Week in Review: Google and Cloudflare outages, Copilot Zero-Click, Cloudflare's Claude flair

Summary

Cyber Security Headlines: Week in Review – June 13, 2025

Hosted by Rich Stroffolino of the CISO Series, this episode provides an in-depth analysis of the latest cybersecurity incidents and developments from the past week. Special guest Christina Shannon, CIO at Kick Consumer Products, shares her expert insights on the discussed topics.

---

1. Google Cloud and Cloudflare Outages

Overview:
On Thursday, both Google Cloud and Cloudflare experienced significant outages that disrupted numerous services, including Google Home, Nest, Snapchat, Discord, Shopify, and Spotify. Users reported authentication failures and connectivity issues with Cloudflare's Zero Trust Warp, with Down Detector logging tens of thousands of affected instances. The disruptions began around 1:15 PM Eastern Time and were resolved by the afternoon.

Discussion:
Rich Stroffolino highlighted the pervasive reliance on these services, noting that outages like these reveal the critical dependencies organizations have on cloud infrastructure.

Christina Shannon's Insight:
"When I saw these outages, the first thing that came to mind was the AWS East incident from years ago. It underscored the need to expand our tabletop exercises to include scenarios where key cloud services like Zero Trust gateways or SSO are unavailable. Ensuring that our business-critical applications remain operational in such events is paramount."
[03:05]

Key Takeaway:
The outages emphasize the necessity for organizations to implement robust contingency plans and diversify their cloud dependencies to mitigate the impact of such disruptions.

---

2. Zero-Click Data Leak Flaw in Microsoft Copilot

Overview:
Researchers at AIM Labs uncovered a vulnerability in Microsoft 365 Copilot, termed "Echo Leak." This flaw allows attackers to perform zero-click data leaks by embedding hidden prompt injections within ordinary business emails. The malicious payload can bypass Microsoft's cross prompt injection protections, enabling the retrieval of internal data and sending it to unauthorized third-party servers.

Discussion:
Rich discussed the sophistication of the attack, which leverages the Retrieval-Augmented Generation (RAG) engine to inject malicious content seamlessly.

Christina Shannon's Insight:
"When evaluating Copilot services, it's crucial to restrict access to roles that don’t require high privileges until robust guardrails are in place. Additionally, implementing Data Loss Prevention (DLP) on outputs can mitigate the risks associated with such vulnerabilities."
[05:39]

Key Takeaway:
Organizations must enforce strict access controls and enhance their DLP strategies to safeguard against emerging threats targeting AI-driven tools.

---

3. IoT Cameras Streaming Secrets via Web Browsers

Overview:
BitSight researchers accessed 40,000 internet-connected cameras globally, with nearly half located in the U.S. These cameras, spanning data centers, hospitals, factories, and homes, were accessible via standard web browsers. Approximately 78% used HTTP, while the remainder utilized Real-Time Streaming Protocol (RTSP). The exposed feeds included sensitive areas like bedrooms and workshops, posing risks of stalking, extortion, and unauthorized surveillance.

Discussion:
Rich emphasized the alarming ease with which these devices can be exploited due to poor security practices.

Christina Shannon's Insight:
"Manufacturers need to enforce mandatory password changes upon setup to prevent default credentials from being exploited. Additionally, organizations should conduct regular security hygiene checks and involve security teams early in the deployment of IoT devices to ensure they are securely configured."
[08:16]

Key Takeaway:
Basic security measures, such as changing default passwords and restricting open ports, are essential to protect against unauthorized access to IoT devices.

---

4. Cloudflare’s OAuth Library Developed with Claude

Overview:
Cloudflare unveiled an open-sourced OAuth 2.1 library, primarily developed using Anthropic's Claude Large Language Model (LLM). The company provided comprehensive documentation, including full prompt histories detailing the interactions between developers and Claude during the library's creation. Developer Max Mitchell praised Claude's ability to generate clear documentation and handle substantial code blocks effectively, though he noted that human oversight was necessary for styling and maintenance tasks.

Discussion:
Rich and Christina explored the implications of AI collaboration in software development, particularly concerning documentation and quality assurance (QA).

Christina Shannon's Insight:
"AI tools like Claude are not here to replace developers but to enhance their productivity. The rise of QA developers signifies a shift where ensuring the quality and security of code becomes increasingly collaborative with AI assistance."
[13:11]

Key Takeaway:
AI can significantly bolster the software development process by handling documentation and repetitive tasks, allowing human developers to focus on more strategic and creative aspects of their roles.

