The brief, in full

Dinis Cruz 0:00 Okay, so there's a big vulnerability flying around at the moment, and I would like to use this as a good case study for what we can do in the newsroom. But it's also a good way to explore other ways to visualise and to map a lot of this stuff. Right. So the first phase that I would like us to really focus on is to really understand and visualise and create infographics and detailed information about this vulnerability, right? And and I think that this is a good example of the power of the technology that we can do. So let's kind of really go to town on the whole provenance and inaccuracy of this, because I was reading the reports and there's some crazy statistics lying around that don't add up that I really want to understand, and is actually a good example of of adding provenance and explainability to to this, and also accuracy to To this environment, which is, you know, it's something that we we talked a lot about, and now I think it's a good time to explore, right? And and a lot of this is it's not about naming and shaming a lot of this stuff, but it's also about you know making sure that the data is actually correct, right, and the statement is actually correct, and also figuring out good ways to find sources and then follow the rabbit holes, and also in a way help journalists, right? Because I don't think I think this is definitely a good example of journalists that don't fully understand Technology that makes mistakes which are not either correct or not factually correct or not seeing the whole picture of the whole thing. So, what I would like us to do is I would like us to basically map this as an incident. Basically, try to find as many sources of information as we can create a full agentic workflow here. We we're basically going to leverage the power agents to map the data. We're going to use both ChatGPT and Claude that I have access to to connect the data, and we want to I want to understand, as an executive, for example, what exactly is going on, and I want to do briefings at all sorts of different levels, and in a way is a good example of of the workflows that we've been talking about all the way back to the cyber boardroom, right? So, so we're going to create a dedicated website for this, and and we're going to start by mapping out and understanding exactly the vulnerability, exactly the attack vector, exactly the exploits, the vulnerable systems, and especially tracking information, mapping out who is saying what? Who is actually communicating? You know, who's basically finding new? Like, what's new? What's a new piece of information? What's being recycled? And I'm especially interested in in basically in the provenance of some of these news, and it's like who's who's bringing it in, who's reporting it, you know, what's the sequence of events, right? And also visualising a lot of this because there's a lot of moving parts on this stuff, right? So the the first thing that I would like is to start off. You know, basically there's multiple threads here. There's this sort of information gathering, raw data, which we're going to use volts for, there is the understanding and mapping what exactly is going on, the current state of affairs, what's being exploited, what's the vulnerabilities, etc. Right? That exists, and this is a vulnerability that was kind of there for a while, but they thought it was theoretical, and now somebody discovered it, and then it's being a little bit botched up because somebody leaked it, and and now they they rush to do a patch, right? So there's a lot of things here who are not adding up, you know, and and I really want to understand more, right? But also, one of the most important things to understand here is we need to map the blast radius, right? Because this feels like a loss for J. This feels like a kind of a kind of the the sort of you know vulnerability that is in software that everybody no that a lot of people use, right? And and that's kind of the first one. Like the first one, I want to really understand is, is the exposure here, right?

