CISO at @sardineai. Treasurer of @OWASP Board of Directors. (he/him) qatta' mIghtaHghach.
Phoenix, AZ
Joined July 2009
- Tweets 8,305
- Following 139
- Followers 776
- Likes 17,402
When Cresta joined McAfee via the acquisition, they let her go. She wrote a long blog post about it and how she joined "eCommerce Merchants." Her post also encouraged merchants to switch from traffic-stealing ScanAlert to best-practice ControlScan.
crestapillsbury.wordpress.co…
1
It gain prominence because Nate McFeters called it out on the @ZDNet Zero Day blog, and spoofed it with his own "Nate McFeters Safe" certification along with "Scanless PCI" (the latter with @jeremiahg).
zdnet.com/article/mcafees-ha…
1
Here's the original video of Cresta's "super hacker" claim, which set off a firestorm in the security community at the time.
youtube.com/ZwppWpZEii8?t=79
1
I'm reminded of the 2008 story of Cresta Pillsbury, who described her company's security scanning product, ScanAlert, as "we go in like a super hacker." Even if you remember it, her story is even more interesting. Read along...
1
1
1
@subaru_usa FYI, your incentive to test drive a car didn’t work, the local dealer declined to honor it.
1
1
Badass! @googlechrome and @firefox are changing cookies to default to SameSite=LAX to help prevent CSRF across a large swath of the internet.
groups.google.com/a/chromium…
Pro-tip: as a rule of thumb, security and privacy professionals do not have IOT-enabled devices in their home.
Our investigation into personal data out on @BBCClick today included researchers at imperial who found:
- a light bulb pinging an ad tech company every time it’s switched on or off.
- a vacuum cleaner beaming floorplans to the cloud
- camera sending data to 54 locations
1
I reported a bug to @Dropbox that their drop-down menu is being covered by a table header, and they replied back that I should reset my browser to its default settings and disable plug-ins. I feel bad for non-technical users that wouldn't know any better.
1
2
Great article about my employer @blinkhealth!
forbes.com/sites/danieldambr…
1
And it appears similar to companies providing cover for dissents, activists, and journalists that operate in adverse countries with limited speech. In both cases, the threat model includes nation states - that's a very challenging space to be in.
1
1
Thanks, that helps! And I agree, you should keep "harm reduction" because it's definitely different than Privacy by Design. I'm not familiar with the harm reduction space, but seems there are ethical/legal decisions companies would have to make and the resultant liability issues.
1
1
BTW, @mikel_hamm and @circl_lu are a great resource in Luxembourg for computer security.
1
6