Young hacker smiling

Zero false positives

Expert intelligence + effective automation

Yellow police line tape on Unsplash: https://unsplash.com/photos/jM6Y2nhsAtk

Preventing Hacks at CERN

A chat with Andrés Gómez.

Have you heard about God’s particle? In 2012, the Large Hadron Collider (LHC) found the Higgs Boson; a particle predicted to exist in the 1960s thanks to the work of Peter Higgs and other physicists. The LHC consists of a 27-kilometer ring of superconducting magnets with several accelerating structures …



Parsing code. Photo by Markus Spiske on Unsplash: https://unsplash.com/photos/hvSr_CVecVI

Parse and Conquer

Why Asserts uses Parser combinators

As you might have noticed, at Fluid Attacks we like parser combinators, functional programming, and, of course, Python. In the parser article, I showed you the essentials of Pyparsing and we also showed how to leverage its power to find SQL injections in a PHP application. Here we will extend …



multicolor abstract paint on Unsplash: https://unsplash.com/photos/YQrUzrsRNes

Seek for chaos and dive into it

The Antifragile philosophy

Imagine a medium-sized sealed carton box, with two or three glasses inside. If you kick the box (like kicking a soccer ball), the glasses will surely break. The glasses are fragile. Now, think of the same box, but with two or three standard steel hammers. Nothing will happen to those …



Chess strategy. Photo by Inactive. on Unsplash: https://unsplash.com/photos/nAjil1z3eLk

Great Expectations

What to expect when you're at risk

Thus far, the situations we have modeled have been either over-simplifications or fabrications in order to illustrate a concept. This article will try to improve on that a bit by considering more variables and closer to reality, too. We will do so by presenting the subject matter needed to understand …



Born into cloud

Secure Cloud as Code

The weakest link in security is not the technology.

Amazon Web Services (AWS) is one of the biggest cloud services used by thousands of companies around the world, and with a centralized and strong security, it is one of the best on the market. Services like Terraform or AWS CloudFormation allow us to write our infrastructure definitions as code …



Broken blue ceramic plate on Unsplash: https://unsplash.com/photos/Odc4dcsjUBw

The F*CK strategy

The pratfall effect application on business

Do you like fried chicken? A year ago or so, KFC -the chicken fast-food chain- was featured in almost every news outlet in the UK: they ran out of chicken for an entire weekend. A horror story for a food-chain with 900 restaurants in the country. People were mad at …



Yellow police line tape on Unsplash: https://unsplash.com/photos/jM6Y2nhsAtk

Do not read this post

What if this post were a malicious link?

Why the f*ck did you click to this post? Seriously, why? Chances are, you were attracted to the title, paradoxically, suggesting not to do something. But, here you are. We are glad you did not follow that direction but we deliberately crafted that title to attract your attention, to …



Finance simulation. Photo by M. B. M. on Unsplash: https://unsplash.com/photos/ZzOa5G8hSPI

Quantitative Python

Risk management with Python

Now that we have an understanding of risk concepts such as the loss exceedance curve, value-at-risk, Bayes Rule, and fitting distributions, we would like to have a realiable, extensible and preferably open tool to perform these computations. In the background, we have used a spreadsheet, which is hard to extend …



Fire extinguisher. Photo by Tommaso Pecchioli on Unsplash: https://unsplash.com/photos/XG_wi3W4-m8

Para bellum

Prepare for the worst risk

"Si vis pacem, para bellum", goes the old adage. If you want peace, prepare for war. In our case, the worst possible risky scenario our information assets could go into. While probability distributions, loss exceedance curves, simulated scenarios, etc, are all great for the quants in the office, at the …



Baseball hit. Photo by Chris Chow on Unsplash: https://unsplash.com/photos/BhwRQr08PcM

Hit or miss

Estimating attack probability

One of the main obstacles against adopting a quantitative approach to risk management is that since major security breaches are relatively rare and hence, there cannot be enough data for proper statistical analysis. While this might be true in the classical sense, it is not if we adopt a Bayesian …



New information. Photo by M. Parzuchowski on Unsplash: https://unsplash.com/photos/GikVY_KS9vQ

Updating your beliefs

How Bayes Rule affects risk

Usually, changing our beliefs is seen as a negative thing. But when those beliefs represent our state of uncertainty regarding a particular cybersecurity risk, you’d better use all the tools at hand to reduce that uncertainty, i.e., measuring. Why do we speak of "belief" and not "probability" here …



Git On Steroids

Git on steroids

From messy logs to Data Analytics

There is a universal law that anyone in the tech world should know: If you ask a programmer to do something, he/she will do it their way. Even though creativity, abstract thinking, and putting your signature in your source code is a fundamental part of programming, sometimes it also …




Service status - Terms of Use