---

5. Bipartisan Healthcare Cybersecurity Bill Introduced

Overview:
Congressman Jason Crow introduced a bipartisan bill aimed at bolstering cybersecurity within the healthcare sector. If enacted, the legislation would mandate collaboration between the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) to enhance threat intelligence sharing, provide security training to healthcare organizations, develop comprehensive risk management plans, and establish criteria for identifying high-risk assets.

Discussion:
Rich discussed the potential impact of the bill on healthcare cybersecurity practices and the role of CISA amidst budgetary challenges.

Christina Shannon's Insight:
"CISA plays a crucial role in supporting organizations that lack the resources to build cyber resilience independently. It's vital that budget cuts do not undermine their ability to assist sectors like healthcare, which face unique and evolving cybersecurity challenges."
[15:59]

Key Takeaway:
Strengthening cybersecurity in the healthcare sector requires sustained support and collaboration between federal agencies and healthcare organizations to address specific vulnerabilities and threats.

---

6. SinoTrack GPS Device Vulnerabilities

Overview:
CISA issued warnings about two critical vulnerabilities in SinoTrack GPS devices. These flaws allow attackers to access a vehicle's device profile, track its location, and potentially disable the fuel pump remotely. The security issues stem from the use of a universal default password and the lack of a password change requirement during setup. Additionally, the device ID, serving as the username, is easily discoverable via labels or online photos, facilitating unauthorized access.

Discussion:
Rich highlighted the broader implications of poor security practices in device manufacturing and user compliance.

Christina Shannon's Insight:
"Manufacturers must prioritize security by enforcing password resets during initial setup. Relying on users to change default credentials is ineffective, as many prioritize convenience over security. Implementing systems that automatically prompt or require password changes can significantly reduce such vulnerabilities."
[20:01]

Key Takeaway:
Ensuring device security requires proactive measures from manufacturers to enforce secure configurations, thereby reducing the risk of exploitation due to default or weak credentials.

---

Conclusion

Throughout the episode, Christina Shannon provided valuable perspectives on the intersection of cybersecurity practices and organizational behaviors. Key themes included the importance of proactive security measures, the evolving role of AI in enhancing cybersecurity, and the critical need for collaboration between various stakeholders to address emerging threats.

Notable Quotes:

• Christina Shannon on Cloudflare Outages:
  "The need to implement robust contingency plans and diversify cloud dependencies cannot be overstated."
  [03:05]

• Christina Shannon on Copilot Vulnerabilities:
  "Implementing Data Loss Prevention (DLP) on outputs is essential to mitigate risks associated with AI-driven tools."
  [05:39]

• Christina Shannon on IoT Security:
  "Regular security hygiene checks and involving security teams early in IoT deployments are crucial for safeguarding devices."
  [08:16]

---

For more in-depth discussions and daily updates on cybersecurity headlines, visit CISOseries.com.

Transcript

[Rich Stroffolino]

From the CISO series, it's cybersecurity headlines. Google Cloud and Cloudflare outages reported Thursday. Zero click data leak, flaw in copilot and IoT cameras worldwide. Stream secrets to anyone with a browser. These are some of the stories that my colleagues and I have selected from this past week's cybersecurity headlines. And now we're looking forward to some insight, some opinion and some expertise through for our bacon level returning guest. Yes, the fantasy football legend herself, Christina Shannon, CIO over at Kick Consumer Products. Christina, we haven't had you on since March. I gotta ask, how was your week in cybersecurity?

[Christina Shannon]

My week was great. So I'm in the chemical CPG space and in this space it's always a challenge between IT and ot. And we had some wins this week on security awareness. Just in time. Security awareness and some bridging between our two groups. So call that a win.

[Rich Stroffolino]

