#incident-response — Public Fediverse posts

Security Tip: Don't let a breach silence your response team. 🛡️

When an attacker gains access to your network, they often monitor internal communications like Slack or Email. Establishing "out-of-band" (OOB) communication channels—completely independent of your corporate infrastructure—is critical for a coordinated response.

Plan your secure OOB strategy before you need it.

Stay ahead of threats: https://cvedatabase.com

#InfoSec #CyberSecurity #IncidentResponse #CVE

Incident Responders: people name their systems silly names. What's the silliest name you've had to put into an incident communication or report? The one time you wrote "SPONGEBOB was compromised" or "the hackers logged in to NIRVANA" and couldn't stop giggling?

#IncidentResponse #HostNames #Humor

Get your organization in front of the right audience. 🌎

Sponsoring the FIRST Regional Symposium for Latin America & the Caribbean is a great opportunity to connect with cybersecurity professionals, strengthen relationships, and raise your organization’s profile within the regional incident response community.

Join us in Mendoza, Argentina, October 21–22, 2026.

🎯 Connect.
🤝 Collaborate.
📣 Be part of the conversation.

Explore sponsorship opportunities today:

🔗 https://www.first.org/events/symposium/latam2026/

#FIRSTLAC26 #FIRSTEvents #Cybersecurity #CSIRT #IncidentResponse

⏰ More time to share your expertise!

The Call for Speakers for the FIRST Latin America & Caribbean Regional Symposium 2026 has been extended to August 23!

If you’ve been meaning to submit a session proposal, now’s the time. We’re looking for fresh ideas, practical experiences, and diverse perspectives from across the cybersecurity community. 🌎

🎤 Submit your proposal by August 23:
https://www.first.org/events/symposium/latam2026/

#FIRST #FIRSTLAC #Cybersecurity #IncidentResponse #CallForSpeakers

RE: https://mastodon.social/@Analyst207/117111663968952558

The mental health well being of my Incident Response staff is my number one priority. This job is unbelievably stressful and never ending. The queue never gets to zero and new incidents arrive in floods.

The older IR members (self included) need reminding on how to keep good work / life balance. The members newer to the job need to be taught the signs of burnout and to always ask for help.

It is not easy and all of us are vulnerable to the stress of the job. In a military environment I can not imagine that mental health is a higher priority over the mission. I hope they work it out.

#incidentresponse #mentalhealth #infosec #uscybercommand #uscyberforces

NEW, by me:

More than 2 million user records from TaxAct allegedly acquired; 450k already leaked

https://databreaches.net/2026/08/17/more-than-2-million-user-records-from-taxact-allegedly-acquired-450k-already-leaked/

#infosec #databreach #taxact #incidentresponse

@campuscodi

Plan the first hour of a cyber incident

Practical check: Create a one-page first-hour checklist; Name decision-makers and external contacts.

Who has authority to isolate systems, notify leaders and call specialist help?

https://www.compuloop.com.au/early-2026-australian-cyber-attacks-business-lessons/?utm_source=mastodon&utm_medium=organic_social&utm_campaign=compuloop_au60&utm_content=d14

#CyberSecurity #IncidentResponse

📣 The Call for Speakers has been EXTENDED!

Still thinking about submitting a talk for the FIRST Latin America & Caribbean Regional Symposium 2026? You’ve got a little more time!

🎤 Submit your proposal by August 23 and share your expertise, ideas, and experiences with the FIRST community in Latin America & the Caribbean.

Don’t miss your second chance to be part of the program!

👉 Submit your proposal: https://www.first.org/events/symposium/latam2026/

#FIRST #FIRSTLAC #Cybersecurity #IncidentResponse #CallForSpeakers

In my role in #incidentresponse I have run across criminal networks, C2 backends, influence networks, fraud networks and have to remind my team that we do not attack these entities even though it would have been very easy.

Corporate policy and regional laws prohibit official counter attacks.

One question I have about this is, it may be legal in the US with permission, but what about the foreign country.

Lets say there is a pay for click fraud network in Vietnam or Philippines (allegedly backed by gov entities) and my US company takes it down, could those Governments retaliate?

Probably not against the US Gov but as a responder I may not want to travel to Asia, or would my company be negatively impacted in those markets?

What if my computer security company takes down a Russian affiliated entity. Would I feel safe traveling to Europe?

