#security-by-design — Public Fediverse posts

Erfrischend ausgewogene Einordnung von Anthropics generativem LLM Mythos, das auf das Finden von Sicherheitslücken trainiert ist. Zwischen Katastrophen-Porno und dem üblichen Ignorieren könnte dies der Weckruf sein, endlich konsequent IT-Sicherheit und Security by Design ernst zu nehmen. https://www.derstandard.de/story/3000000318156/die-mythos-panik-wie-gefaehrlich-das-neue-ki-modell-von-anthropic-wirklich-ist

#ITSicherheit #SecurityByDesign #Mythos

🇪🇺📢 As #ChatControl will hopefully end, a new study proves mass scanning tech is flawed & easily evaded. 🔬

To truly protect kids now, we must shift from broken algorithms to targeted police work 🕵️‍♂️ and strict #SecurityByDesign 🛡️.

Read: https://www.patrick-breyer.de/en/end-of-chat-control-paving-the-way-for-genuine-child-protection/

🇩🇪📢 Neue Studie passend zum mgl. #Chatkontrolle-Aus: Massenscan-Technik ist fehlerhaft und leicht zu umgehen. 🔬

Um Kinder jetzt wirklich zu schützen, brauchen wir gezielte Ermittlungen 🕵️‍♂️ und sichere Apps #SecurityByDesign 🛡️.

Infos: https://www.patrick-breyer.de/ende-der-chatkontrolle-weg-frei-fuer-echten-kinderschutz/

🏋️ 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲 𝗙𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻𝘀/𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴𝘀 (𝟮/𝟭𝟮): "Beyond Whiteboard Hacking: Master AI-Enhanced Threat Modeling" 𝗽𝗮𝗿/𝗯𝘆 Steven Wierckx (Toreon)