Good to hear. We cover those stories quite a bit. We have some in the lineup today, so good to hear. Always top of mind. That is good. Good stuff. Also some good stuff is our sponsor for today, Vanta A new way to GRC. Remember to join us on YouTube live. Do so go to cisoseries.com hit the old events dropdown and look for the cybersecurity headlines Week in review image. If you click on it, you will join us. You will join luminaries like Kevin Farrell, Robert Reed CCL that are already lighting up our chat room. Reid, I think is a new name in there. So he's leaving some emojis in there. It's all good, I guess. Emoticons. It's an emoticon technically. Sorry Reid, I don't mean to slight your keyboard sophistry there. Be sure to contribute your comments in the chat. We love to see them to help make the show better and we'll try to do our best to address them in the show. If you can't join us live, send us feedback through email. It's electronic mail. It's really catching on. Female feedbackisoseries.com is the address. Before we jump into the news, a quick reminder that these opinions are in fact Christina's own, not necessarily those of her employer, friends, staff or affiliates. First up here, Google Cloud and Cloudflare outages reported. You may have noticed this in your Internet life. Google Cloud and Cloudflare suffered outages yesterday impacting services such as Google Home and Nest, Snapchat, Discord, Shopify and Spotify, as well as creating access authentication failures and cloud. Cloudflare Zero Trust warp connectivity issues Down Detector received tens of thousands of report with impacted users experiencing Cloudflare and Google Cloud server connection, website and hosting problems. The issue started around 1:15pm Eastern and was resolved through the afternoon. Getting into some of the fallout here. Cloudflare is blaming their outage on Google but regardless it caused a ripple in parts of the interwebs especially if you're trying to authenticate if you are in fact a human. Resolved relatively quickly but it just shows how dependent we all are on fast and consistent up always Internet services got to have all the nines all the time. Christine, I'm curious what goes through your mind when you see these types of events happen.

[Christina Shannon]

Well, the first thing that went through my mind was I remember the AWS east incident. I'm like 21, right. That's what it reminded me of. But then, then the second thing I thought oh okay so the tabletop, the inventory has to expand a little bit where now you do blind tabletops, meaning for cloud providers, meaning pretend or look at it do the scenario where your zero trust gateway is gone, your SSO is gone and then are your business critical applications still running? I think that would be, I mean that's one of the strategies I think would be really effective and a lot of folks should start doing especially from this outage.

[Rich Stroffolino]

Yeah, Cloudflare is just one of those it always needs to be there. Right. For so much of this stuff and yeah that kind of like let's see how far down to the routes we can go when we're tabletopping. Very much critical. Even though it's notable enough that we're reporting on it. Right. There's outages on a lot of services all the time. Slack goes down and everybody doesn't work for a while. It's great. But you know, Cloudflare is a different beast altogether though.

[Christina Shannon]

Yeah. And Cloudflare where it sits to your point, it's, I mean that is super important to make sure you don't have a single point of failure right there and that you know, you can still your critical applications can still run. Agree.

[Rich Stroffolino]

All right, Next up here, 0 click Data Leak Flaw in Copilot Researchers at AIM Labs documented a flaw in Microsoft 365 copilot dubbed Echo Leak, part of an emerging class of LLM scope violation vulnerabilities. By sending an email with a hidden prompt injection in an otherwise banal business email, the researchers could get around Microsoft's cross prompt injection attack classifier protections, which is a surprisingly hard thing to say when a user later asks about the email. The retrieval augmented generation or RAG engine, if you're an LLM head, pulls in the malicious injection, inserting internal data into a crafted markdown image and then sending it to a third party server. It's a pretty clever little attack there, given that Microsoft has today announced the release of Copilot Vision, kind of a real time version of recall. CISOs probably should have a lot more work cut out for them with regards to employees who want to use these kind of copilot services at work. When it comes to evaluating these in this kind of new breed of LLM scope violations. I'm curious, Christina, what's your advice?

[Christina Shannon]

When I think about the Vision product, I'm like, it doesn't matter, right? If it's an invoice or if it's an admin screen, it captures it all, doesn't it?

[Rich Stroffolino]

Oh God, you somehow made it sound so much worse.

[Christina Shannon]

Well, you know, where I'd start is I'd look at, you know, what, what are the roles that are you're going to give this copilot license to. And I would make sure that you don't give it to any roles that have privilege, access or until you really put down your guardrails. Right. And then second, I mean, dlp, that's what comes back into play. You have to look at, you know, can you DLP on your outputs? I'd probably be where I'd start. First, two things.

[Rich Stroffolino]

Kevin Farrell helpfully pointing out that Clippy never did this back in the day. So you're moving, you know, Clippy was cool. Clippy was cool. It wasn't gonna narc on you. Yeah, it is interesting seeing these. You know, I've heard multiple people say, like everyone's, everyone's still piloting all of their copilot stuff, right? We're still stuck in this where we very clearly see there's a ton of opportunity, right, for productivity here. And it still feels so much like the wild west when it comes to understanding all the different threat services and these kind of attacks where, you know, you would barely see this as an attack, but it's like, oh, getting this to get ingested so it gets put out through the specially trained, you know, this algorithm that's trained so that it can be more useful to you. Right. Bring up Surface only. Your useful company information is, is something I think we're still trying to grasp and grapple with.

