<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:admin="http://webns.net/mvcb/"
	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">

	<channel>

	<title>&#45; CircleID</title>
	<link>https://www.circleid.com/blogs/</link>
	<description>Postings from  on CircleID</description>
	<dc:language>en</dc:language>
	<dc:rights>Copyright 2026, unless where otherwise noted.</dc:rights>
	<dc:date>2026-04-30T19:14:00+00:00</dc:date>

	
	<item>
		<title> The Diet Pill Security Model (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20181003_the_diet_pill_security_model</guid>
		<link>https://circleid.com/posts20181003_the_diet_pill_security_model</link>
		<description><![CDATA[The information security industry, lacking social inhibitions, generally rolls its eyes at anything remotely hinting to be a "silver bullet" for security. Despite that obvious hint, marketing teams remain undeterred at labeling their companies upcoming widget as the savior to the next security threat (or the last one -- depending on what's in the news today). I've joked in the past that the very concept of a silver bullet is patently wrong... <a href="https://circleid.com/posts20181003_the_diet_pill_security_model">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Security Talent Gap Is Misunderstood and AI Changes It All (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20180927_security_talent_gap_is_misunderstood_and_ai_changes_it_all</guid>
		<link>https://circleid.com/posts20180927_security_talent_gap_is_misunderstood_and_ai_changes_it_all</link>
		<description><![CDATA[Despite headlines now at least a couple of years old, the InfoSec world is still (largely) playing lip-service to the lack of security talent and the growing skills gap. The community is apt to quote and brandish the dire figures, but unless you're actually a hiring manager striving to fill low to mid-level security positions, you're not feeling the pain -- in fact, there's a high probability many see problem as a net positive in terms of their own employment potential and compensation. <a href="https://circleid.com/posts20180927_security_talent_gap_is_misunderstood_and_ai_changes_it_all">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Missing Piece of the Security Conference Circuit (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20180925_the_missing_piece_of_the_security_conference_circuit</guid>
		<link>https://circleid.com/posts20180925_the_missing_piece_of_the_security_conference_circuit</link>
		<description><![CDATA[So far this year I think I've attended 20+ security conferences around the world - speaking at many of them. Along the way, I got to chat with hundreds of attendees and gather their thoughts on what they hoped to achieve or learn at each of these conferences. In way too many cases I think the conference organizers have missed the mark. I'd like to offer the following thoughts and feedback to the people organizing and facilitating these conferences (especially those catering to local security professionals). <a href="https://circleid.com/posts20180925_the_missing_piece_of_the_security_conference_circuit">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Cyber Scorecarding Services (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20180425_cyber_scorecarding_services</guid>
		<link>https://circleid.com/posts20180425_cyber_scorecarding_services</link>
		<description><![CDATA[Ample evidence exists to underline that shortcomings in a third-parties cybersecurity posture can have an extremely negative effect on the security integrity of the businesses they connect or partner with. Consequently, there's been a continuous and frustrated desire for a couple of decades for some kind of independent verification or scorecard mechanism that can help primary organizations validate and quantify the overall security posture of the businesses they must electronically engage with. <a href="https://circleid.com/posts20180425_cyber_scorecarding_services">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Bug Bounty Programs: Are You Ready? (Part 3) (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170220_bug_bounty_programs_are_you_ready_part_3</guid>
		<link>https://circleid.com/posts20170220_bug_bounty_programs_are_you_ready_part_3</link>
		<description><![CDATA[The Bug Bounty movement grew out a desire to recognize independent security researcher efforts in finding and disclosing bugs to the vendor. Over time the movement split into those that demanded to be compensated for the bugs they found and third-party organizations that sought to capitalize on intercepting knowledge of bugs before alerting the vulnerable vendor. Today, on a different front, new businesses have sprouted to manage bug bounties on behalf of a growing number of organizations new to the vulnerability disclosure space. <a href="https://circleid.com/posts20170220_bug_bounty_programs_are_you_ready_part_3">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Characterizing the Friction and Incompatibility Between IoC and AI (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170125_characterizing_the_friction_and_incompatibility_between_ioc_and_ai</guid>
		<link>https://circleid.com/posts20170125_characterizing_the_friction_and_incompatibility_between_ioc_and_ai</link>
		<description><![CDATA[Many organizations are struggling to overcome key conceptual differences between today's AI-powered threat detection systems and legacy signature detection systems. A key friction area -- in perception and delivery capability -- lies with the inertia of Indicator of Compromise (IoC) sharing; something that is increasingly incompatible with the machine learning approaches incorporated into the new breed of advanced detection products. <a href="https://circleid.com/posts20170125_characterizing_the_friction_and_incompatibility_between_ioc_and_ai">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Bug Bounty Programs: Are You Ready? (Part 2) (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170124_bug_bounty_programs_are_you_ready_part_2</guid>
		<link>https://circleid.com/posts20170124_bug_bounty_programs_are_you_ready_part_2</link>
		<description><![CDATA[In Part 1 of "Bug Bounty Programs: Are You Ready?" we examined the growth of commercial bug bounty programs and what organizations need to do before investing in and launching their own bug bounty. In this part, we'll discuss why an organization needs to launch a bug bounty program, and what limits the value they will likely extract from such an investment. <a href="https://circleid.com/posts20170124_bug_bounty_programs_are_you_ready_part_2">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Bug Bounty Programs: Are You Ready? (Part 1) (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20170123_bug_bounty_programs_are_you_ready_part_1</guid>
		<link>https://circleid.com/posts20170123_bug_bounty_programs_are_you_ready_part_1</link>