📅 Dates: May 11 and 12, 2026 (2 days)
📊 Difficulty: Medium
🖥️ Mode: On-Site

Description: "𝘛𝘩𝘪𝘴 𝘵𝘳𝘢𝘪𝘯𝘪𝘯𝘨 𝘵𝘢𝘬𝘦𝘴 𝘺𝘰𝘶 𝘥𝘦𝘦𝘱 𝘪𝘯𝘵𝘰 𝘵𝘩𝘦 𝘱𝘳𝘢𝘤𝘵𝘪𝘤𝘢𝘭 𝘸𝘰𝘳𝘭𝘥 𝘰𝘧 𝘵𝘩𝘳𝘦𝘢𝘵 𝘮𝘰𝘥𝘦𝘭𝘪𝘯𝘨, 𝘤𝘰𝘮𝘣𝘪𝘯𝘪𝘯𝘨 𝘩𝘢𝘯𝘥𝘴-𝘰𝘯 𝘦𝘹𝘦𝘳𝘤𝘪𝘴𝘦𝘴 𝘢𝘯𝘥 𝘳𝘦𝘢𝘭-𝘸𝘰𝘳𝘭𝘥 𝘴𝘤𝘦𝘯𝘢𝘳𝘪𝘰𝘴. 𝘛𝘩𝘪𝘴 𝘩𝘢𝘯𝘥𝘴-𝘰𝘯 𝘵𝘩𝘳𝘦𝘢𝘵 𝘮𝘰𝘥𝘦𝘭𝘪𝘯𝘨 𝘵𝘳𝘢𝘪𝘯𝘪𝘯𝘨 𝘰𝘧𝘧𝘦𝘳𝘴 𝘢𝘯 𝘪𝘮𝘮𝘦𝘳𝘴𝘪𝘷𝘦 𝘦𝘹𝘱𝘦𝘳𝘪𝘦𝘯𝘤𝘦, 𝘨𝘳𝘰𝘶𝘯𝘥𝘦𝘥 𝘪𝘯 25 𝘺𝘦𝘢𝘳𝘴 𝘰𝘧 𝘱𝘳𝘢𝘤𝘵𝘪𝘤𝘢𝘭 𝘦𝘹𝘱𝘦𝘳𝘵𝘪𝘴𝘦, 𝘢𝘯𝘥 𝘳𝘦𝘧𝘪𝘯𝘦𝘥 𝘧𝘰𝘳 𝘰𝘷𝘦𝘳 𝘢 𝘥𝘦𝘤𝘢𝘥𝘦 𝘰𝘧 𝘥𝘦𝘭𝘪𝘷𝘦𝘳𝘺 𝘢𝘵 𝘉𝘭𝘢𝘤𝘬 𝘏𝘢𝘵, 𝘢𝘷𝘰𝘪𝘥𝘪𝘯𝘨 𝘢 𝘭𝘦𝘤𝘵𝘶𝘳𝘦-𝘩𝘦𝘢𝘷𝘺 𝘢𝘱𝘱𝘳𝘰𝘢𝘤𝘩 (70% 𝘰𝘧 𝘵𝘩𝘦 𝘤𝘰𝘶𝘳𝘴𝘦 𝘪𝘴 𝘧𝘰𝘤𝘶𝘴𝘦𝘥 𝘰𝘯 𝘦𝘹𝘦𝘳𝘤𝘪𝘴𝘦𝘴 𝘵𝘰 𝘳𝘦𝘪𝘯𝘧𝘰𝘳𝘤𝘦 𝘭𝘦𝘢𝘳𝘯𝘪𝘯𝘨). 𝘉𝘺 𝘵𝘩𝘦 𝘦𝘯𝘥 𝘰𝘧 𝘵𝘩𝘪𝘴 𝘵𝘳𝘢𝘪𝘯𝘪𝘯𝘨, 𝘺𝘰𝘶 𝘸𝘪𝘭𝘭 𝘸𝘢𝘭𝘬 𝘢𝘸𝘢𝘺 𝘯𝘰𝘵 𝘫𝘶𝘴𝘵 𝘸𝘪𝘵𝘩 𝘬𝘯𝘰𝘸𝘭𝘦𝘥𝘨𝘦, 𝘣𝘶𝘵 𝘵𝘩𝘦 𝘢𝘣𝘪𝘭𝘪𝘵𝘺 𝘵𝘰 𝘱𝘳𝘢𝘤𝘵𝘪𝘤𝘦 𝘵𝘩𝘳𝘦𝘢𝘵 𝘮𝘰𝘥𝘦𝘭𝘪𝘯𝘨 𝘦𝘧𝘧𝘦𝘤𝘵𝘪𝘷𝘦𝘭𝘺 𝘪𝘯 𝘺𝘰𝘶𝘳 𝘰𝘳𝘨𝘢𝘯𝘪𝘻𝘢𝘵𝘪𝘰𝘯. "
🔗 Full Training Details: https://nsec.io/training/2026-beyond-whiteboard-hacking-master-ai-enhanced-threat-modeling/

👨‍🏫 About the trainer:
Steven Wierckx (Toreon) is a seasoned software and security tester with 15 years of experience in programming, security testing, source code review, test automation, functional and technical analysis, development, and database design. Steven shares his web application security passion by writing about and through training on testing software for security problems, secure coding, security awareness, security testing, and threat modeling. He’s the OWASP Threat Modeling Project Lead and organises the BruCON student CTF. Last year, he spoke at Hack in the Box Amsterdam, hosted a workshop at BruCON, and provided threat modeling training at OWASP AppSec USA and O’Reilly Security New York.

#NorthSec #cybersecurity #threatmodeling #AIsecurity #LLM #DevOps #securitybydesign

A clear take on why less data brings more trust, more value, and more power to teams. #privacyfirst #dataminimization #ethicaltech #digitaltrust #securitybydesign #dataethics #cxothoughts #techleaders
https://www.linkedin.com/pulse/data-purpose-power-privacy-first-world-sanjay-k-mohindroo--f03fc

Computer Security Day 2025: Fraunhofer FOKUS und das @Weizenbaum_Institut betonen digitale Resilienz für Staat, Wirtschaft & Gesellschaft. Cyberangriffe und Regulierung erfordern #SecurityByDesign und Zusammenarbeit aller Akteure: ➡️ https://www.fokus.fraunhofer.de/de/newsroom/news/computer_security_day.html

#Cybersecurity #Cybersicherheit #SecurityByDesign

𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗖𝘂𝗿𝗮𝘁𝗼𝗿𝘀 𝗼𝗳 𝘁𝗵𝗲 𝗡𝗲𝘄 𝗖𝗣𝗦𝗔-𝗔 𝗠𝗼𝗱𝘂𝗹𝗲 𝗘𝗠𝗕𝗘𝗗𝗗𝗘𝗗𝗦𝗘𝗖! 🔐

We spoke with Felix Bräunling and Isabella Stilkerich about the new Advanced Level module #EmbeddedSecurity for Architects. They share why embedded security matters, how safety and security intersect, and which skills architects need to design secure embedded systems.