[Christina Shannon]

I think you're 100% right. Right. It's a new version of the new future zero day type of talk.

[Rich Stroffolino]

Alright, next up here. IoT cameras worldwide stream secrets to anyone with a browser. Security researchers at BitSight accessed 40,000 Internet connected cameras globally. Almost half of those were in the US which reveal live feeds from data centers, hospitals, factories and homes. Many required no hacking, just a Web browser. About 78% used HTTP and the rest used Real Time Streaming Protocol or RTSP. The findings back at. The findings back at DHS warning regarding Chinese made cameras and critical infrastructure could aid spies or criminals. Researchers also found IP feeds being shared on forums showing bedrooms and workshops, potentially for stalking or extortion or just general creepiness. Christina Almost every show there's a story where I feel like I have to look over my metaphorical glasses in a school Marmee fashion. Just get those down here and this is definitely one of them showing off my Aqualine profile. If there's only had been some sort of clue buried within the phrase, you know, Chinese made cameras in critical infrastructure. Is this the thing that obviously could happen happened or is there more to it here than that?

[Christina Shannon]

You know, I think that, you know, when I think about the actual cameras themselves, right. I always think it's a good idea to go and look at, you know, what the, there's a band list for the US and, and go look at that list and then see if you have cameras that are that manufacturer model. And if you do, you probably should look at switching those or replacing those. Right. But I think the problem is more so that a lot of folks really need to get back to the basics and look at. Are they resetting the password, the default password? They have port 80 open. Right. I don't know. I think a lot of it is, you know, do a day on Shodan IO. Right. Monitor. That's a scary, I mean that's a. You spend an hour there and leave just terrified. But I think a lot of it goes back to people are missing basic security hygiene when they put these devices in play. And it's especially scary and you know, industries like mine, chemical infrastructure or critical infrastructure. Right. Because you need the cameras because you have to have visibility of what you're doing, your production, you know, and your quality. But at the same time you also need to include the security guys up front or gals up front before you deploy them.

[Rich Stroffolino]

Yeah. And I certainly for you know, SMBs for home usage, it's a different situation in terms of the level of security awareness, you know, for lack of a better term. Although these devices aren't new so I would hope there'd be a little bit more at least skepticism, right? About what kind of if I'm buying a white label camera or something like that. But yeah, for business and stuff like that. Some of this does fall under basic hygiene. Again, don't want to not victim shaming here, but there has to be a basic level of this is connecting and displaying something for my network. I should probably look into how it's doing this in any way as opposed to plugin it works okay, just don't go to this one web address. Just go to our IP address and we'll be fine.

[Christina Shannon]

Exactly.

[Rich Stroffolino]

Before we run to our next story, we have to spend a few moments with our sponsor for today. Vanta Is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots and manual processes. Vanta with Vanta GRC can be so much easier while also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC program, including compliance, risk and customer trust, and streamlines the way you manage information. The impact is real. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. Get back time to focus on strengthening security and scaling your business. Get started at vanta.com headlines that's V A N T A dot com headlines I have to laugh Kevin Ferrell but the camera will arrive one day earlier and cost $4.37 less when all that critical infrastructure rip out stuff was going down. I don't know what is this four, five, five, six years ago now? I did very much sympathetic to being like we have X amount of budget we can do so much. It's a little bit more ridiculous when you get into the individual camera space. But Kevin, you made me laugh so thank you. Our next story here. Cloudflare creates OAuth library with Claude Cloudflare recently published the open sourced OAuth 2.1 library, which was written almost entirely by Anthropic's Claude LLM. I won't say Claude quite enthusiastically anymore. I just was very excited by this headline. Notably, the company also published a comprehensive documentation of the process and that includes a full prompt history. Like every single prompt they use all the inputs and outputs. Really interesting stuff. Software developer Max Mitchell reviewed that process, finding the LLM excelled when given a substantial code block to work off of and clear context and explanation of what needed to be changed. I'd also add that humans do that kind of well with clear context and good source material. In all instances, the LLM excelled at generating documentation. Famously humans terrible at that, however, the code needed human intervention for styling and other housekeeping tasks. Mitchell suggested looking at it the same way as collaborating with a human developer instead of expecting one off prompting success. You should see it as a collaboration on. On cloudflare's end, their tech lead, Kenton Varda, they oversaw the project, came in healthy dose of skepticism, didn't know if this was possible and ended up saying I was trying to validate my skepticism. I ended up proving myself wrong. So from waterfall to agile to DevOps to Claude, CICD now has a new Playmate. I'm curious, Christina, does this confirms people's fear that AI is coming for their jobs, or should we all be looking for our, our new AI collaborators here?

