National Security Officer @microsoftcanada via @CDS_GC & @CSE_CST. Mostly just a Dad though. @boardom@infosec.exchange
Ottawa, Ontario
Joined March 2011
- Tweets2.4K
- Following358
- Followers741
- Likes3.4K
Pinned Tweet
The next time imposter syndrome gets you down, or you have this mistaken belief that everyone around/above you 'knows what they are doing'... recite the message below.
John O'Brien retweeted
... sociological experiments with the moods of the simulated humans.
Is the simulated earth and it's inhabitants worth protecting in the same way as the real world?
Holy cow no. The entire discussion is insane.
Honestly curious what SH thought was going to happen poking the bear...
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.
The Dutch High-Tech Crime Unit arrested the suspect under Dutch law. That's exactly how the "best athlete" model in the new FBI Cyber Strategy is meant to work: the partner with the strongest authority and access leads.
The @FBI is grateful to everyone who has assisted us in the ShinyHunters investigation, especially the Dutch National Police and the industry partners who shared information with us.
Took the wrong streetcar last night, *not* to the airport.
Got off, realized I forgot my suitcase.
Back to the office.
Back to the streetcar.
Waltzed into the airport, through security, yay.
Look down. still have my suitcase, the one I was supposed to check-in.
I am an "adult" :)
John O'Brien retweeted
One of the downsides about headline making intrusion news is it's a drop in the bucket for what's actually transpiring. People were always surprised when I told them how many intrusions I would see a year. Only a tiny fraction of those ever made the news.
John O'Brien retweeted
Periodic reminder: Good security architecture minimizes the number of bugs and CVEs you have to care about.
John O'Brien retweeted
As the de facto expert from the NSA who not only develops these types of attacks but also designs and deploys systems to prevent them, I can say will utmost confidence that ASI, with unimaginable capability, will still fall flat when it comes to the physics and coordination required here.
Everyone who gives this type of attack any credence is basing their opinions off of white papers conducted with complete control over all variables, no unknown variables, and with the first-mile problem solved. In the real world things are incredibly noisy and messy - the odds are stacked against ASI in every measurable way.
I have performed TEMPEST attacks in various real world scenarios but there is no scenario where ASI escapes an air-gapped network via a side channel without significant human or other external forces overcoming the first-mile. Even then it would be beyond any reasonable probability.
usenix.org/publications/logi…
If you can't explain how something *actually* works, what hope do you have of noticing (Defending, detecting, responding) when it works *differently*.
Low bar for success these days.
The "whiteboard defense:" I should be able to pull you aside at any moment and ask you to explain any customer-facing system you've shipped. You should be able to clearly explain how it works and defend the decisions you made. This is my benchmark for responsible AI usage.
I don't expect line-level familiarity with the code. I don't care if you remember the exact function name or implementation detail. You may not even know it. I don't care.
But if I ask "why did you do X instead of Y?", "what happens if this actor behaves maliciously?", "what data structure did you use here and why?", or "where does this fail?" you should be able to answer confidently.
For PoCs, demos, experiments, whatever: I don't care. Generate 100% of it and understand none of it. Speed over quality every time in those specific scenarios.
But if you're shipping customer-facing work, you can't be shipping things you don't understand at a high level.
Flashback to days at CDS where our yubkieys regular made themselves known in our org chats.
Can't get my nano to register me when I need it, but God forbid I reach for a glass of water and come withing three feet of it whilst typing.
John O'Brien retweeted
Members of Russian Intelligence Services Network Charged with Conspiring to Finance Terrorism and Commit Murder for Hire in the United States
"charges against five individuals working for the intelligence services of the Russian Federation to conduct attacks and murders around the world, including in the United States."
justice.gov/opa/pr/members-r…
John O'Brien retweeted
Endorse.
Some of us need to put down the Sci Fi books and go touch some grass.
This is what all doomsters say.
God will save believers & everyone else will die.
Climate change will kill us all.
If we don't invade X, or spend trillions in defense, we could all die by nuclear weapons.
Pandemics will cause our extinction.
Bioterrorism could wipe us all out.
A super-volcano, asteroid, comet, black hole, gamma-ray burst, solar flare, etc. will destroy all life on earth.
Media love these claims & just move on to the next one when nothing happens, and never re-interview the person:
"You said humanity would die but it didn't. What do you say now?"
And they never recant: "Just you wait—it's coming soon!"
Anyone know any Google Health PM's?
Think they need a bit more sleep. Switched to kids profile, locked out and can't switch back.
This is fine.
John O'Brien retweeted
Breaking my X hiatus because this is fascinating. I ran threat disruption at Meta for 8 years, where we routinely released reports like the Anthropic report out today. It’s noteworthy that Anthropic is being this transparent, and they deserve credit if we want this level of visibility into AI companies going forward. Here's what stood out to me, and where I'd push back. 🧵
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
John O'Brien retweeted
I have been seeing reverse engineering / malware analysis courses that cost thousands of dollars. Do you know you can actually learn that for free, right? There are also a bunch of other courses out there that are way cheaper or even free:
- courses.0ffset.net/
- malwareanalysis-for-hedgehog…
- invokere.com/
- github.com/RPISEC/MBE
- guyinatuxedo.github.io/index…
- openanalysis.net/
- p.ost2.fyi/
- taomm.org/
John O'Brien retweeted
How to get into InfoSec
Step 1: Find an org with almost no security investments
Step 2: Get compromised, raise hand to fix it
Welcome, you are now in InfoSec
I will be first to line up to donate if only so we can stop talking about 24 Sussex.
We’re restoring 24 Sussex Drive to a standard worthy of the country it serves.
Today, the property sits empty and in critical condition. We’re launching a design-and-build competition to find the best of Canadian talent and expertise — to protect this national landmark, put it back in service, and ensure we leave it better than we found it.
ALT Prime Minister Carney speaking at a podium in front of 24 Sussex Drive.
