The hottest Cybersecurity Substack posts right now

And their main takeaways
Category
Top Technology Topics

“State-in-a-Smartphone” App Helps Ukraine Weather War and Counter Corruption

Natto Thoughts • 39 implied HN points • 02 Jun 23
🌍 World Politics Cybersecurity
  1. Diia app in Ukraine is a prime example of effectively utilizing international aid money and technical savvy to enhance digital governance and counter corruption.
  2. The app has evolved to support citizens during wartime, offering various tools for evacuation, financial support, and information dissemination.
  3. Ukraine's focus on transforming into a non-corrupt, modern state through initiatives like Diia reflects its determination to build a resilient, tech-savvy economy with potential for global export of innovative solutions.

Must Learn AI Security Part 6: Model Inversion Attacks Against AI

Rod’s Blog • 39 implied HN points • 23 Aug 23
🕹 Technology Cybersecurity
  1. A Model Inversion attack against AI involves reconstructing training data by only having access to the model's output, posing risks to data privacy.
  2. There are two main types of Model Inversion attacks: black-box attack and white-box attack, differing in the level of access the attacker has to the AI model.
  3. Model Inversion attacks can have severe consequences like privacy violation, identity theft, loss of trust, legal issues, and misuse of sensitive information, emphasizing the need for robust security measures.

Must Learn AI Security Part 2: Data Poisoning Attacks Against AI

Rod’s Blog • 39 implied HN points • 08 Aug 23
🕹 Technology Cybersecurity
  1. Data Poisoning attacks aim to manipulate machine learning models by introducing misleading data during the training phase. Protecting data integrity is crucial in defending against these attacks.
  2. Data Poisoning attacks involve steps like targeting a model, injecting misleading data into the training set, training the model on this poisoned data, and exploiting the compromised model.
  3. These attacks can lead to loss of model integrity, confidentiality breaches, and damage to reputation. Monitoring data access, application activity, data validation, and model behavior are key strategies to mitigate Data Poisoning attacks.

Cochlear Implant Users Face Grim Future Without Repair or Upgrades

Fight to Repair • 39 implied HN points • 07 Apr 23
🏥 Health Politics Cybersecurity
  1. Cochlear implant users, especially low-income earners, face challenges when their devices become obsolete or in need of repair, potentially leading to loss of hearing if they can't afford upgrades.
  2. Repairing electronics could save Americans $50 billion annually; household could save approximately $382 per year by repairing electronics instead of replacing them.
  3. Tensions between corporate profits and the care of individuals emerge in the realm of medical devices, showing the importance of supporting repair initiatives and community aid over consumption.

Preparing the SOC for Generative AI

Rod’s Blog • 39 implied HN points • 05 Sep 23
🕹 Technology Cybersecurity
  1. Before implementing Generative AI in a SOC, it's important to configure incident tags to provide more information for AI.
  2. Assigning specific incidents to analysts based on skillsets through automation rules can enhance SOC efficiency.
  3. Practicing gathering information to create better Generative AI prompts is crucial for successful AI utilization in a SOC.
Get a weekly roundup of the best Substack posts, by hacker news affinity:

The KQL Mysteries: Chapter 8

Rod’s Blog • 19 implied HN points • 06 Feb 24
🕹 Technology Cybersecurity
  1. A major security breach has occurred with sensitive data stolen, leading to a need for urgent action to track down the threat actor.
  2. Jordan quickly jumps into action, using KQL queries to analyze data and identify patterns associated with the suspected threat actor.
  3. The story leaves readers with a cliffhanger, hinting at upcoming developments and ensuring engagement for the next chapter.

Notes on Volt Typhoon

Cybersect • 19 implied HN points • 02 Feb 24
🕹 Technology Cybersecurity
  1. Warnings about hackers targeting critical infrastructure may not always be accurate.
  2. Defenders should stop relying on source IP addresses to detect attacks.
  3. Hackers are exploiting vulnerabilities in public-facing products quickly, so prompt patching is crucial.

Việt Nam

Thái | Hacker | Kỹ sư tin tặc • 119 implied HN points • 28 Jul 22
🌐 International Cybersecurity
  1. The author will be participating in various events in Vietnam in August 2022, connecting with students and presenting on hacking and defending Vietnamese banks.
  2. There will be a Real World Crypto Day event organized, featuring cryptography experts and discussions on cryptography.
  3. The author humorously mentions creating a new title for himself and hints at organizing an event in Saigon, showcasing a playful approach to self-promotion.

