David Knickerbocker

I've updated the page for the Encyclopedia of Crash Dump Analysis Patterns, Third Edition, adding all available purchase options https://lnkd.in/gckWeNxe

5

CISA is sounding the alarm over a critical vulnerability in GeoServer that is being actively exploited in the wild, ordering federal agencies to patch immediately. The flaw, tracked as CVE-2025-58360, is an unauthenticated XML External Entity (XXE) vulnerability affecting GeoServer versions 2.26.1 and earlier. When exploited, the bug lets attackers retrieve arbitrary files from vulnerable servers, allowing data theft, denial-of-service attacks, or server-side request forgery (SSRF) that can expose internal systems. GeoServer, an open-source platform for publishing and sharing geospatial data, is widely used across civilian, scientific, and defense-linked federal environments. “GeoServer is widely used across federal agencies that manage land, water, and geoscience data,” said Louis Eichenbaum, federal CTO of ColorTokens, noting that it often runs alongside ArcGIS and remains connected back to enterprise GIS systems, even in otherwise segmented or air-gapped deployments. CISA added CVE-2025-58360 to its Known Exploited Vulnerabilities (KEV) catalog this week, citing active exploitation. Advisories from Wiz and the Canadian Centre for Cyber Security indicate that exploit code has circulated since late November, giving attackers a head start before coordinated patching could happen. https://lnkd.in/gRqEs5Dg

7

For SOCs, it’s not just the hackers that pose a threat - it’s the avalanche of data that buries real signals under noise. Security logs, once the fuel for detection, are now both an asset and a liability. The flood of redundant, misaligned, or uncurated telemetry drains not just budgets - but analysts. The challenge isn’t just collecting data - it’s collecting the right data, in the right shape, at the right time. Security tools generate logs by the terabyte. Yet most organizations lack a strategy to qualify, contextualize, or prioritize what enters their SIEMs. As a result: ▪ Real threats get buried in noise. ▪ False positives clutter dashboards, wasting attention. ▪ Costs balloon from excessive licensing and storage. To move from reactive firefighting to proactive defense, SOCs must elevate telemetry management as a core security function. Here's how leading teams do it: 1. Precision Filtering, Not Blanket Collection Start with a threat-informed view: what data truly supports detections? Eliminate noise - e.g., suppress successful login logs unless from unusual geographies or times. 2. Normalization and Enrichment as Multipliers Standardize formats and enrich with business context - asset criticality, user identity, threat intel, geolocation. This transforms raw logs into events that trigger rules more accurately and reduce triage ambiguity. 3. Retention That Reflects Risk Abandon “store everything” habits. Align retention with risk: real-time detection data stays hot; compliance data can go cold. 4. Use Case-Driven Collection Let strategy guide ingestion. Data should map to real correlation rules, MITRE ATT&CK coverage, or compliance needs. If it doesn’t, reconsider ingesting it. Log optimization isn’t just about saving money, it enables: ▪ Faster decision-making ▪ Reduced alert fatigue ▪ Stronger detection fidelity When telemetry pipelines are treated with the same rigor as detection logic or incident response, the SOC becomes sharper and more effective. Final thought…. Data isn't your greatest asset - useful data is. 👉Ask Yourself Are you collecting data to feel secure - or to be secure? #CyberSecurity #SOC #SecOps #ThreatDetection #Telemetry #DataStrategy #DataQuality #OptimizeLogs #LogReduction #SecurityEfficiency #SIEMOptimization #AlertFatigue #TelemetryPipeline