[Christina Shannon]

I don't think AI is coming for a developer's job. I think that there'll be a big difference on those who are using AI and those who aren't in terms of productivity and what you can build. Even more so though, I think that really what this proves is that there's going to be a fundamental shift and I think it's already happening in terms of the significance of the QA developer. For many years, a QA developer, it's always been, you know, get the product out the door. If it's got some bugs, you know, you know, we'll fix them, we'll iterate. But, you know, the glory's always been with, at least in my experience with the development team. Right. And then the QA developers are somewhat like the security engineers that are like, hey, don't release that yet. Right.

[Rich Stroffolino]

And so the noble Cassandras in their organization.

[Christina Shannon]

Yeah, exactly. So I really think that like the QA folks are going to get to shine and I think the developers are going to become more QA type developers in the long term.

[Rich Stroffolino]

Yeah. And it's really interesting just from my experience with that is QA is usually like, all right, I'll get my foot in the door with this and then I'll go, you know, then I'll go do the more prestigious work. The real, you know, not poo poo and QA in any way. Extraordinarily vital and hard work.

[Christina Shannon]

Yeah.

[Rich Stroffolino]

But I love that idea of that. That becomes where the human provides.

[Christina Shannon]

Right.

[Rich Stroffolino]

That value for a lot of this, like keeping one, keeping everything scrutable. Still, to human review, I think is also something that's going to be increasingly important for the stuff. Admittedly, it's a lot easier when you have AI that isn't too lazy to do the documentation. I think that's going to be One of those big boons that we don't yet appreciate. I need all my man files. AI, help me out with all those. I need good man files.

[Christina Shannon]

I completely agree. Right, you're right. Humans are not great at documentation. Whether it's it cyber, other professions. Yeah, we're not great at it. So I definitely think Claude and others can help there.

[Rich Stroffolino]

Alright, next up here. Bill strength seeks to strengthen healthcare security. Congressman Jason Crow introduced the bipartisan Healthcare Cybersecurity bill to Congress. If passed, the bill would require CISA and the U.S. department of Health and Human Services to work together on a measure to improve cybersecurity across the sector. This includes sharing of threat intelligence, CISA provided training to healthcare orgs, the creation of healthcare risk management plans with best practices and, and creating an objective basis for determining high risk assets. So Christina, it's interesting to hear all these things that CISA has yet to accomplish while it's also simultaneously facing some steep cuts and kind of a reimagining of their mandate. One could say not wanting to get into politics here but this bill being proposed, sectors like healthcare asking for CISA provided training, I guess what are we to assume about its future? Is this, is this a potential new direction for CISO or does not align with where the administration sees that agency going?

[Christina Shannon]

Well, you know, first of all, like I'd love to be in the room, you know, when they're deciding the priorities for budget cuts, right. Because I'd be the person probably get escorted out but the one definitely screaming they're like what? Come on, like put your thinking hat on. Like why? Let's look at all the data and look at all the breaches. Look at it. You know, let's not get rid of the folks who are trying to help, you know, mid sized companies or a lot of these companies who can't, who have proven time and time again that they're not going to get self reliant or they're not going to become, you know, cyber resilient on their own. They need help. I mean I would, I go back to the, even the industry I'm in, right, to switch a little bit from health care, but similar conceptually where it's you know, the Critical Infrastructure Reporting act, it's like without CESA that would have really ever came to be. And so then you're talking about a lot of organizations and companies that, that you know, they wouldn't get there without having to, you know, report incidents and then do things so that you know, they don't have the incidents. But it's all, you know, I think Cease is a very important organization. I think they've done a lot of great good. I'm hopeful that, you know, bipartisan type pressure, you know, keeps it to where, you know, the budget cuts don't, you know, take them. I don't think they're, you know, I still think they're going to be a relevant organization. I just hope the budget cuts don't go too far.