Dinis Cruz 5:04 Because the some of the reports say like 70% of the internet is impacted. Some of the reports say tonnes of websites are impacted, and we need to understand that, right? We need to understand, okay, you know, you know there is there's a difference between a vulnerability that literally brings 70% down of everything, or even 20% down, versus this, right? The the thing that also is important to take into account, right, is that first of all, we need to map out. Okay, so this this does remote code execution on on a website, right? But it doesn't mean that the website is compromised. Well, everything is compromised from day one, right? But what means it means that that website is compromised. But it depends what you're going to do with it, right? Depends what's on either side. Depends what credential exists on that website. Depends on what information exists on a website. So that needs to be mapped, right? It also depends on what type of website actually exists, right? And and what are the assets? So so the first kind of thing to do is to really map out what what would a compromise of that website mean? And this is with a threat model. It's a great way to map this out in blast radius and understanding how this works. And we can actually provide some interesting toolkits and vaults and examples for for how to how to to help with this, right? Because you know, again, this is just the first step, right? So, for example, like if you have a website that has you know a bunch of protections on the other side, right? Like you know, it's a bit like I think yesterday I wrote a document that was basically saying, you know, yes, you can have all the credentials for a website, but if you can't use them, then that's not a problem. Now people already done, you know, shell, you know, PHP for shell on this, which is an example of the weaponization. So you now have remote code execution, but then what signals do you have? Like you know, and this is important, right? It's important to understand that a zero day like this is not invisibility cloak, right? So we have to be objective, right? We have to be objective from a point of view of what actually is being exploited, and what are the signals for that exploitation, right? Which is very important. And and then the other element here is also how many sites have actually been exploited, and what's the path, and what is actually happening on the ground because this is also an important signal, right? It's important signal to say, you know, if this is that vulnerable, then you would see a ridiculous amount of exploits, right? Especially if they're being weaponized, right? And I think it's important to track this over time because you would see, you know, this sort of level of exploitation happening throughout the throughout the day and throughout the the months, right, or the the hours, and you would see this sort of massive spike of attacks, right? Because the point here is that we have to start with the assets, right? You have to start with what's on the other side, what's exposed, what's actually, you know, being exploited on this, and then what's the consequences. So we we need to basically start from the whole premise of mapping out what exists, mapping out the latest status of the research, the actual vulnerability. You know, find really good sources, which I'm sure they start to be, of of what the actual vulnerability is, and also think about, you know, what would the website dedicated to this vulnerability look like? You know, like it's almost like, well, if we're going to create the perfect website for tracking this vulnerability and and mapping it out, what would it look like? What would we have? What do we need to capture what's basically the the information about it, and then we need to start, you know, mapping the structure, right, of of the vulnerability.

Transcribed by https://otter.ai

Dinis Cruz 0:00 So this is again for the agent that is gonna help set up the website for the PHP vulnerability. So this is gonna be a website that is like a dedicated sub site. I think we're gonna call it stories, but in story, right? So it's going to be something like newsroom. So it's going to be like PHP or CVEX, PHP 2026. We need a headline for this for the domain name, at and then I'm not sure if there's a name already for it. dot story dot newsroom dot esquitoai, and and that website is going to be basically our reference website that we're going to basically set up a full agentic workflow to be as fact driven as as we can, and well, we might we might want to do some analysis on it, but but the idea is to be as fact driven as possible, so not opinionated, not. I think I think maybe the thing to do is to maybe leave for now the newsroom. What's it called? The main newsroom to have facts and opinions about it, where we put that into context, etc. And what we do is we we basically create this website that has fundamental. multiple audiences, and also shows the agentic workflow from journalist to researcher to security professional to PHP expert to analyst to board member to advisor. So we can create all these roles, and then we can basically create messaging for different roles, and we can basically create sort of a a website that can follow the story. But there's a couple of very important points that I really want us to to do, because I want to do this as a way to also capture the provenance and how the story changes over time, and how data maps out, and how accurate things are, and and that's why we need to have the whole semantic fractal graph, and we need to have this whole sort of converting the graphs, converting the the data that we get into graphs, and then connecting the dots, and then finding the evidence, and then you know finding the facts, opinions, and really go deep on it, right? And and like, and a good example is like, for example, the internet has the BBC has that 70% of the internet is impacted, which is a crazy statement. Which then you look at the source, and the source says 70% of websites are impacted, and they look at it. Say 70% of websites that we can measure the language are impacted. Now, I've been in security and technology for a long time, and I and I could I don't buy that 70% of websites out there, especially some sort of websites that matter, that have a huge amount of information, are a impacted. B don't have other ways to protect this, right? Because because what we have to take into account is that, and this is what I want to understand: is like you know where is the vulnerability, how it can be exploited, how it can be detected, like can you protect? Can you can you put a simple patch in front of it, right? Like, can you do a a fix? There was things they say you can remove some stuff from the website, right? So let's let's also map out what can you actually do to fix it, what can you do to to mitigate it, you know, like if you have a vulnerable system, what what are the steps? Because at the end of the day, we should map out like all the steps. If you have a vulnerable system, we should have a full-blown guide, backed with evidence, backed with basically the guidance to how you're going to fix it, what you're going to do about it, what's what's the deal? What's the what's it called? What's the the steps and and you know and that you should do before, doing, after, including like the whole you know putting a website offline is an option, but should be like at the end of a long sequence of events, right? But also, it should be one of those things where companies should be able to do it very quickly, right? Like you know, this is the whole pull the plug, right? You know, like how fast can you pull the plug of a system, right?

