Casey Ellis, on the record.
1,355 items across 6 categories: press, broadcast, stage, and paperwork. Captured, displayed, and archived for posterity.
Researchers warn of ‘rosy’ security reports in wake of Twitter whistleblower case
SC Magazine published a feature discussing how the Twitter whistleblower case prompted researchers to warn about unreliable internal security reporting. Casey Ellis contributed perspective on the risks of overly optimistic security assessments and their role in masking actual vulnerabilities within organizations.
Twitter lacks cybersecurity & data privacy best practices, says ex-security chief
A Security Magazine article from August 2022 covers former Twitter security chief Peiter Zatko's whistleblower complaint alleging severe cybersecurity and privacy gaps at the platform. Casey Ellis commented on the implications of Zatko's allegations and the importance of security accountability at major technology companies.
Security Industry Rallies Behind Twitter Whistleblower
Security Boulevard published a report on August 25, 2022, documenting cybersecurity industry support for Twitter whistleblower Peiter Zatko and his allegations of security failures at the company. Casey Ellis joined other security professionals in backing Zatko's claims about Twitter's inadequate security practices and culture.
Security Flash - Apple Vulnerability (CVE 2022-32893)
Bugcrowd hosted a webinar on a zero-day vulnerability affecting multiple Apple products, published on August 24, 2022. Casey Ellis participated in the discussion of CVE-2022-32893 and its implications for Apple users and security teams.
Mudge Blows Whistle on Alleged Twitter Security Nightmare
Dark Reading published an article on Twitter's security practices based on whistleblower Peiter Zatko's complaint to regulators. Zatko characterized Twitter's security posture as a nightmare marked by mismanagement and inadequate safeguards for user data.
Twitter has a security problem
Protocol published an article examining the security and business implications of Twitter's whistleblower complaint from the company's former head of security. Casey Ellis commented on the incident and its broader significance for platform security practices and accountability.
US government set to outlaw leaky software in the military
This IT Pro article from August 2022 reports on planned US military rules requiring secure-by-design software to prevent high-profile security incidents. Casey Ellis, chairman, founder, and CTO at Bugcrowd, says the approach is extremely important given the enormous attack surface of the US government and growing threats from nation-state and criminal hacking groups.
ZERO DAY INITIATIVE CHANGES DISCLOSURE POLICY FOR FAULTY PATCHES
The Zero Day Initiative announced a policy change regarding disclosure of vulnerabilities with faulty or incomplete patches, as reported by Duo Security. Casey Ellis noted the initiative's shift to provide clearer timelines and expectations for vendors releasing defective patches to address coordination gaps.
Taiwan Hit By Multiple DDoS Attacks Following Arrival of Pelosi
IT Security Guru reported on multiple DDoS attacks targeting Taiwan following House Speaker Nancy Pelosi's arrival in the country. Casey Ellis commented on the incident's geopolitical implications and the operational security challenges such coordinated attacks pose to critical infrastructure during politically sensitive events.
U.S. Doubles Reward for Information on North Korea Cyberattackers
A Channel Futures report covers the U.S. government's decision to double its reward to $10 million for information on North Korean state-sponsored cyberattackers. The piece documents the government's escalating efforts to identify and hold accountable those responsible for major cyber operations attributed to North Korea.
Builders and Breakers
Security Boulevard published an opinion piece by Casey Ellis examining the relationship between software developers and security researchers and their need for stronger collaboration. Ellis argues that builders and breakers must work together more effectively to improve overall software security outcomes.
Crypto Firms Make Thieving Hackers an Offer: Keep a Little, Give Back the Rest
A Wall Street Journal article from July 2022 examines the practice of cryptocurrency firms negotiating directly with hackers following thefts, offering them financial incentives to return most of the stolen funds. Casey Ellis is cited on the rationale behind such negotiations and their implications for security practices in the crypto industry.
Latest Atlassian Confluence vulnerability raises concerns
A Computer Weekly news item addresses security concerns following discovery of a critical vulnerability in Atlassian's Confluence software. Casey Ellis comments on the vulnerability's implications and the importance of prompt remediation for affected organizations.
T-Mobile to Pay $350 Million Settlement in Data Breach Class-Action Lawsuit
Channel Futures reported that T-Mobile agreed to pay $350 million to settle a class-action lawsuit stemming from a major data breach. Casey Ellis commented on the settlement's implications for corporate accountability and data protection standards in the telecommunications industry.
Messaging Apps That Are Secure: Signal vs. WhatsApp
TheStreet published an article comparing the security and privacy features of messaging apps including Signal and WhatsApp. Casey Ellis contributed analysis on how these platforms protect user data and the technical differences in their encryption approaches.
