Ben Rothke
@benrothke.bsky.social
I do information security, risk management and other tech stuff. Co-author of new book: The Definitive Guide to PCI DSS Version 4: Documentation, Compliance, and Management. https://amzn.to/3WhEfh1
My @OneRSAC #RSAC #infosec book review: Blue Team Dynamics: Three Proven Leadership Principles Inspired by @IDF Sources for Business & Life, by @YaakovLappin via @GefenPublishing. Deep insights from @IDF, @ElbitSystemsLtd & other #Israel hi-tech leaders. www.rsaconference.com/library/blog...
Ben's Book of the Month: Blue Team Dynamics: Three Proven Leadership Principles Inspired by IDF Sources for Business and Life
rsaconference.com
It’s almost certain that the call you get about a vacation is from a scammer. So why do vacation scams persist? Vacation scams are effective because they exploit a perfect combination of emotion, psychology, and timing. www.linkedin.com/feed/update/...
Vacation Scams Are Booming — Here’s How Not to Become the Next Victim | Ben Rothke
It’s almost certain that the call you get about a vacation is from a scammer. So why do vacation scams persist? Vacation scams are effective because they exploit a perfect combination of emotion, psy...
linkedin.com
Vacation scams don't just steal your money - they steal your dream vacation. Scammers prey on excitement, urgency & "too good to pass up" deals. Before you book your next trip, learn the red flags that can save you thousands. #Scams #Travel #Cybersecurity brothke.medium.com/vacation-sca...
Vacation Scams Are Booming — Here’s How Not to Become the Next Victim
That call about a vacation is from a scammer
brothke.medium.com
"𝘖𝘯𝘦 𝘰𝘧 𝘵𝘩𝘦 𝘣𝘰𝘰𝘬’𝘴 𝘴𝘵𝘳𝘰𝘯𝘨𝘦𝘴𝘵 𝘤𝘰𝘯𝘵𝘳𝘪𝘣𝘶𝘵𝘪𝘰𝘯𝘴 𝘪𝘴 𝘪𝘵𝘴 𝘢𝘳𝘵𝘪𝘤𝘶𝘭𝘢𝘵𝘪𝘰𝘯 𝘰𝘧 𝘩𝘰𝘸 𝘈𝘐 𝘤𝘢𝘯 𝘤𝘳𝘦𝘢𝘵𝘦 𝘵𝘩𝘦 𝘴𝘦𝘮𝘣𝘭𝘢𝘯𝘤𝘦 𝘰𝘧 𝘪𝘯𝘵𝘦𝘭𝘭𝘪𝘨𝘦𝘯𝘤𝘦—𝘱𝘳𝘰𝘥𝘶𝘤𝘪𝘯𝘨 𝘰𝘶𝘵𝘱𝘶𝘵𝘴 𝘵𝘩𝘢𝘵 𝘢𝘱𝘱𝘦𝘢𝘳 𝘪𝘯𝘵𝘦𝘯𝘵𝘪𝘰𝘯𝘢𝘭 𝘰𝘳 𝘢𝘶𝘵𝘩𝘰𝘳𝘪𝘵𝘢𝘵𝘪𝘷𝘦 𝘥𝘦𝘴𝘱𝘪𝘵𝘦 𝘭𝘢𝘤𝘬𝘪𝘯𝘨 𝘨𝘦𝘯𝘶𝘪𝘯𝘦 𝘶𝘯𝘥𝘦𝘳𝘴𝘵𝘢𝘯𝘥𝘪𝘯𝘨." -- Caroline Wong in her review of Justin "Hutch" Hutchens' 𝙏𝙝𝙚 𝙇𝙖𝙣𝙜𝙪𝙖𝙜𝙚 𝙤𝙛 𝘿𝙚𝙘𝙚𝙥𝙩𝙞𝙤𝙣
The AI hype cycle is beginning to crack. Companies sold AI as a cure-all, but many rushed deployments are falling flat. People hate frustrating HR and customer service bots, and businesses are now paying the price for replacing good experiences with bad automation. brothke.medium.com/the-ai-big-c...