Dive into the full interview 👉 https://t1p.de/k3rzl

#CPSA #AdvancedLevel #SoftwareArchitecture #EMBEDDEDSEC #SecurityByDesign #EmbeddedSystems #iSAQB

Die #Denkwerkstatt2025 steht vor der Tür! Diskutiert mit uns über die Zukunft der #Cybersicherheit und entscheidet über die neuen Workstreams. Grundlage: 12 Ideen-Skizzen, von denen zwei in agile Projekte überführt werden. Die Bandbreite reicht von #ThreatIntelligence für die öffentliche Hand, über #ZeroTrust an der Hochschule bis zu #SecurityByDesign in #KI. Seid am 14. und 15. November in Berlin dabei. 👉 https://www.dialog-cybersicherheit.de/denkwerkstatt/

#DiCySi

Cybersecurity specialist Exein partners with Kontron to embed autonomous protection into industrial and IoT systems— two European tech companies joining forces just as the EU Cyber Resilience Act raises the bar for #SecurityByDesign.

A big step toward digital sovereignty and resilience in connected industries.
🔗 https://www.movetheneedle.news/technology/strengthening-europe-s-cybersecurity-ecosystem/

#Cybersecurity #DigitalSovereignty #EU #technology #business #industry

Tara from Sovereign Tech Agency and Hugo will be hosting the next 'Memory Safety in the EU' meeting in Amsterdam, on Tue 26 Aug (during #OSSummit).

The meeting aims to finalise a statement on the importance of memory safety for security by design. This is a joint effort by several European stakeholders to put memory safety on the agenda of both industry and policy makers.

Read more here: https://tweedegolf.nl/en/blog/160/update-on-our-advocacy-for-memory-safety

@tarakiyee
@sovtechfund

#memorysafety #securitybydesign

🔐 Vernetzte Geräte und Cybersicherheit: Viele Smart-Home-Produkte haben gravierende Sicherheitslücken, z.B. schwache Passwörter oder unverschlüsselte Datenübertragung. Neue EU-Funkrichtlinien ab 1. August sollen Standards verschärfen. Händler & Konsumenten sind gefragt! 👉 https://www.srf.ch/sendungen/kassensturz-espresso/espresso/cybersicherheit-fuer-zuhause-vernetzt-aber-sicher-neue-regeln-fuer-smarte-geraete #Cybersicherheit #SmartHome #SecurityByDesign #IoT #newz

One of our founding directors, Mike Eftimakis, sat down with Akshaya Asokan from Information Security Media Group (ISMG) to explore how CHERI is helping tackle one of cybersecurity’s biggest challenges: memory safety.

CHERI (Capability Hardware Enhanced RISC Instructions) is a hardware-based approach to security, designed to prevent around 70% of today’s common vulnerabilities. Backed by industry leaders and the UK government, we're working to ensure global adoption across the electronics supply chain.

Watch the interview to learn more about:

💠 How CHERI addresses memory safety issues
💠 Common hardware supply chain vulnerabilities
💠 Progress on adoption by chipmakers
💠 Scalability challenges associated with CHERI

🎥 Watch the full interview: https://www.bankinfosecurity.com/uks-cheri-alliance-expands-to-global-hardware-supply-chain-a-28942

#CHERI #CyberSecurity #HardwareSecurity #MemorySafety #SecurityByDesign #InfoSec

🔧 Right to repair, but not to fix security?

Framework’s philosophy empowers users to open, upgrade, and repair their devices. But with great openness comes a security catch.

On the Framework 13, pressing the chassis intrusion switch 10 times resets the BIOS, removing passwords, Secure Boot, and more.

We flagged this to Framework. Their response?
"It's a feature..."

That’s risky. This reset might help with recovery, but it also hands an attacker physical access to critical settings.

Kieran explains the issue, what this means for security, and how to protect your device.

📌Read here: https://www.pentestpartners.com/security-blog/framework-13-press-here-to-pwn/

#RightToRepair #HardwareSecurity #FrameworkLaptop #BIOSReset #SecurityByDesign #CyberSecurity

Are Web Components & Cybersecurity A Better Combo?