Let's Talk About Malicious Browser Extensions: Part 2

!important • 43 implied HN points • 13 Feb 25
🕹 Technology Cybersecurity
  1. Malicious browser extensions can steal sensitive information like passwords and cookies. This puts users at risk of losing their accounts and personal data.
  2. In workplaces, these risks are even more serious because a breach can affect the whole organization and its customers. It's crucial for businesses to be aware of these dangers.
  3. Many security professionals need better training and tools to recognize the risks of browser extensions and to protect their systems effectively.

The KQL Mysteries: Chapter 7

Rod’s Blog • 19 implied HN points • 30 Jan 24
🕹 Technology Cybersecurity
  1. Jordan Alghamdi is a skilled data analyst in Saudi Arabia who blends tradition with modern technology in her work at a state-of-the-art data center.
  2. The data center where Jordan works represents Saudi Arabia's push towards modernization while preserving tradition, showcasing the country's advancement in technology.
  3. Jordan's use of KQL, a query language, showcases her analytical skills as she unravels complex data to solve mysteries and address potential threats.

💥New Chapter 11 Bankruptcy Filing - Eye Care Leaders Portfolio Holdings LLC💥

PETITION • 19 implied HN points • 21 Jan 24
💼 Business Cybersecurity
  1. Eye Care Leaders Portfolio Holdings LLC filed for Chapter 11 bankruptcy due to ransomware attacks, security breaches, poor management decisions, and high development costs.
  2. The company provides software solutions for ophthalmology and optometry practices, offering services like practice management and electronic health records.
  3. The case highlights the financial challenges and risks faced by technology companies in an environment where cyberattacks and management decisions play a significant role.

Software Supply Chain Attack Types

Resilient Cyber • 79 implied HN points • 28 Feb 23
🕹 Technology Cybersecurity
  1. Software supply chain attacks are not new and have been happening for decades, with many recent high-profile cases shining a light on them.
  2. There are several types of attack vectors, including issues with developer tools, negligence in following security practices, and problems with trust and code signing.
  3. Malicious actors often combine different attack methods to cause harm, so it's important for organizations to have strong security measures in place to protect their software supply chain.

How Adaptive AI Microcontainers Outmaneuver Modern Cybersecurity Threats in AI Workloads

Phoenix Substack • 42 implied HN points • 06 Feb 25
🕹 Technology Cybersecurity
  1. AI workloads are crucial for businesses but can attract cyber threats. These threats target predictable systems and can steal data or disrupt operations.
  2. Static security methods, like firewalls, are not enough to protect AI workloads. New challenges like lateral movement and data theft highlight the need for better security.
  3. Adaptive AI Microcontainers create secure environments by changing and healing themselves automatically. This makes it hard for hackers to predict or exploit the system.

Dissecting the FedRAMP Authorization Act

Resilient Cyber • 99 implied HN points • 04 Dec 22
🇺🇸 U.S. Politics Cybersecurity
  1. The FedRAMP Authorization Act aims to improve how federal agencies adopt cloud services. It highlights the importance of cloud for modernizing old IT systems and creating jobs in the tech sector.
  2. A key change in the legislation is the creation of a Federal Secure Cloud Advisory Committee. This group will include experts from both the government and private sector to streamline cloud service authorizations and improve communication.
  3. Another important aspect is the 'Presumption of Adequacy', which allows agencies to trust existing FedRAMP authorizations without needing extra checks. This should reduce the repetitive security assessments that cloud service providers currently face.

America's Fatal Flaw

Diane Francis • 259 implied HN points • 12 Jul 21
🇺🇸 U.S. Politics Cybersecurity
  1. There's a debate within the U.S. government about how to deal with Russia. Some think we should be tougher, while others seem to want to be more lenient, which could lead to more Russian aggression.
  2. The current U.S. strategy toward Russia is seen as weak. Past actions, like backtracking on sanctions, made Russia feel empowered and might encourage further bad behavior.
  3. America's foreign policy is struggling to understand Russia's true nature. Unlike during the Cold War, today's leaders often lack the expertise or experience to effectively counter Russian threats.