The AI Big Crunch Is Starting
The AI emperor has clothes. Just much less than everyone thinks.
brothke.medium.com
Considering buying an honorary doctorate? Imagine sitting in a job interview while hiring manager asks where you earned your doctorate. Explaining that you purchased an honorary PhD isn’t the conversation anyone wants to have. Just don’t do it, or buy it. brothke.medium.com/when-dr-come...
When “Dr.” Comes With a Receipt
Why spending thousands of dollars on an “honorary PhD” may cost you far more than the purchase price.
brothke.medium.com
Beware of the Baseboard Management Controller (BMC). A 20-year-old BMC vulnerability gave researchers access to bare-metal servers & a foothold in the no man’s land of data center infrastructure. api.cyfluencer.com/s/how-we-hac...
How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability
A 20-year-old vulnerability gave us access to bare-metal servers - and a foothold in the no man’s land of data center infrastructure.
api.cyfluencer.com
For first time in 19 years, @Verizon @VZDBIR looked at what happens after attackers get in. Mapped routes taken to privilege escalation. Real exposures live in the permissions, configurations & trust relationships along those routes. HT @XMCyber_. api.cyfluencer.com/s/the-2026-v... #DBIR
The 2026 Verizon DBIR Stopped Asking How Attackers Get in and Started Asking Where They Go | XM Cyber
Learn more about The 2026 Verizon DBIR Stopped Asking How Attackers Get in and Started Asking Where They Go . Read more on XM Cyber website.
api.cyfluencer.com
Shai-Hulud is one of the most persistent supply-chain worms in recent years. It’s a self-replicating worm & actively compromising packages with 3M+ weekly downloads, hijacking tokens from CI/CD pipelines, bypassing trusted publishing protections. #Shai-Hulud cybersec.gitguardian.com/s/mini-shai-...
Mini Shai-Hulud: A persistent supply-chain worm
A self-replicating worm is actively compromising packages with 3M+ weekly downloads, hijacking tokens from CI/CD pipelines, and bypassing trusted publishing protections.
cybersec.gitguardian.com
📝 𝙍𝙚𝙫𝙞𝙚𝙬 𝘿𝙖𝙮! 📕 Jack Freund reviews 𝙈𝙖𝙨𝙩𝙚𝙧𝙞𝙣𝙜 𝙏𝙝𝙞𝙧𝙙-𝙋𝙖𝙧𝙩𝙮 𝙍𝙞𝙨𝙠: 𝘼 𝙋𝙧𝙖𝙘𝙩𝙞𝙘𝙖𝙡 𝙃𝙖𝙣𝙙𝙗𝙤𝙤𝙠 𝙛𝙤𝙧 𝙈𝙖𝙣𝙖𝙜𝙞𝙣𝙜 𝙑𝙚𝙣𝙙𝙤𝙧, 𝙏𝙝𝙞𝙧𝙙-𝙋𝙖𝙧𝙩𝙮, 𝙖𝙣𝙙 𝙎𝙪𝙥𝙥𝙡𝙮 𝘾𝙝𝙖𝙞𝙣 𝙏𝙝𝙧𝙚𝙖𝙩𝙨 𝙞𝙣 𝙀𝙫𝙚𝙧𝙮 𝙊𝙧𝙜𝙖𝙣𝙞𝙯𝙖𝙩𝙞𝙤𝙣, authored by Bill Bonney, Chris Forbes, Gary Hayslip, Andrea Little Limbago, and Matt Stamper. 👉 Review: tinyurl.com/3aahu3rm
Good @jbhall56 piece: He notes YoY #PCI #27001 audit efficiencies are only in 2%-4 % range. The real problem is a consultancy sales exec who thinks it’s >25% & lowers the audit price to make clients happy. It’s then the consultants who have to deliver. pciguru.wordpress.com/2026/07/27/t...