Dinis Cruz 4:52 And in principle, you if you have a good system flying around, and if you have a good tech stack, right, you should be able to reasonably quickly, right? You know, remove a website from being offline. In fact, that's good practice, right? And you should also be able to monitor all the traffic, and you should be able to monitor and detect exploitation, right? Because this is quite a thing. And now, so then the question becomes: How easy it is to detect? How easy it is to detect exploitation? Does it show up in the logs? Do you have good signatures? Can can a wife protect it? Can can intrusion detection tools protect it? Can you? Is there things that you can deploy right now? So let's create a website that has also the best of what's out there. Find out who's who. Who are the researchers? Who are the people pushing good advisory? What is good data about it? What's fact? What's fiction? And I really want us to track expectation numbers, and I want us to track patches numbers. I want to track like which systems are vulnerable, which systems are not vulnerable. You know, all of that.

Transcribed by https://otter.ai

Dinis Cruz 0:00 Okay, so this is now a brief. This is interesting because I guess which is the agent that should be doing this. Let's now let's make this the Sherpa because I think the Sherpa is the one that owns the customer, owns the user experience, right? So what I would like to experiment now, and let's start with the CEO, right? But fundamentally, the CEO is a board level, right? In a way, C level, exactly. And and what I would like us to focus on is on that message. And the message basically is if the CEO lands on the website, right, what should they see? What are the primitives that it should see? And this is where we need to also involve the agent to think about this, right? So, so we need to first of all have a semantic graph for that user, right? Like, what does he care about? What does it focus on? And we should actually say, you know, like this is This is the the the this is the the view for that user. This is what it looks like, right? And this is the assumptions that we made. And then we should allow in where this graph to be modified because if this graph is modified, in where this should be again another level of dynamic elements to this, right? So there's a couple of primitives I think we need to explore. One of them is the primitive of time. So what's interesting about this is that we should have. We talked about this already, right? But we should have a view of the website on specific milestones, and this is where, from an instant point of view, they become bigger or smaller as they are events or over time. So, for example, we should have a briefing in the first couple of hours when things just took off, right? So it's it's kind of like what does the briefing to the CEO looks like to the C level exec? Sorry, looks like at zero hours, right? Like you know, literally as it happened, the first time we hear something, what is there, right? What's available? What's to do? In fact, I think what's interesting is that we should actually capture, we should map out what are the significant timeline moments here, and I think the significant timeline moments are when what's it called when the vulnerability was first reported, when the the what's it called? When it first became an issue, when you know basically you have this sort of sequence of events happening, right? And and then when it was leaked, and and what is interesting because we should have the data, right? Because we should have our timelines, so we should reverse engineer, and then eventually the idea is that next time we'll be obtaining this in real time, right? Because the data is very interesting here. I always find that in this event sometimes we don't capture is that it's very important to capture what we knew at what moment in time? Because that's what determines the activity, and that's what determines the action, right? And and it's easy sometimes to reverse engineer and to rewrite history, not fully understanding that at that moment in time we made decisions based on this version of reality, and I think that's one of the powers of our graph, especially if a graph has timestamps on it, and he has connection with it, we should go to say, look, at at plus two hours or five plus hours or one day after or two days after or today, right? Five days after or you know, X days after this whole thing kicked off, right? This is what we knew. This is the data that was known, because sometimes you know it's easy to you know basically go to sometimes and says, oh, there's been some not very good reporting here, but you have to also take into account the data that was available at that moment in time for that reporting, right? So it's it's not these these things are never you know as simple, right, as that, so so from let's start with the C level exec, right? So so the C level exec, which we might consolidate. I think we have quite a lot of you know pieces of the puzzle now. So personas, right? I think we might simplify that a little bit.