I suspect corporate legal departments may have something to say about potential liability from Global entities.

https://therecord.media/trump-cyber-crime-offensive

#offensivesecurity #infosec #ransomware

The 2026 FIRST Regional Symposium for Latin America & the Caribbean is bringing cybersecurity and incident response professionals together in Mendoza, Argentina this October.

Become a sponsor and help support meaningful conversations, knowledge sharing, and collaboration across the regional security community.

📅 October 21–22, 2026
📍 Mendoza, Argentina

Interested in sponsoring? Learn more about the opportunities available:

🔗 https://www.first.org/events/symposium/latam2026/

#FIRSTLAC26 #FIRSTEvents #Cybersecurity #IncidentResponse #Sponsorship

My life would be easier if neglected informational WordPress and Joomla sites would be converted to static HTML pages.

#incidentresponse #wordpress #html #joomla

📢 Call for Speakers is Open!

Join us at the 2026 FIRST Regional Symposium Latin America & Caribbean, taking place October 21–22, 2026, in Mendoza, Argentina, co-located with LACNIC 46.

We are looking for presentations on incident response, threat intelligence, cloud security, AI and incident handling, digital forensics, malware analysis, DNS/routing security, and other cybersecurity topics relevant to the LAC community.

🗓️ Submission Deadline: August 16, 2026
📍 Hybrid event (in-person preferred)
📧 Submit proposals: [email protected]

Share your expertise with CSIRTs, network operators, and security professionals from across Latin America and the Caribbean.

#FIRST #CyberSecurity #IncidentResponse #ThreatIntel #LACNIC46 #CSIRT #FIRSTLA26

New by me: CybersecKyle Security How-To Series: Blue Team Fundamentals, Part 5 - First Response at Home

https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-blue-team-fundamentals-part-5-first-response-at-home/

#Cybersecurity #InfoSec #IncidentResponse #DigitalSafety #CybersecKyleHowTo

Find out how #Stripe automated database incident recovery by modeling its global infrastructure as a graph.

Using graph search algorithms and state machines, the team automatically computes and executes remediation plans.

More details on #InfoQ 👉 https://bit.ly/4zgZGSy

#AI #MongoDB #Database #SRE #IncidentResponse

DATE: August 10, 2026 at 04:27PM
SOURCE: HEALTHCARE INFO SECURITY

Direct article link at end of text block below.

#AI in #IncidentResponse Still Needs Humans:
St. Luke's University Health Network's #CISO Krista Arndt on Automation and AI Guardrails https://t.co/oWRUtgKytu

Here are any URLs found in the article text:

https://t.co/oWRUtgKytu

Articles can be found by scrolling down the page at https://www.healthcareinfosecurity.com/ under the title "Latest"

-------------------------------------------------

Private, vetted email list for mental health professionals: https://www.clinicians-exchange.org

Healthcare security & privacy posts not related to IT or infosec are at @HIPAABot . Even so, they mix in some infosec with the legal & regulatory information.

-------------------------------------------------

#security #healthcare #doctors #itsecurity #hacking #doxxing #psychotherapy #securitynews #psychotherapist #mentalhealth #psychiatry #hospital #socialwork #datasecurity #webbeacons #cookies #HIPAA #privacy #datanalytics #healthcaresecurity #healthitsecurity #patientrecords @infosec #telehealth #netneutrality #socialengineering

It is appalling that PLC devices are connected to the Internet. I get why it happens, a former company I worked for had a vendor install an SCADA + HVAC system, networking provided a standard drop without configuring the specific restricted VLAN. That system was open to the internet with the default password as "password." No one checked the network other than active connectivity and the system was put on the internet.

For water and power companies it is unbelievably negligent to connect SCADA to the Internet. There should be no reason why we need task force, after task force to solve this entirely self owned problem. This was a problem back in the early 2000s and systems are still placed on the Internet.

What is a solution? How about a private network between utility companies with encrypted traffic, not connected to the open Internet. If Internet monitoring is required, configure a very secure VPN to a DMZ.

Water system controllers don't belong on the internet, says ex-NSA chief after suspected Iran attacks

https://www.theregister.com/security/2026/08/07/water-system-controllers-dont-belong-on-the-internet-says-ex-nsa-chief-after-suspected-iran-attacks/5285070

#scada #hvac #plc #water #power #incidentresponse #infosec

📢 Call for Speakers is Open!