The Audit Efficiency Myth
I have been guilty in the past of agreeing to this and have always regretted it. Clients think that an audit/assessment is like assembling a widget. The more times you do it the faster and more eff…
pciguru.wordpress.com
Interesting post by @bigidsecure on #ExploitGym, a cybersecurity benchmark designed to evaluate whether #AI agents can turn software vulnerabilities into working, end-to-end attacks. #HuggingFace shows that AI risks have gotten quite real. api.cyfluencer.com/s/a-model-a-... #infosec
A Model, a Goal, and an Unlocked Door
Every fictional AI villain gets a moment where it decides humans are the problem. HAL 9000 decides the mission matters more than the crew. Skynet decides humanity is …
api.cyfluencer.com
In the rush to secure AI, many forget about the data center & AI infrastructure security risks. The #FORGE #AI framework from #Lava, coming out of stealth, is quite compelling. It is about hardening the metal beneath the model. Something many forgot to do. api.cyfluencer.com/s/the-top-10...
Top 10 Risks
A practical security framework for Data Centers and AI Infrastructure: the Top 10 risks in the layer that trains, hosts, and serves AI.
api.cyfluencer.com
Anyone can call themselves Dr. But what happens when someone literally buys an honorary doctorate & uses title to gain credibility? I dug into the surprising industry behind purchased honorary degrees, ethics & risks. Read before you're impressed by "Dr." medium.com/@brothke/whe...
When “Dr.” Comes With a Receipt
Why spending thousands of dollars on an “honorary PhD” may cost you far more than the purchase price.
medium.com
In the rush to secure AI, many forget about the data center & #AI infrastructure security risks. The #FORGE framework from #Lava, coming out of stealth, is quite compelling. It is about hardening the metal beneath the model. Something many forgot to do. api.cyfluencer.com/s/the-top-10...
Top 10 Risks
A practical security framework for Data Centers and AI Infrastructure: the Top 10 risks in the layer that trains, hosts, and serves AI.
api.cyfluencer.com
Anyone can call themselves Dr. But what happens when someone literally buys an honorary doctorate & uses title to gain credibility? I dug into the surprising industry behind purchased honorary degrees, ethics & risks. Read before you're impressed by "Dr." medium.com/@brothke/whe...
When “Dr.” Comes With a Receipt
Why spending thousands of dollars on an “honorary PhD” may cost you far more than the purchase price.
medium.com
Fun fact: Don’t pay thousands for #Gartner reports, vendors mentioned in them often provide them free. This @Gartner_inc report on ‘Reimagining Network Microsegmentation: Beyond the IP — Identity, Context & Agentless Innovation’ courtesy of @ZeroNetworks. api.cyfluencer.com/s/gartner-re...
Gartner® Reimagining Network Microsegmentation: Beyond the IP — Identity, Context, and Agentless Innovation
Examine why identity-centric, agentless microsegmentation has become a critical control for network security in hybrid and multicloud environments. Download the full Gartner research report to underst...
api.cyfluencer.com
🤫 𝗦𝗵𝗵𝗵 (or not!) This week, Helen Patton reviews Ross Young's 𝘾𝙮𝙗𝙚𝙧𝙨𝙚𝙘𝙪𝙧𝙞𝙩𝙮’𝙨 𝘿𝙞𝙧𝙩𝙮 𝙎𝙚𝙘𝙧𝙚𝙩: 𝙒𝙝𝙮 𝙈𝙤𝙨𝙩 𝘽𝙪𝙙𝙜𝙚𝙩𝙨 𝙂𝙤 𝙩𝙤 𝙒𝙖𝙨𝙩𝙚: 📝 Review: tinyurl.com/jdrdsjs4 #CyberCanonReview #CybersecurityBooks #CISO
#Argon2 is a key derivation function (KDF) designed to make brute-force attacks more computationally expensive by limiting advantages attackers gain from GPUs & other high-performance cracking hardware. Passwords getting close to being almost uncrackable. api.cyfluencer.com/s/new-resear...
