps, ofc).

121

2 Comments

I recently talked with a CISO of a big organization who said something that stuck with me: he's not just measuring MTTR, he's also measuring time to RCA (Root Cause Analysis). It made me think about how much gets buried in MTTR. Detection, investigation, containment, remediation. It all blends into one number, and you lose sight of how long it actually took to investigate. And that's a shame, because there's a lot you can do to optimize that part specifically. When you start paying attention to investigation time, you notice where the hours actually go. The back-and-forth between tools to answer one question. Manually enriching IPs with context that should already be there. Data that's technically there, but not in a shape you can actually use. But if you're measuring time to RCA, it stops being invisible. You start asking: what slowed the investigation down, and more importantly, how do we fix it.

19