I'm not trying to dunk on popular #UI #frameworks – I'm sure they're totally fine for #cybersecurity stuff, probably get loads of reviews and #audits.

But from my angle: Web Components are *native* to the #browser. Doesn't that just inherently reduce the risk of **#SupplyChainAttacks** (you know, like a rogue `npm install` on a bad network) for your #AppSecurity?

Or am I overthinking it, and the #framework choice is less important than the #browser, #OS, or #device running it? What are your thoughts, #DevCommunity?

---

Quick context: I've got a #ReactJS #messagingApp (repo here: https://github.com/positive-intentions/chat) and a separate #UIFramework (repo here: https://github.com/positive-intentions/dim) built with #Lit (which uses Web Components). I'm genuinely wondering if there's a compelling #cybersecurity reason to refactor the chat app to use my #WebComponent UI framework. Might be a whole new level of #SecurityByDesign for #FrontEndDev.

FYI, same question's on Reddit here: https://www.reddit.com/r/ExperiencedDevs/comments/1lmk1rg/are_web_components_better_for_cybersecurity/, got some good #insights, but want to make sure nothing's getting overlooked! Let's discuss #InfoSec #WebDev #JavaScript #OpenSource #TechQuestion.

Threat Modeling hilft, Risiken früh zu erkennen – bevor sie zum Problem werden. Frag dich im Design: Was kann schiefgehen? Wer könnte angreifen? So entsteht Software, die nicht nur funktioniert, sondern schützt.

Basierend auf: "Threat Modeling" von Adam Shostack.
#SecurityByDesign #ThreatModeling

ICYMI: “Every TWINSCAN EUV ships with ~45 million lines of code […] Bugfixes and features start out as *word documents* sent to a series of review boards…”

Remember, kids: all this security nightmare can be fixed through the simple act of regulators demanding that security be implemented “by design”.

Or not. Because “security by design” doesn’t mean anything.

These are the machines which fabricate all the world’s major CPUs:

https://twitter.com/lauriewired/status/1915162540868596081

#bugs #securityByDesign #softwareEngineering

Es kommt auf Hersteller und Entwickler an, um die Cyberesilienz in Deutschland und Europa zu stärken. Als BSI unterstützen wir euch in Sachen #CyberResilienceAct. Weitere Infos zum #CRA liefert euch der aktuelle Lagebericht zur IT-Sicherheit in Deutschland:➡️ https://bsi.bund.de/Lagebericht sowie unsere Webseite ➡️ https://www.bsi.bund.de/dok/CRA, die auch zu den Handreichungen führt.

#LageKennenResilienzStärken #CybernationDeutschland #CRA #SecurityByDesign #SecurityByDefault

Wir waren Teil der 5G.NRW-Jahreskonferenz. 🙌 Hier kamen Expertinnen und Experten aus Forschung, Wirtschaft und Politik zusammen, um über Chancen und Herausforderungen von #5G und #6G zu diskutieren.

Unsere Präsidentin Claudia Plattner legte in ihrer Keynote einen klaren Fokus auf #Cybersecurity, Resilienz und Souveränität: Wir brauchen dringend #SecuritybyDesign – nur so können wir eine zukunftsfähige und vertrauenswürdige digitale Infrastruktur schaffen, die uns allen nachhaltig dient.

Another good @lawfare entry in the #SecuritybyDesign series: https://www.lawfaremedia.org/article/privacy-by-design--lessons-for--security-by-design

⚠️ #EuGoingDark – 🇪🇺's clandestine #surveillance plan is about to be finalized:

15 Nov.: final meeting
27 Nov.: presentation of final report

→ @andre_meister has a new document: https://chaos.social/@andre_meister/113361602775442149

Overview of the plan: https://www.patrick-breyer.de/en/posts/going-dark-expert-group-eus-surveillance-forge/
🚫 #DataRetention
🚫 " #SecurityByDesign "
🚫 access to devices
🚫 undermining #encryption #e2ee

#FreedomNotFear #FnF #privacy

EU-Rat bringt #CyberResilienceAct auf den Weg | heise online https://www.heise.de/news/EU-Rat-bringt-Cyber-Resilience-Act-auf-den-Weg-9977103.html #SecurityByDesign #CRA