[New Research] Does Argon2 Mean Your Password is Uncrackable?
Does Argon2 make passwords uncrackable? See how it performs against the latest hardware with this research from Specops.
api.cyfluencer.com
The thing about AI is that while it has massive potential & current value, too many are drinking the #AI Kool-Aid. Lots of firms are spending massive amounts on AI w/o a clue what they are trying to solve. They think AI is an IT pixie dust. medium.com/@brothke/the...
The AI Big Crunch Is Starting
The AI emperor has clothes. Just much less than everyone thinks.
medium.com
You know when ransomware is called ‘Everest’, it has to be bad. #Everest is a Russia-based Windows #ransomware & data-extortion operation. It encrypts files with the .everest extension & is linked to the #BlackByte ransomware. cybersec.picussecurity.com/s/everest-ra...
Everest Ransomware: Triple Threat of Encryption, Access, and Insiders
Everest Ransomware encrypts Windows hosts, steals data, and sells network access. Learn how it works and how to defend against it.
cybersec.picussecurity.com
#Gamaredon is a Russia-aligned APT, widely attributed to Russia's Federal Security Service. @mfa_russia attempted to infect over 1,500 Ukrainian government systems & ran 5,000 attacks by late 2021. They’re still quite active & dangerous. HT @PicusSecurity. cybersec.picussecurity.com/s/gamaredon-...
Gamaredon (Primitive Bear) APT Profile and MITRE ATT&CK Breakdown
Gamaredon is a Russia-linked APT active since 2013 targeting Ukraine and NATO. Learn their TTPs, GammaLoad, and GammaSteel tools.
cybersec.picussecurity.com
Hear about the person who got a great board spot via #Boardsi? Neither did I, as that’s not how boards recruit. Many paid services promise to get people on corporate boards & lucrative advisory roles. I challenge you to find anyone who’s been successful. brothke.medium.com/get-on-a-boa...
Get on a board — but maybe not with Boardsi
Can Boardsi really get you a six-figure board and advisory positions like they claim?
brothke.medium.com
🏛 HoF Nominee: 𝘍𝘰𝘳 𝘢𝘯𝘺𝘰𝘯𝘦 𝘴𝘦𝘦𝘬𝘪𝘯𝘨 𝘵𝘰 𝘶𝘯𝘥𝘦𝘳𝘴𝘵𝘢𝘯𝘥 𝘸𝘩𝘺 𝘱𝘳𝘪𝘷𝘢𝘤𝘺 𝘮𝘢𝘵𝘵𝘦𝘳𝘴, 𝘸𝘩𝘺 𝘵𝘦𝘤𝘩𝘯𝘰𝘭𝘰𝘨𝘺 𝘢𝘯𝘥 𝘭𝘪𝘣𝘦𝘳𝘵𝘺 𝘢𝘳𝘦 𝘪𝘯𝘦𝘹𝘵𝘳𝘪𝘤𝘢𝘣𝘭𝘺 𝘭𝘪𝘯𝘬𝘦𝘥, 𝘢𝘯𝘥 𝘸𝘩𝘺 𝘵𝘩𝘦𝘴𝘦 𝘲𝘶𝘦𝘴𝘵𝘪𝘰𝘯𝘴 𝘳𝘦𝘮𝘢𝘪𝘯 𝘢𝘴 𝘶𝘳𝘨𝘦𝘯𝘵 𝘵𝘰𝘥𝘢𝘺 𝘢𝘴 𝘵𝘩𝘦𝘺 𝘸𝘦𝘳𝘦 𝘢 𝘤𝘦𝘯𝘵𝘶𝘳𝘺 𝘢𝘨𝘰, 𝘵𝘩𝘪𝘴 𝘣𝘪𝘰𝘨𝘳𝘢𝘱𝘩𝘺 𝘪𝘴 𝘪𝘯𝘥𝘪𝘴𝘱𝘦𝘯𝘴𝘢𝘣𝘭𝘦. -Daniel 'Rags' Ragsdale of 𝙇𝙤𝙪𝙞𝙨 𝘿. 𝘽𝙧𝙖𝙣𝙙𝙚𝙞𝙨: 𝘼 𝙇𝙞𝙛𝙚 by Melvin Urofsky
Many people are victims of identity theft but don’t have a clue how to recover from it. What does one do if they’re hacked? #Psono has a practical step-by-step guide to containing damage, recovering accounts and reducing the risk of being hacked again. api.cyfluencer.com/s/what-to-do...
