Skip to main content

Posts

Three Pixels and a Pi: Wardriving

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. --- My current wardriving setup is a Pixel 4a 5G, a Pixel 7a, a Pixel 10 Pro XL, and a Raspberry Pi 4B with three external antennas.  The phones run Wardriver Go and WiGLE, and the Pi runs Kismet. The Pixel 4a 5G and Pixel 7a have been part of the setup for a while, with the Pixel 10 Pro XL joining as the newest. Having three generations of hardware gives me a chance to compare what each records under similar conditions. In earlier tests, the Pixel 4a 5G recorded more SSIDs. I want to see whether that result holds up over repeated runs. Placement, scan timing, app settings, and conditions along the route affect the results. The Raspberry Pi 4B adds another collection platform to test. Its hardware includes three Wi-Fi adapters and a GNSS receiver: | Device | Role | | --- | --- | --- | | MediaTek MT7612U adapter |...
Post a Comment
Read more
Recent posts

If Security Awareness Needs to Change, What Do We Build Instead?

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. --- In my last post, I argued that security awareness has become too clean. Too polished. Too predictable. Too focused on recognizing examples instead of developing judgment. Criticism is easy. The harder question is what we build instead. I don't think the answer is better graphics, and I don't think it's making every employee learn Linux or reverse malware. The problem isn't that security awareness isn't technical enough. It’s that we don’t give people enough opportunities to practice making decisions. I've been experimenting with a different model. It isn't one product or format, but a set of principles, mechanics, and techniques built around a premise: teach judgment. Not recognition of training, memorization of policy, or completion.  Judgment. --- Start With the Decision A lot of tra...
Post a Comment
Read more

Security Awareness Training Has Been Polished Into Irrelevance

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. ---  (Cyber)security awareness training (SAT) has long focused on recognizing threats inside the enterprise, but anyone who has dealt with a real compromise knows attacks rarely respect those boundaries. Real breaches are messy. They’re personal.  They involve bad timing, strange messages, compromised friends, personal accounts, social media, reused credentials, AI-generated likenesses, family members, phone calls, desperation, embarrassment, deception, and sometimes outright threats or blackmail. Yet we teach security awareness with polished graphics, spotless templates, friendly AI-generated illustrations, and scenarios where the suspicious answer is practically given. What are we actually teaching people to recognize? The problem is that training today focuses too heavily on... Recognizing sp...
Post a Comment
Read more

Who Put a Chip Under Their Skin First?

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. ---- Who put a chip under their skin first? Depending on who you ask, you’ll hear  Kevin Warwick , the British cybernetics professor behind Project Cyborg. He had a chip implanted in 1998. There’s a problem with that.  Eduardo Kac  had done a public microchip implantation in 1997. The dates are the easy part. What we mean by first, and whose work we decide counts, gets messier. ---- Chipped in São Paulo On November 11, 1997, Brazilian artist Eduardo Kac staged Time Capsule at Casa das Rosas in São Paulo. In front of seven family photographs, he inserted a passive identification transponder under the skin of his left ankle. The event was broadcast and participants could activate a scanner remotely to retrieve the number from the implant. Kac then registered himself in a U.S. database built to identi...
Post a Comment
Read more

Rethinking Cybersecurity Training: A Path for Career Transitions

Cybersecurity’s long attracted those seeking a challenging and financially lucrative career, but if you’ve ever tried to break into the field, you’ll know it’s far from straightforward. Whether you’re already in IT or coming from a completely different profession, figuring out how to pivot can be overwhelming. Check out r/SecurityCareerAdvice , and you’ll find plenty of questions like, “How do I move from help desk to SOC analyst?” or “What’s the best path from System Administrator to Security Engineer?” or even “How do I jump from Human Resources to Cybersecurity?” The interest is there, but the roadmap? Not so much! The problem is that cybersecurity career training today focuses on…      1.   Those already in Information Technology           2.   Teaching specialized Skills These topics are valuable for certain roles, but they’re not really designed to help someone transition into the industry. How can we improve trainin...
1 comment
Read more