Revisiting the Azure Kudu XSS: what Microsoft saidTen years on, the email thread behind the Azure Kudu XSS is more interesting than the bug. A look at the disclosure, why MSRC kept rejecting it, and why they were wrong.
Cybersecurity 101 with W3Schools: what you actually needI sat down with W3Schools, one of the largest websites in the world, to cover the fundamentals of cybersecurity: the CIA triad, what hacking really means, the full attack surface, and where to start learning safely.
Responsible disclosure shouldn't be this hardI found open cloud buckets with 10,000+ PII documents and spent months trying to get someone, anyone, to act. It took going to NRK before the data was finally secured.
The Register on my SANS webinar: NIS2, DORA and TIBER-EUThe Register previewed my SANS webinar breaking down three European cybersecurity regulatory frameworks, NIS2, DORA, and TIBER-EU, and what they mean for security operations.
TV2 asked me about the global CrowdStrike outageA faulty CrowdStrike update blue-screened Windows systems worldwide. TV2 spoke with me about what happened and why a single vendor update could cause that much disruption.
DevSecOps can take development to new heightsMy guest post on Kode24: how folding security into DevOps lets developers ship fast and safely, from defensive coding and reusable libraries to behavioural monitoring.
TV2 asked me about TikTok on politicians' phonesAs Norway debated politicians using TikTok on government phones, TV2 asked me about the security risks. My take: it is less about the app itself and more about data, jurisdiction, and where you install it.
Speaking at DefCamp 2022 in BucharestI spoke at DefCamp 2022, Central and Eastern Europe's largest hacking and infosec conference, on building an offensive SOC. Business Review covered the event and its stark ransomware numbers.
TV2 asked me about the Killnet DDoS attacks on NorwayWhen the pro-Russian group Killnet knocked over Norwegian sites like BankID and Altinn, TV2 asked me whether people should worry. My answer: this is muscle-flexing, not a threat to your identity or money.
Hacker techniques developers should know in 2022My Kode24 guest post walking developers through four attack classes worth understanding: SQL injection, XXE, XSS, and SSRF, with the defensive takeaway for each.
Naive to think there are no Norwegian cybercriminalsKode24 asked me about home-grown cybercrime. My point: it is naive to assume Norwegian actors don't exist, and we should be steering that technical talent toward ethical hacking.
Digi.no on the Nordic Choice data leakDigi.no covered the Nordic Choice breach, where employee personal data was dumped online. I commented on what double-extortion ransomware means for the people whose data leaks.
Dagens Næringsliv on the Hurtigruten cyberattackDagens Næringsliv quoted me on the extensive cyberattack against Hurtigruten, one of several ransomware incidents that hit large Norwegian organizations.
NRK: how your email account gets hackedNRK had me demonstrate how email accounts get taken over. The uncomfortable truth: most of it is trivial, because we reuse passwords. Two-factor is what actually gets in an attacker's way.
Security misconceptionsA SANS@MIC talk on the pits and fallacies we fall into while advising ourselves and others in information security.
Smart house attack vectorsBeyond WPA2 and a firewall: WPS, pre-compromised LAN hosts, evil-maid USB attacks, weak ISP routers, leaked credentials, and sub-GHz radio protocols.
An Azure zero-day XSS with sandbox escapeChaining a command injection into a stored XSS that jumps from a compromised SaaS site to the Azure administrator through the Kudu console.
Fifteen tips on producing good documentationPractical rules for documentation that actually gets written and stays useful: keep it simple, write in English, never store passwords, and update as you go.
My reflections as a CISOMoving from techie to security leader: staying visible, not being the dust boy, and avoiding the security roller-coaster of budget cuts.
Is social engineering an actual threat?Why social engineering keeps working, the psychological levers behind it, and classic examples including the HBGary hack.
XSS explainedThe three ways to deliver a Cross-Site Scripting payload, the attack vectors that make it dangerous, and a short history of XSS in the wild.
Enumeration with sqlmapUsing sqlmap to enumerate databases through a SQL injection, what enumeration means in a pen test, and how the attack looks in the server logs.