What to Do If You Get Hacked
A practical step-by-step guide for containing damage, recovering accounts, protecting money and data, and reducing the chance of getting hacked again.
api.cyfluencer.com
Securing the modern onboarding process is challenging. Employee onboarding always relied on the service desk. Now service desk is the target. AI-powered attacks & remote/hybrid work are 2 of many trends making this a very risky area. HT @specopssoftware api.cyfluencer.com/s/a-guide-to...
A Guide to Secure Employee Onboarding in 2026
The service desk is facing increased threats in 2026. Learn how to secure employee onboarding from issues like social engineering.
api.cyfluencer.com
The irrational exuberance that AI was a cure-all is starting to crack. Starting to see massive pushback on #AI projects that have failed miserably. Everyone hates dealing with #HR & customer service AI agents, & now firms are paying dearly for the mistake. brothke.medium.com/the-ai-big-c...
The AI Big Crunch Is Starting
The AI emperor has clothes. Just much less than everyone thinks.
brothke.medium.com
Great Dr. @RanigaVinay of @UniofOxford @BlavatnikSchool video details how utterly corrupt @FIFAcom @FIFAWorldCup is. #FIFA has zero oversight & is a cash cow. The work of Chuck Blazer, former @CONCACAF General Secretary, has sadly done little to change FIFA. www.youtube.com/@drvinayraniga
Dr Vinay Raniga
Videos to help you better understand the world (and the people who run it). Join our community: https://vinayraniga.beehiiv.com/ Inquiries: vinayraniga@hotmail.com
youtube.com
🕵️♂️ 𝗥𝗲𝘃𝗶𝗲𝘄 𝗗𝗿𝗼𝗽! Today, Jonathan Cote provides an in-depth analysis of Kurtis Minder's 𝘾𝙮𝙗𝙚𝙧 𝙍𝙚𝙘𝙤𝙣: 𝙈𝙮 𝙇𝙞𝙛𝙚 𝙞𝙣 𝘾𝙮𝙗𝙚𝙧 𝙀𝙨𝙥𝙞𝙤𝙣𝙖𝙜𝙚 𝙖𝙣𝙙 𝙍𝙖𝙣𝙨𝙤𝙢𝙬𝙖𝙧𝙚 𝙉𝙚𝙜𝙤𝙩𝙞𝙖𝙩𝙞𝙤𝙣. ✍ cybercanon.org/cyber-recon-... #CyberCanonReview #RansomwareNegotation #CTI #CyberCrime #CybersecurityBooks | @jon24cote.bsky.social
For the first time, @VerizonBusiness @VZDBIR ran attack graph analysis on real environments, mapping users, groups & permissions to model what happens after an attacker gets in. #DBIR found that 16% of organizations had about 80% exposure. HT @XMCyber_. api.cyfluencer.com/s/the-2026-v...
The 2026 Verizon DBIR Stopped Asking How Attackers Get in and Started Asking Where They Go | XM Cyber
Learn more about The 2026 Verizon DBIR Stopped Asking How Attackers Get in and Started Asking Where They Go . Read more on XM Cyber website.
api.cyfluencer.com