Dinis Cruz 5:05 Is but let's start with this one, right? So the C level exec, what do we know at each moment in time, and what's the briefing? And so, for example, let's say the difference between day one and day two. You know what has changed? So, so imagine, and I think, I think one of the important points here is that we have to also think about the audience, right? And one of the audiences here is the cybersecurity team that needs to brief the executive. So this is very important, right? It's very important to think that, for example, the audience, from a probability point of view, is much more likely that the the C-level exec, the CISO or the cybersecurity team, is going to be the one viewing this page, not the board level, right? The CEO. But what we need to do is we need to make it easy for that exec, for that cybersecurity person to send the materials to the CEO. So that's why it's so important that everything we do here, we think from a point of view of reusability of change, also Creative Commons, modify it, right? So everything here should be accessible, downloadable, downloadable in text format, in JSON format, in you know, in in HTML format, which you can, and also we have slides, and we already have this interesting, nice way to create PDFs on the browser from the HTML. So I don't want to be uploading PDFs left, right, and centre, but we should be able to create the PDFs from the HTML, right? So every time you make a presentation, you should be able to export it, right? And then import it. And then if there's demand, we could also look at creating PowerPoint. So although these days we we can even have prompts, for example, to say bring this to Claude, and then modify it here, right? So or ChatGPT, right? And then the thing. The point is, and this is an article probably that should be written in guidance, is that a lot of the stuff that we do here, even the chamfer, one of the sherpa's main users is cybersecurity professionals right? Yeah. So, so the use case here is, I as an exec come to the website, and let's say I want to see what's happening right now, or what happened, what was the evolution. But let's say it comes. I want to happen right now, right? So you see a slice. You see a slice at the last moment that there was a significant update. Well, that we ran it, but also there was a significant update for that stakeholder, right? Because remember that we're going to have different updates for different stakeholders, right? And they should change, right? Because sometimes you might have new technical information coming along that We we don't have the the information about it, right? So so then the person comes and then he marks as red, and and again let's assume that he marks as red on his browser, right? So you can see that this is where that person was, right? So if that person comes again, we should also say, "All right, nothing has changed since the last time he was here." So that's very important, right? And that's the beginning of again that usability, and which again remember, he goes to the billing element of it, right? And then you have the next phase is we do an update and so now these updates are incremental, so these updates are again what you would send to your board to say that something happened. So, for example, last night we could have the update that said there has been no confirmed exploitation, right? So that means the risk of exploitation is still low, or at least you know we haven't seen reports of it, and the what's it called? But there's been X amount of websites offline, right? There's a whole bunch of websites been taking offline, and because of this, right, and so now you that's an update, right? So, so what's important is that we have this sort of over time view. So that's one. The other one that I think is very important is to have a whole section that maybe has even presentations on each. Who kind of explains in in in sort of it starts with the jargon, but then it goes into executive.

Dinis Cruz 9:49 And you have to remember that a lot of times even technical people might not fully understand the implications, right? So you kind of have to explain it in very easy to understand terms, right? And that's why infographics, you know, storyboards, you know, visual representations are so powerful, right? So, so what you want to do is let's say somebody goes, "What is PHP, right? What is the problem? What is the attacker? Who? What? What should I worry about? What is going on, right? What situation? What actually happened?" So, in a way, maybe have five or six key questions, which then I want to ask people for feedback, right? But if you have five or six key questions that we you answer very very explicitly, so you can say, okay, this is what PHP is. This is the thing. This is the stuff. And maybe why is PHP is probably not going to be the first question. Maybe the first question is what is going on, right? And and and even now you might say that maybe that's the first presentation that they see, right? So this should be very visual, very sort of presentation style, and again have multiple views of viewing it. Like if I have a presentation, I should be able to see all the slides in one go, right? I should be able to see the slides one at a time. I should be able to see with animations, without animations. Again, you have to think about the cognitive load of the person seeing this. And actually, why don't we do you do this for three, three audiences straight away? And again, the maturity. So we should present them these at the top as kind of like you know the three views that we have on this, right? So one is the C level exec, the other one is the the CISO slash security exec, and the last one is the technical operator, right? Which is basically the one that needs to fix and implement

Unknown Speaker 11:35 this

Transcribed by https://otter.ai