Thoughts on the MOVEit hack

Frankly Speaking • 203 implied HN points • 20 Jun 23
🕹 Technology Cybersecurity
  1. The MOVEit hack highlights issues with software age and responsible disclosure.
  2. Progress handled the security incident well but third-party risk management needs a shift towards evaluating vendor security culture.
  3. Security teams should focus less on questionnaires and more on vendor security roadmap and practices.

Enter the Matrix

Resilient Cyber • 79 implied HN points • 13 Feb 23
🕹 Technology Cybersecurity
  1. The Cyber Defense Matrix helps organizations understand their security tools better. It allows teams to see what tools they have, find overlaps, and spot gaps in their defenses.
  2. Cybersecurity tool sprawl is a big issue where companies use many different tools, often without fully understanding how well they work. This can make it harder to respond to threats effectively.
  3. Investing more in technology than in the people and processes can lead to a weaker security response when incidents occur. It's important to balance resources across technology, people, and processes.

Intelligence Failure in Threat Detection

Rhythms of Research • 19 implied HN points • 05 Jan 24
🕹 Technology Cybersecurity
  1. Analysis and operation both require prioritization, leading to risks of surprise and inadequate response
  2. Threat intelligence enables better prioritization to focus on effective detection and prevention efforts
  3. Compensate for risks of prioritization by asking hard, self-reflective questions about unlikely events

Passkeys, Phishing-Resistant MFA, and the Passwordless Revolution

Identity Revive • 38 implied HN points • 04 Feb 25
🕹 Technology Cybersecurity
  1. Passkeys use a public-private key system for logging in. This makes them safer than passwords because the private key never leaves your device, reducing the risk of hacking.
  2. Passkeys can sync across devices or stay on one device, offering flexibility for users. This means you can log in from different devices easily without needing to remember passwords.
  3. Major companies like Apple, Google, and Microsoft support passkeys, making them easy to use on different platforms. This helps create a passwordless future that's more secure and user-friendly.

Geopolitical Cyber Warfare

Identity Revive • 38 implied HN points • 26 Jan 25
🕹 Technology Cybersecurity
  1. Nation-state cyber attacks are on the rise, with groups like Silk Typhoon and Salt Typhoon targeting critical US infrastructure for espionage and data theft. These attacks show how vulnerable important systems can be.
  2. One effective way to defend against these cyber threats is by sticking to basic security practices. Simple steps can help protect against a wide range of attacks.
  3. Understanding how these threat groups operate is crucial, but often the tactics they use highlight the importance of following established cybersecurity protocols to minimize risks.

Building a Compliance and AppSec Program for a Federal Platform-as-a-Service (PaaS)

Resilient Cyber • 59 implied HN points • 11 Apr 23
🕹 Technology Cybersecurity
  1. Building a compliance and AppSec program for a federal Platform-as-a-Service is challenging. It's important to understand which security controls can be inherited by development teams.
  2. Scaling the compliance program across multiple teams can lead to unique challenges. It's crucial to onboard each team effectively while minimizing their workload.
  3. Developers need support in balancing security and compliance with their work. Educating auditors about cloud practices is also important for smoother collaboration.

In House vs. Outsourced Red Teams (Part 1)

Locks and Leaks • 19 implied HN points • 27 Dec 23
🕹 Technology Cybersecurity
  1. Different organizations may benefit from various approaches to red teaming based on their needs, budgets, and internal capabilities.
  2. There are more nuanced red teaming models than just in-house or outsourced, such as hybrid operator model, learning model, and hybrid mitigation model.
  3. Some discouraged red teaming models include relying solely on part-time teams or contingent workers due to trust, loyalty, and capability concerns.

Breach simulation is a complicated market

Frankly Speaking • 50 implied HN points • 01 Nov 24
🕹 Technology Cybersecurity
  1. The breach simulation market is confusing because companies market their products in different ways. It's hard to understand exactly what these tools are supposed to solve for security teams.
  2. Turning security services into products is challenging. Many customers prefer high-quality services rather than automated tools because they believe they catch more sophisticated attacks.
  3. For these simulation tools to succeed, they need to show clear benefits to businesses, like saving money or preventing incidents. Right now, many organizations view them as nice-to-have rather than essential.