33

4 Comments

This thread showed up on r/msp a while back and Eytan Gipi sent it to me asking if I posted it as a gag or something. "Not losing tribal knowledge" is literally our tagline. The responses reveal how most MSPs think about this problem: "𝗠𝗮𝗸𝗲 𝘁𝗲𝗰𝗵𝘀 𝘄𝗿𝗶𝘁𝗲 𝗯𝗲𝘁𝘁𝗲𝗿 𝘁𝗶𝗰𝗸𝗲𝘁 𝗻𝗼𝘁𝗲𝘀" Assumes techs have time to write detailed notes. They don't. They're solving the problem, managing the client emotionally, and thinking about their next 3 tickets. By 5:47pm when they're submitting time, they're reconstructing the day from memory. Notes become a rushed approximation of what actually happened. "𝗛𝗶𝗿𝗲 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝘁𝗼 𝗰𝗵𝗮𝘀𝗲 𝗲𝘃𝗲𝗿𝘆𝗼𝗻𝗲 𝗶𝗻𝘁𝗼 𝗱𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗶𝗻𝗴" One commenter found their most detail-oriented employee and made documentation their job. This works until that person leaves or can't keep up with volume. You've moved the bottleneck, not removed it. "𝗕𝘂𝗶𝗹𝗱 𝗮 𝗥𝗔𝗚 𝘀𝘆𝘀𝘁𝗲𝗺 𝗼𝗻 𝘆𝗼𝘂𝗿 𝘁𝗶𝗰𝗸𝗲𝘁 𝗵𝗶𝘀𝘁𝗼𝗿𝘆" Genuinely useful. But RAG is only as good as what's in your tickets. If your notes are "Reviewed logs. Verified fix." then your AI is learning from less than ideal information. The intelligence layer doesn't fix the data capture layer. "𝗝𝘂𝘀𝘁 𝗳𝗶𝘅 𝘁𝗵𝗶𝗻𝗴𝘀 𝗽𝗲𝗿𝗺𝗮𝗻𝗲𝗻𝘁𝗹𝘆 𝘀𝗼 𝗸𝗻𝗼𝘄𝗹𝗲𝗱𝗴𝗲 𝗱𝗼𝗲𝘀𝗻'𝘁 𝗺𝗮𝘁𝘁𝗲𝗿" Sounds good in theory. One commenter nailed it: "Not every problem has a permanent fix, or a fix that is viable." Vendor software has quirks. Clients make decisions that create workarounds. You can't engineer away the need for institutional knowledge. Here's what none of these address: The most valuable knowledge never enters a searchable system in the first place. Think about where troubleshooting knowledge actually lives. The 45-second explanation on a call. The "their print server is haunted, here's what you do" sidebar in Slack. The verbal walkthrough while you're both looking at the same screen. None of that gets typed up. By the time the call ends, you're onto the next ticket. Voice is the most information-dense medium technicians use. It's also the least captured. Every solution in that thread tries to fix what happens after knowledge exists in a system. The real problem is upstream - it never enters the system at all. That's the gap we're focused on. DM if you want to learn more about how we're solving this problem 👁️

13

4 Comments

Technology advances faster than society adapts. We track the gaps between tech breakthroughs, human understanding, and governance responses. Balance the Triangle Daily Brief - January 4, 2026 Imbalance: We’re good at patching. We’re bad at governing fast change (algorithms, models, suppliers). Sources verified; links checked; mismatch scored. 1) Your encryption will change—can you change it safely? What happened: NIST published CSWP 39 on “crypto agility” (how to swap algorithms/keys across software, hardware, and protocols without breaking operations). Why it matters: PQC migrations + deprecations turn “crypto” into continuity risk (outage, audit failure, messy incident response). Do this next (Prepare + Prove): Inventory where crypto lives, then run one “swap drill” (TLS/VPN/IAM) with rollback criteria and key-rotation SLAs. https://lnkd.in/eYVbE4ut The Gap (S/T | Human | Ethics/Gov): 8.2 | 5.6 | 6.4 — capability exists; change muscle is thin. Confidence: High Bottom Line: If you can’t rotate crypto fast, you don’t control blast radius. 2) Your AI stack needs a security profile—not vibes. What happened: NIST released a draft “Cyber AI Profile” mapping CSF 2.0 to AI risks (secure AI, AI defense, AI-enabled attacks). Why it matters: Data/model/tool chains create new control gaps (poisoning, prompt/tool abuse, model theft) that don’t map cleanly to legacy catalogs. Do this next (Protect + Policy): Require an AI “bill of materials” (data, model, tools, HITL), and gate prod on red-team results + continuous logging/monitoring. https://lnkd.in/eYctQHTc The Gap (S/T | Human | Ethics/Gov): 8.0 | 5.2 | 5.8 — tools move; governance lags. Confidence: Medium-High Bottom Line: Treat models like production systems—because attackers already do. 3) Your DoD contracts now carry a certification clock. What happened: DoD is implementing CMMC 2.0 via DFARS—cyber certification requirements are rolling into solicitations/contracts on a phased schedule. Why it matters: Primes will flow requirements to suppliers; “not defense” won’t save you if you touch FCI/CUI or sit in a defense-adjacent supply chain. Do this next (People + Portfolio): Name an exec owner, fund a readiness sprint (gap→POA&M→assessment path), and add CMMC checks to supplier onboarding + bid/no-bid. https://lnkd.in/ei6Ej6Ud The Gap (S/T | Human | Ethics/Gov): 6.5 | 6.8 | 7.6 — org change is the choke point. Confidence: High Bottom Line: Compliance is market access. Today’s Pattern: Verification Gap — controls exist; proof-at-speed is rare. Imbalance Score: 7.3/10 (High) — governance ops lag capability. Your Move: If you had 90 days to prove this, what breaks first: inventory, ownership, or budget? #encryption #ai #DoD