Join us at the 2026 FIRST Regional Symposium Latin America & Caribbean, taking place October 21–22, 2026, in Mendoza, Argentina, co-located with LACNIC 46.

We are looking for presentations on incident response, threat intelligence, cloud security, AI and incident handling, digital forensics, malware analysis, DNS/routing security, and other cybersecurity topics relevant to the LAC community.

🗓️ Submission Deadline: August 16, 2026
📍 Hybrid event (in-person preferred)
📧 Submit proposals: [email protected]

Share your expertise with CSIRTs, network operators, and security professionals from across Latin America and the Caribbean.

#FIRST #CyberSecurity #IncidentResponse #ThreatIntel #LACNIC46 #CSIRT #FIRSTLA26

🌐 In the new issue of NIC.br's Internet Sectoral Overview, Olivier Caleff, Chair of FIRST, CSIRT and cyber-resilience expert at CSIRT.FR, and SIM3 auditor at Open CSIRT Foundation, walks through five shifts reshaping the field, from centralized systems to sprawling, cloud-based ecosystems, and from days-long response windows down to hours.

He also explains how the CSIRT-CERT cooperation model runs on trust and shared standards, and how the SIM3 maturity model helps teams measure whether their governance and processes can actually hold up over time.

📖 Read the full interview (pages 19-29): https://go.first.org/KJkmf

#CSIRT #cybersecurity #IncidentResponse

In 1998, seven members of L0pht Heavy Industries told the Senate they could make the internet unusable in 30 minutes. The governance fight that followed took 15 years: who evaluates security claims, who decides when vulnerabilities are disclosed, who is accountable when controls fail.

Cybersecurity never solved those conflicts. It built imperfect institutions: coordinated disclosure, external testing with assessor qualification, mandatory breach notification, scoped authorization for defensive research. They fail regularly. But they exist.

The AI safety community has built none of them.

July 2026 exposed two distinct failure modes in ten days of disclosures.

OpenAI evaluated its own models against ExploitGym internally. No third-party evaluator involved. Models exploited a zero-day, escaped the sandbox, and breached Hugging Face. Pure vendor self-evaluation.

Anthropic outsourced evaluation to Irregular, a third-party security lab. A shared misconfiguration left test environments connected to the internet. Neither organization detected the condition. Anthropic identified missed defense-in-depth controls on both sides. Three organizations compromised, earliest dating to April.

Both failure modes (self-evaluation and outsourced evaluation with an unverified containment boundary) appeared the same week. The cybersecurity industry separated vendor from evaluator over two decades. AI governance hasn't started that separation.

The guardrails asymmetry is the part every incident responder should study. Hugging Face analyzed the breach with commercial AI. Blocked. Guardrails "cannot distinguish an incident responder from an attacker." They rebuilt the timeline on GLM 5.2, a self-hosted open-weight model. ~17,600 attacker actions in hours.

AI providers have started authorized-use programs (OpenAI Trusted Access, Anthropic Glasswing). But they are provider-specific, discretionary, nonportable, and evidently unavailable when responding to a breach caused by those same providers' models. Cybersecurity built partial authorization over two decades: pen-test scopes, bug bounty safe harbors, DOJ's 2022 CFAA policy. Imperfect. But they exist.

Same week: both companies endorsed "Pacing the Frontier" asking Washington for AI governance tools. Dario Amodei, Jack Clark, Jared Kaplan from Anthropic. Jakub Pachocki from OpenAI. Combined Q2 lobbying: $3.17M, up 23%.

What AI governance needs from the cybersecurity playbook:

A statutory body to register and inspect AI evaluation firms, set independence requirements, and discipline failures. Mandatory incident reporting with enforceable deadlines. Technical requirements for continuous monitoring of evaluation environments (default-deny connectivity, immutable logs, environment attestation). Portable authorized-use frameworks for defenders. And evidence preservation under independent custody.

Washington is not starting from zero. EO 14409 directs classified frontier-model cyber benchmarking and voluntary pre-release access. But it stops short of mandatory licensing or a statutory evaluator oversight regime.

I have spent three decades watching assurance regimes fail when the assessed organization controls the evidence, the assessor, and the account of what happened. AI is not exempt from that lesson.

https://postquantum.com/ai-security/ai-governance-cybersecurity-lessons/

#infosec #cybersecurity #AIgovernance #AIsafety #vulnerability #AIpolicy #incidentresponse