Krebs on Security

Hey, wanted to reply and drop you a note. I'm a co-founder at Aptible, and we spend a lot of time thinking about how to help developers in your situation.

In terms of general reading, I'd suggest:

--------------

Blogs:

Bruce Schneier [0]

Brian Krebs [1]

--------------

Whitepapers:

- Google's BeyondCorp paper touches on issues that most cloud-first companies will find familiar [2]

- AWS has a few that are good for seeing how a large company communicates the scope of it's security program to customers and potential customers. [3] I'd start with "Introduction to AWS Security Processes" aka "Overview of Security Processes" and "AWS Risk and Compliance".

- Verizon's Data Breach Investigations Reports [4]

--------------

Standards:

- Request your IaaS provider's SOC 2 Type II report

- ISO 27001 is worth buying

- The Cloud Security Alliance's CCM tries to cross-map different frameworks, and is a good reference for a high-level rundown of various security management controls and activities [5]

--------------

In terms of books, conferences, and meetups, I'm sure there is good stuff out there that I'm not aware of because of limitations on my time, sorry.

I hope this is helpful. Good luck! You (or anyone reading) can reach out to me at the email in my profile to chat about any of this.

p.s. Shameless plug: We are launching a product for managing infosec + compliance programs at companies like yours.

--------------

[0] https://www.schneier.com/

[1]…

I haven't been able to verify these sort of claims any more than I've been able to speculate it was blanket telco Letters-of-Authorization (LoAs) [0][1] or classic SIM swaps that resulted in the account takeovers. I'm not claiming you're wrong, but given the timing of the LoA fraud and the attacks, it seemed likely to me that this was not an actual web vulnerability.

What makes you believe a specific exploit like that existed against Coinbase's 2FA? And if it existed, then why wasn't that caught in a routine pentest?

[0]: https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/

[1]: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80

Some of the ones I follow:

- Mr. Money Mustache for financial independence and lifestyle: https://www.mrmoneymustache.com/

- Quastor for large-scale engineering: https://www.quastor.org/

- Krebs for IT security: https://krebsonsecurity.com/

- Lenny's newsletter for product development: https://www.lennysnewsletter.com/

- Psychotactics for marketing: https://www.psychotactics.com/

- CTO craft for CTOs: https://ctocraft.com/

- AI and Machine Learning: https://aiweekly.co/

- Programming news: https://www.programmerweekly.com/

- Startups and tech: https://tldr.tech/

- IT engineering trends: https://www.infoq.com/

- For startup founders: http://www.founderweekly.com/

Brian Krebs is great. Back in 2018, I discovered a flaw in a website enabling anyone to track any US cellphone’s location without consent, and I contacted US-CERT and Krebs to break the news (https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/). After checking the locations of several numbers he provided, I remember discussing his need for location privacy - and his shock when he found it was so easy to break. His opsec might be very strict, but when every cellular carrier is eager to sell off your location data, that level of security is absolutely justified.

> Why then do we not take income into account in credit worthiness?

Income is definitely considered in large loans. You’re not going to get a mortgage or a car loan on your credit score alone.

Credit firms also collect a lot of payroll data, but it’s kept separate from what you know as your credit score because they inherently can’t have payroll data for everyone that also has credit history data. The scores must be kept separate as a result.

Here’s just one example of credit worthiness companies expanding their payroll data collection: https://krebsonsecurity.com/2021/07/intuit-to-share-payroll-data-from-1-4m-small-businesses-with-equifax/

People love to say this, and while I agree with the general gist, there are a couple problems with this statement:

1. For large swaths of the population, hardware key-based 2FA or TOTP-based 2FA are too difficult to use, and they can also be more difficult to remediate if the user loses the hardware key or TOTP secret.

2. SMS 2FA is much better than nothing for most people. The bigger problem is when SMS can be used as just a single factor in account recovery scenarios.

3. There is a push to make telecoms more responsible for sim-swapping fraud: https://krebsonsecurity.com/2021/10/fcc-proposal-targets-sim-swapping-port-out-fraud