9

Forensic Timeliner: Fast and Open Source! A high-speed forensic processing engine that consolidates CSV output from popular triage tools like EZ Tools, Kape, Axiom, Hayabusa, Chainsaw, and Nirsoft into a unified, easy-to-read timeline. • Comprehensive Artifact Parsing • Date Filtering and Deduplication • Keyword Tagging for Timeline Explorer • Interactive Setup • Easy Integration with Triage Directories This tool significantly reduces the time spent sorting through large datasets, enabling investigators to focus on what matters: uncovering critical evidence. The ability to customize the tool’s functionality through YAML files further adds to its flexibility. Source: https://lnkd.in/gxcwQpsX Learning data analysis techniques is essential for interpreting complex data and extracting actionable insights, even with powerful tools. Please share and follow Sanjay Singh if you enjoy the content! Join Cyber Squad's Discussion WhatsApp Group to have open discussions with peers🔗 https://lnkd.in/gMRin_WX #cybersecurity #threathunting #threatdetection #blueteam #soc #socanalyst #skillsdevelopment #careergrowth #IR #DataAnalysis #IncidentResponse

31

Most people write Claude prompts. I write skill.md files. Here’s the difference. A prompt tells Claude what to do once. A skill file turns Claude into a production system that executes the same workflow 100 times without breaking. At Nexius Labs, every agent we deploy has 3-7 skill files. They’re not templates. They’re executable instructions Claude reads before taking action. Here’s the exact structure I use: ## 1. CORE IDENTITY (3 lines max) - What this skill does (one sentence) - When Claude should activate it - What it produces as output ## 2. TRIGGER PATTERNS User says: "process this invoice" Claude recognizes: invoice workflow needed Action: Activate this skill ## 3. INPUT REQUIREMENTS - Required data format (JSON/CSV/text) - Validation rules - What Claude should ask for if missing ## 4. EXECUTION WORKFLOW Step 1: Validate inputs Step 2: Check dependencies Step 3: Execute core logic Step 4: Generate output Step 5: Log for audit trail ## 5. OUTPUT SCHEMA { "status": "completed", "data": {...}, "next_actions": [...] } ## 6. ERROR HANDLING - What breaks this skill - Recovery steps - Fallback behavior ## 7. INTEGRATION POINTS - Which skills this depends on - What downstream skills consume this Why this structure works: → Trigger Patterns = Claude knows exactly when to use this vs other skills → Input Requirements = No hallucinations from missing context → Output Schema = Other skills can chain seamlessly → Error Handling = System keeps running when things fail Real example from production: We built an invoice processing skill for a distribution company. Before the skill file: Claude processed invoices correctly 60% of the time, failed silently 40% of the time. After adding this structure: 98% accuracy, errors caught and logged, zero silent failures. The file took 30 minutes to write. It saved 20+ hours of debugging over the next month. How to implement this: 1. Pick one workflow Claude does for you repeatedly 2. Copy this structure into a SKILL.md file 3. Fill in each section with your specific requirements 4. Reference it: “Claude, use the invoice-processing skill to handle this” At Nexius Labs, this is how we scale from prototype to production. Skills don’t replace prompts. They make prompts repeatable. Save this structure. You’ll need it when “Claude worked yesterday but broke today.” What workflow would you turn into a skill first?

13

4 Comments

I recently spent six years working on the Tofino security appliance. It is effective, partially because attackers do not know it is there. It is what is called a BUMP-ON-THE-WIRE device. It does not have an IP address. It forwards all traffic that comes in out the other side. It is detectable as a small additional latency on the network. Before I left the company, I wanted to add my background in machine learning so the device would "learn" what normal network traffic looks like, and alert on unusual behavior--the mechanism that Secret Service agents use to protect Mr. Trump in a large crowd. However, the new managers in Germany decided to lay off half of the team without asking us our plans. As far as hardware security goes in the cloud, I was invited to a meeting between Ruby Lee of Princeton University and the VP of research at Intel. Dr. Lee told the VP (he replaced my boss at Intel Labs, Konrad Lai) how to put a "root of trust" in a microprocessor. This root of trust is augmented by TrustForge, which in the property of Agita Labs, one of the companies started by Todd Austin. It changes the key 20 times a second so that if someone finds a way to exfiltrate data from the cloud to break the cryptography, 50msec later, the broken key is useless. This is called _temporal_ security. Cheers! ☕ Todd B. Bittally

1

I’ve been thinking about exposure management less as a tooling problem and more as a systems problem. When discovery grows faster than mobilization capacity, exposure doesn’t just increase — it compounds. That accumulation is exposure debt.

16

2 Comments