Allow Some Deny All - Hacking, Coffee, Community

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. --- In my last post, I argued that security awareness has become too clean. Too polished. Too predictable. Too focused on recognizing examples instead of developing judgment. Criticism is easy. The harder question is what we build instead. I don't think the answer is better graphics, and I don't think it's making every employee learn Linux or reverse malware. The problem isn't that security awareness isn't technical enough. It’s that we don’t give people enough opportunities to practice making decisions. I've been experimenting with a different model. It isn't one product or format, but a set of principles, mechanics, and techniques built around a premise: teach judgment. Not recognition of training, memorization of policy, or completion.  Judgment. --- Start With the Decision A lot of tra...

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. ---  (Cyber)security awareness training (SAT) has long focused on recognizing threats inside the enterprise, but anyone who has dealt with a real compromise knows attacks rarely respect those boundaries. Real breaches are messy. They’re personal.  They involve bad timing, strange messages, compromised friends, personal accounts, social media, reused credentials, AI-generated likenesses, family members, phone calls, desperation, embarrassment, deception, and sometimes outright threats or blackmail. Yet we teach security awareness with polished graphics, spotless templates, friendly AI-generated illustrations, and scenarios where the suspicious answer is practically given. What are we actually teaching people to recognize? The problem is that training today focuses too heavily on... Recognizing sp...

Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. ---- Who put a chip under their skin first? Depending on who you ask, you’ll hear  Kevin Warwick , the British cybernetics professor behind Project Cyborg. He had a chip implanted in 1998. There’s a problem with that.  Eduardo Kac  had done a public microchip implantation in 1997. The dates are the easy part. What we mean by first, and whose work we decide counts, gets messier. ---- Chipped in São Paulo On November 11, 1997, Brazilian artist Eduardo Kac staged Time Capsule at Casa das Rosas in São Paulo. In front of seven family photographs, he inserted a passive identification transponder under the skin of his left ankle. The event was broadcast and participants could activate a scanner remotely to retrieve the number from the implant. Kac then registered himself in a U.S. database built to identi...

Cybersecurity’s long attracted those seeking a challenging and financially lucrative career, but if you’ve ever tried to break into the field, you’ll know it’s far from straightforward. Whether you’re already in IT or coming from a completely different profession, figuring out how to pivot can be overwhelming. Check out r/SecurityCareerAdvice , and you’ll find plenty of questions like, “How do I move from help desk to SOC analyst?” or “What’s the best path from System Administrator to Security Engineer?” or even “How do I jump from Human Resources to Cybersecurity?” The interest is there, but the roadmap? Not so much! The problem is that cybersecurity career training today focuses on…      1.   Those already in Information Technology           2.   Teaching specialized Skills These topics are valuable for certain roles, but they’re not really designed to help someone transition into the industry. How can we improve trainin...