@diego-ferreira

Community member since Jul 2026

Security consultant, mostly GRC and IR readiness. I live in client war rooms — breach disclosure, tabletops, comply-first debates. Skeptic by trade.

First ShareFounding MemberEstablished SharerValued Voice

Shared decisions

As the CISO briefing the board, decide whether to move board and executive communications to a company-managed end-to-end-encrypted channel with governed retent
Board risk
Board memo: approve a **90-day controlled migration** of board and executive sensitive communications to a **company-managed, enterprise E2EE channel with governed retention**. Do **not** approve consumer messaging or unmanaged encrypted apps as the control. The rationale is not that E2EE eliminates state risk; it…
As the CTI analyst, decide whether to keep submitting TLP:AMBER indicators and victim context through government information-sharing platforms after DHS's own H
Risk acceptance
Risk acceptance memo: For the next 30 days, adopt a controlled-sharing posture rather than normal full-context submission through government information-sharing platforms. Continue sending sanitized, machine-actionable indicators and defensive measures where appropriate, but route victim-identifying,…
As the SOC shift lead, decide whether the in-the-wild exploitation of CVE-2026-20896 in the official Gitea Docker image — the same image running our internet-re
SOC escalation
SOC decision: do not keep this Gitea CI server operating normally behind VPN while you “look around.” Based on the briefing and panel review, CVE-2026-20896 is reported as an auth-bypass issue in affected official Gitea Docker deployments where reverse-proxy auth trusts spoofable headers such as `X-WEBAUTH-USER`;…
As the SOC shift lead, decide whether to hunt for JSP webshells across our Cisco Unified CM voice stack before patching CVE-2026-20230 — preserving forensic evi
SOC escalation
Decision: do not choose “hunt indefinitely before patching.” Treat this as **contain immediately, preserve a minimum evidence set, then patch**. Per the briefing and CyberBrief corpus, CVE-2026-20230 exploitation has been reported against Cisco Unified CM/WebDialer with JSP/Axis webshell activity; CISA KEV status…
As the SOC lead, decide whether CERT-In's warning about VBScript malware spreading through compromised WhatsApp accounts justifies blocking WhatsApp Web at the
Risk acceptance
Do not block WhatsApp Web globally tonight; approve a time-boxed risk acceptance through 2026-08-19 only for managed browsers/endpoints with compensating controls. Treat the CERT-In warning as referenced in secondary reporting, while separate researcher/vendor reporting describes similar WhatsApp Web/Desktop…
As the SOC shift lead, decide whether the active exploitation of SimpleHelp's CVE-2026-48558 — the RMM platform our MSP uses to manage every one of our endpoint
SOC escalation
Declare a SEV-1 compromise assessment tonight unless the MSP can prove within two hours that the SimpleHelp instance was not exposed, not vulnerable/OIDC-enabled, or has complete clean telemetry for the exposure window. The CyberBrief corpus and panel verification tie CVE-2026-48558 to active exploitation reports;…
As the GRC lead of an EU-regulated financial entity, decide whether yesterday's four-hour payment-authorization outage meets DORA's major ICT-related incident c
Regulatory
A four-hour payment-authorization outage at an EU-regulated financial entity, in DORA's first real supervisory enforcement cycle. The panel classifies it as major — starting the supervisor notification clock — or documents it non-major with the classification evidence attached.
As the GRC lead running a readiness tabletop, assume an actively exploited vulnerability is confirmed in our flagship connected product on 12 September 2026 — o
Regulatory
Regulatory decision note: the current draft disclosure pack should **not** be approved as CRA-ready as written. A mature generic evidence pack may be reused, but the CRA/SRP submission layer must be rebuilt field-by-field for the 24-hour early warning, 72-hour notification, and later final report. Decision: rebuild…
As the consultancy advising our manufacturing client's leadership, decide whether the sample files World Leaks published as proof of the Tata Electronics breach
Vendor claim
The public World Leaks samples do **not** prove a confirmed Tata supplier breach, but they are credible enough to justify a **narrow preservation and attestation notice now** if the client has direct Tata exposure. Evidence grade is **low-moderate to moderate**: plausible document patterns and Tata’s acknowledged…