Vulnerability Disclosure Programs (VDP) and PSIRT's

Resilient Cyber • 79 implied HN points • 18 Dec 22
🕹 Technology Cybersecurity
  1. Vulnerability Disclosure Programs (VDP) help software suppliers communicate vulnerabilities to users. Having a clear VDP builds trust and prepares organizations for potential security issues.
  2. A Product Security Incident Response Team (PSIRT) focuses on managing and responding to security issues in products. PSIRTs help organizations effectively analyze vulnerabilities and communicate solutions to their consumers.
  3. Maturity levels for PSIRTs range from basic to advanced, with advanced teams being proactive and integrating security into product development. This approach ensures better security practices and communication throughout the supply chain.

Strengthening security in the Bitcoin ecosystem: the case for improved vulnerability communication

bolt.observer • 19 implied HN points • 18 Dec 23
🕹 Technology Cybersecurity
  1. Vulnerabilities happen in open source projects, impacting the security of bitcoin and other systems.
  2. Communication with users of open source projects, especially in the financial industry, needs to be improved for quick responses to critical issues.
  3. Utilizing RSS feeds exclusively for announcing critical vulnerabilities in software can enhance security communication and response.

OMB 22-18 and NIST's SSDF

Resilient Cyber • 79 implied HN points • 11 Dec 22
🕹 Technology Cybersecurity
  1. Federal agencies must collect self-attestations from software vendors about their secure development practices, following NIST's guidelines.
  2. The NIST Secure Software Development Framework (SSDF) encourages integrating security early in the software development process, rather than addressing it later on.
  3. Industry groups are raising concerns about the requirements for transparency in the software supply chain, which could lead to delays in implementing necessary security measures.

290 Cybersecurity Funding Rounds, 160 Acquisitions

The Security Industry • 13 implied HN points • 23 Jul 25
💼 Business Cybersecurity
  1. In the first half of 2025, cybersecurity funding is on track to exceed $17 billion with 290 investment rounds already recorded. This shows that the industry is recovering and thriving.
  2. Artificial Intelligence security companies are gaining attention and investments, representing 16% of the total funding this year. Data Security and Governance, Risk, and Compliance (GRC) sectors are also popular among investors.
  3. There have been 160 acquisitions in the cybersecurity space, which is slightly higher than the previous year. This suggests that companies are eager to invest in cybersecurity to boost their portfolios.

Announcing LASEC: LLM Application Security Executive Certification

PromptArmor Blog • 92 implied HN points • 20 Mar 24
🕹 Technology Cybersecurity
  1. LASEC is a new certification focused on LLM application security. It aims to educate leaders on current security threats and best practices.
  2. Participants will learn about real-world threats, including a new exploit discovered by PromptArmor. They'll also dive into compliance standards and how to balance security with product development.
  3. The certification program is designed to share knowledge gained from working with top security leaders in Fortune 100 companies, making it a valuable resource for security professionals.

More Fast 50 Under Fifty

The Security Industry • 13 implied HN points • 16 Jul 25
💼 Business Cybersecurity
  1. There are many cybersecurity companies with fewer than 50 employees showing growth. In fact, there are currently 459 of them that have positive growth this year.
  2. Some companies from last year's Fast 50 list have continued to thrive and are on track to join a larger group called the Cyber 150.
  3. Tracking data helps identify which smaller companies are rising quickly in the cybersecurity field, making it easier to spot potential leaders.

Undoing RLHF, prompt injection, and the brittle limits of moderating LLMs

Democratizing Automation • 126 implied HN points • 18 Oct 23
🕹 Technology Cybersecurity
  1. Recent papers challenge the need for safety filters on open LLM weights, suggesting regular releases of parameters.
  2. Fine-tuning LLM safety can be bypassed with minimal supervised examples, raising concerns about robustness.
  3. Moderation in LLMs relates to liability, with Meta emphasizing safety filters in their models, while OpenAI faces challenges due to fine-tuning access.

A Quick Warning

Story Club with George Saunders • 49 implied HN points • 19 Oct 24
🕹 Technology Cybersecurity
  1. Be cautious of fake messages claiming you've been randomly selected for a personal conversation. These messages are not real.
  2. If you receive such a message, it's best to delete it immediately. Don't engage with it or the sender.
  3. Stay safe online by being aware of scams and only trusting verified sources.