		<description><![CDATA[The premise of crowdsourcing the task of uncovering new bugs and vulnerabilities in an organization's web applications or consumer products sounds compelling to many. What's not to like with the prospect of "many eyes" poking and prodding away at a corporate system for a minimal reward -- and preemptively uncovering flaws that could have been exploited by hackers with nefarious intent? <a href="https://circleid.com/posts20170123_bug_bounty_programs_are_you_ready_part_1">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Edge Computing, Fog Computing, IoT, and Securing Them All (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20161227_edge_computing_fog_computing_iot_and_securing_them_all</guid>
		<link>https://circleid.com/posts20161227_edge_computing_fog_computing_iot_and_securing_them_all</link>
		<description><![CDATA[The oft used term "the Internet of Things" (IoT) has expanded to encapsulate practically any device (or "thing") with some modicum of compute power that in turn can connect to another device that may or may not be connected to the Internet. ... The information security community -- in fact, the InfoSec industry at large -- has struggled and mostly failed to secure the "IoT". This does not bode well for the next evolutionary advancement of networked compute technology. <a href="https://circleid.com/posts20161227_edge_computing_fog_computing_iot_and_securing_them_all">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Sledgehammer DDoS Gamification and Future Bugbounty Integration (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20161207_sledgehammer_ddos_gamification_and_future_bugbounty_integration</guid>
		<link>https://circleid.com/posts20161207_sledgehammer_ddos_gamification_and_future_bugbounty_integration</link>
		<description><![CDATA[Monetization of DDoS attacks has been core to online crime way before the term cybercrime was ever coined. For the first half of the Internet's life, DDoS was primarily a mechanism to extort money from targeted organizations. As with just about every Internet threat over time, it has evolved and broadened in scope and objectives. The new report by Forcepoint Security Labs covering their investigation of the Sledgehammer gamification of DDoS attacks is a beautiful example of that evolution. <a href="https://circleid.com/posts20161207_sledgehammer_ddos_gamification_and_future_bugbounty_integration">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> NTP: The Most Neglected Core Internet Protocol (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20161205_ntp_the_most_neglected_core_internet_protocol</guid>
		<link>https://circleid.com/posts20161205_ntp_the_most_neglected_core_internet_protocol</link>
		<description><![CDATA[The Internet of today is awash with networking protocols, but at its core lie a handful that fundamentally keep the Internet functioning. From my perspective, there is no modern Internet without DNS, HTTP, SSL, BGP, SMTP, and NTP. Of these most important Internet protocols, NTP (Network Time Protocol) is the likely least understood and has the least attention and support. Until very recently, it was supported (part-time) by just one person. <a href="https://circleid.com/posts20161205_ntp_the_most_neglected_core_internet_protocol">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> The Purple Team Pentest (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20161130_the_purple_team_pentest</guid>
		<link>https://circleid.com/posts20161130_the_purple_team_pentest</link>
		<description><![CDATA[It's not particularly clear whether a marketing intern thought he was being clever or a fatigued pentester thought she was being cynical when the term "Purple Team Pentest" was first thrown around like spaghetti at the fridge door, but it appears we're now stuck with the term for better or worse. Just as the definition of penetration testing has broadened to the point that we commonly label a full-scope penetration of a target's systems with the prospect of lateral compromise and social engineering as a Red Team Pentest -- delivered by a "Red Team" entity operating from a sophisticated hacker's playbook. <a href="https://circleid.com/posts20161130_the_purple_team_pentest">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Navigating the "Pentest" World (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20161128_navigating_the_pentest_world</guid>
		<link>https://circleid.com/posts20161128_navigating_the_pentest_world</link>
		<description><![CDATA[The demand for penetration testing and security assessment services worldwide has been growing year-on-year. Driven largely by Governance, Risk, and Compliance (GRC) concerns, plus an evolving pressure to be observed taking information security and customer privacy seriously, most CIO/CSO/CISO's can expect to conduct regular "pentests" as a means of validating their organizations or product's security. <a href="https://circleid.com/posts20161128_navigating_the_pentest_world">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Exploiting the Firewall Beachhead: A History of Backdoors Into Critical Infrastructure (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20160928_exploiting_firewall_beachhead_history_of_backdoors_infrastructure</guid>
		<link>https://circleid.com/posts20160928_exploiting_firewall_beachhead_history_of_backdoors_infrastructure</link>
		<description><![CDATA[There is no network security technology more ubiquitous than the firewall. With nearly three decades of deployment history and a growing myriad of corporate and industrial compliance policies mandating its use, no matter how irrelevant you may think a firewall is in preventing today's spectrum of cyber threats, any breached corporation found without the technology can expect to be hung, drawn, and quartered by both shareholders and industry experts alike. <a href="https://circleid.com/posts20160928_exploiting_firewall_beachhead_history_of_backdoors_infrastructure">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	
	<item>
		<title> Watching the Watchers Watching Your Network (Featured Blog)</title>
		<guid isPermaLink="true">https://circleid.com/posts20160129_watching_the_watchers_watching_your_network</guid>
		<link>https://circleid.com/posts20160129_watching_the_watchers_watching_your_network</link>
		<description><![CDATA[It seems that this last holiday season didn't bring much cheer or goodwill to corporate security teams. With the public disclosure of remotely exploitable vulnerabilities and backdoors in the products of several well-known security vendors, many corporate security teams spent a great deal of time yanking cables, adding new firewall rules, and monitoring their networks with extra vigilance. <a href="https://circleid.com/posts20160129_watching_the_watchers_watching_your_network">More...</a>]]></description>
		<dc:date>2026-04-30T12:14:00-07:00</dc:date>
	</item>
	

	</channel>
</rss>