Shareable versions · 1 deck

Carousels

Posts from this site, distilled into slides for LinkedIn and sized for anywhere else. Each deck links back to the full post, and each one downloads as a PDF with real, selectable text.

Dispatch · Security engineering9 slides

The Attack Surface of Security Language

  1. trusted, adj. The word becomes executable: if user dot trusted, allow. The Attack Surface of Security Language. Your security controls run on vocabulary. Who owns the definitions?
  2. The premise. Security tooling is sold as if it were about attackers. Most of the time, it is about ordinary lives. The volunteer locked out of a shared account; The administrator working past midnight; The user who does not resemble the model's idea of a person. The system does not ask who they are. It asks whether they fit.
  3. Detection is not perception. anomalous, adj. Struck through: a threat. Replaced with: A distance from a chosen baseline. Every baseline encodes a population it considers ordinary. Whoever falls outside it pays in friction: repeated challenges and lost time, until the tool gets abandoned.
  4. Labels compress. trusted, adj. Struck through: a character judgment. Replaced with: Trust granted by someone, for a purpose, within a scope, under conditions that can change. The adjective hides every one of those clauses. That compression is an operational risk.
  5. One word, three states. authorized, adj. Authenticated successfully; Permitted to perform this action; Approved in advance. Collapse them into one word and you create gaps an attacker can use and an operator may not notice until after the incident.
  6. The fix: a load-bearing lexicon. If changing a word's definition would alter an alert, permission, workflow, escalation path, or user consequence, govern it like code. lexicon/authorized.yaml: term: authorized; definition: one state, stated precisely; owner: who may change it; scope: where it applies; failure_modes: known, written down; evidence: what supports the baseline; review: a date; contested: interpretations on record.
  7. The frameworks already admit context. NIST AI RMF 1.0 describes AI systems as inherently socio-technical, shaped by human behavior and social dynamics. NIST CSF 2.0 places GOVERN at the center of its functions, starting with organizational context. The next step is to ask what that admission requires of the categories those systems use.
  8. The human cost. A false positive leaves a social residue. Volunteers stop reporting suspicious behavior; Administrators build workarounds; Users learn the system's idea of legitimate excludes them; The alert stream becomes a second inbox. Measure friction alongside detection. After every block, ask what behavior the system produced.
  9. Categories must remain repairable. The moment a word becomes load-bearing, it becomes part of the attack surface. Read the full dispatch.

Read the postDownload PDF of The Attack Surface of Security Language