Why Current Events Can and Will Affect Your Security Posture
A CISO Series article examines how current geopolitical and social events directly impact organizational security posture and threat landscape. Casey Ellis discusses the connection between real-world events and evolving security risks that organizations must monitor and address in their defense strategies.
Hardcoded password in Confluence app has been leaked on Twitter
Ars Technica reported on a critical vulnerability in Atlassian's Confluence software stemming from a hardcoded password that Atlassian warned was likely to be actively exploited. Casey Ellis contributed analysis on the security implications and exploitation risk of the flaw for the article.
Atlassian warns of several new critical vulnerabilities potentially being exploited in wild
The Record by Recorded Future reported on Atlassian's advisory regarding multiple critical vulnerabilities in its products being potentially exploited in the wild, including a hardcoded password flaw. Casey Ellis commented on the significance of the vulnerabilities and their potential impact on affected organizations.
Labor Department announces 120-day cybersecurity apprenticeship sprint
Fed Scoop reported on the U.S. Department of Labor's launch of a 120-day Cybersecurity Apprenticeship Sprint to address the shortage of cyber professionals. Casey Ellis contributed to the initiative as part of efforts to expand apprenticeship pathways in the cybersecurity field.
Chaotic LAPSUS$ Group Goes Quiet, but Threat Likely Persists
Dark Reading published an analysis of the LAPSUS$ extortion group and their operational tactics in July 2022. The article examines the group's social engineering and data theft methods, with Casey Ellis contributing insight on the persistence of the threat despite the group's irregular activity patterns.
Labor and Commerce departments launch new cybersecurity apprenticeship scheme
Silicon Angle reported in July 2022 on the U.S. Departments of Labor and Commerce launching a new cybersecurity apprenticeship program designed to address a significant workforce shortage. Casey Ellis contributed perspective on the initiative's potential to build a stronger pipeline of skilled cybersecurity professionals into the market.
New cyber apprenticeship initiative to develop & train cybersecurity workforce
Security Magazine published a piece on the Cybersecurity Apprenticeship Sprint, a federal initiative designed to build the U.S. cybersecurity workforce through registered apprenticeships. Ellis contributed to the effort as an advocate for practical, hands-on training models that address the cybersecurity skills gap.
First CSRB Report Tackles on Ongoing Log4j Risk
A Security Boulevard article from July 2022 covers the Cyber Safety Review Board's inaugural report examining the Log4j vulnerability and its sustained threat to organizations. Casey Ellis contributed to the CSRB's findings on Log4j's systemic risk and the need for coordinated remediation efforts across the technology sector.
There is a cybersecurity talent gap across the US. Here's what to put on your résumé to a land high-paying job in the industry.
Business Insider published a 2022 article on building a cybersecurity career resume amid industry talent shortages. Casey Ellis discusses the skills and qualifications employers seek when hiring for high-paying roles in the field.
There is a cybersecurity talent gap across the US. Here's what to put on your résumé to a land high-paying job in the industry.
Business Insider published a careers article on landing high-paying cybersecurity roles in the US job market. Casey Ellis contributed advice on résumé strategies and in-demand skills needed to address the industry's talent shortage.
Log4j incident response within the community shows collaboration & dedication to security
Security Magazine published an article examining the collaborative response from the global cybersecurity community to the Log4j vulnerability crisis. The piece highlights the collective efforts and dedication demonstrated by security professionals in addressing this widespread threat.
Crime Watch: Why Are Ransomware Attacks Intensifying?
Bank Info Security published "Crime Watch: Why Are Ransomware Attacks Intensifying?" discussing ransomware trends and the Cyber Safety Review Board's Log4j vulnerability investigation. Casey Ellis contributes analysis on the escalating ransomware threat landscape and factors driving increased attack frequency against organizations.
CYBER SAFETY REVIEW BOARD: EXPLOITATION OF ‘ENDEMIC’ LOG4J FLAW WILL EVOLVE
Duo Security published coverage of the Cyber Safety Review Board's report on the Log4j vulnerability, which characterizes the flaw as an endemic risk to critical infrastructure. Casey Ellis contributed analysis on how attacker exploitation methods will continue to adapt and evolve over time.
Security chiefs fear ‘CISO scapegoating’ following Uber-Sullivan verdict
A July 2022 article in The Record by Recorded Future examines concerns among security leaders following Joe Sullivan's conviction, with worry that CISOs will face increased legal liability for breaches. Casey Ellis is quoted discussing the risks of scapegoating security executives and the need for clearer accountability frameworks across organizations and boards.
DoD launches ‘Hack US’ bug bounty program
This Cyber Daily article covers the U.S. Department of Defense launching its first "Hack U.S." bug bounty on HackerOne in July 2022. Casey Ellis, founder and CTO of Bugcrowd, says a paid bug bounty makes a lot of sense, noting that DoD's Cyber Crime Center has run a disclosure program for years.