[Rich Stroffolino]

I mean, if there is one thing, it's like, you know, emergency services and healthcare are the. Are the two things I think we can get around. Like, don't let our hospitals get hacked. Seems like something we. I don't want to say that because it turns out we can disagree on anything. That's the marvelous thing about humanity as well. But, yeah, this and healthcare is so unique. I mean, this is where I could see SISA having like a really, a really powerful mandate again, you know, working with Health and Human Services to put this together. Where you're dealing with these organizations that just have so many unique challenges. All these disparate systems, things that, you know, you want to talk about ot challenges, things that are not getting updated regularly, just access to people. I always think of this like securing.

[Christina Shannon]

A hospital when you have these people.

[Rich Stroffolino]

Constantly flowing in and out, like. Yeah. So, yeah, like, I hope ascension think about that one.

[Christina Shannon]

Right. That proved that hospitals aren't going to just do it on their own. Right. So they need help.

[Rich Stroffolino]

So. Yeah, absolutely. Yeah. So I hope if there is a. If there is a new mandate for CISA or a reimagined mandate for cisa, that maybe these kind of specific vertical best practices and other resources for those can be part of that. For sure.

[Christina Shannon]

Kevin is also funny here. Sorry.

[Rich Stroffolino]

Oh, Kevin, you're trying to distract us here. Yes. Maybe a little find and replace there. Not bad. Legislation has been made with similar practices. I'll just say that. All right, and our last story here. Sino track GPS device flaws lead to remote vehicle control and. And location tracking. Speaking of CISA, they warned about two vulnerabilities in SinoTrack GPS devices that can be exploited to access a vehicle's device profile, track its location, or even cut power to the fuel pump in certain types of cars. SinoTrack apparently uses the same default password for all units and does not require change during setup. I would also point out this is a potential school marmy stare down the nose situation. Since the username is just the device ID printed on the label, someone could easily gain access by either physically seeing the device or. Or Spotting it online on photos, you know, you're just on ebay. That could be on there. That could be enough. I mean, heck, we have Copilot vision could just take care of that for you too. So Christina, in contrast to the secretive Chinese made camera story that we had before the break, I'd quickly surmise that a company that's called SinoTrack is, I don't know, known for Chinese tracking software. Maybe does what it says on the tin, it's in the name. Aside from that, let's, I guess let's look past the marketing brilliance of the name and ask why people still do not want to change their passwords or why do companies allow for that kind of practice when they know lazy people or people are lazy as a rule with these kind of things and will not change it unless you make them.

[Christina Shannon]

I think it goes back to like the, someone had said that in the comments earlier where, you know, people are always going to pick convenience over security. Right. I think like when I think about manufacturers, that's been something I've been saying for a long time. Many people have been saying like make it to where when you get these devices, it forces a password reset right from the app or when you're connecting it. Don't make people think about it. Because when I think about that, I think about the average fleet manager, unless they're security aware, they probably get these devices. It probably has a QR code, they're scanning the QR code, they're up and running. It's like plug and play. They don't really think, at least my opinion, I don't think they really think about, okay, now I need to go in and change my password. So I think it's more that than anything. Just people are focused on get it up and running, start using it, and there's not enough. I think the manufacturers need to do a little bit more.

[Rich Stroffolino]

Yeah. And this is where like just like some human interface design like this to me is almost not even a, it's less of a security story. It's more like let's account for the realities of human behavior. And it's like whatever it is, people just like you said, they just want to get it set up. If you give them an easy way to set it up, they're going to take that and get to play with their new toy or get their, you know, get this thing off of their desk that their boss told them to set up or whatever the situation is. Right. And so like so many things in security, I do think there is, there's it's so much of a. If we just designed it to account for our horrible human frailty, maybe then we'd be in a better place. CCL coming out strong here. We're going to talk about our thumbs up or an eye roller with you, Christine, in just a second here. But this is, this is CCL's Facepalm Story of the Week. Yeah, CCL, I can't necessarily disagree with you there. Thanks to everybody in the comments though, for helping making a lot of fun. Kevin Farrell with, with the zingers today. I'm going to go ahead and say he gets the award for zinger comment of the week here. But we also had ccl, of course, that we acknowledged in here. We, we saw Reed in there. Reed, you left your emoji, your emoticon, excuse me, and then abandoned us. And the big boss man, David Spark in there as well. Thanks to everybody that gets in there and has some fun on a Friday. Christine, before we get out of here, we alluded to it. What's your thumbs up or eye roller story this week? Something you reacted strongly to.

[Christina Shannon]

You know, I thought Claude making like the Oauth library, I thought that was really cool. I thought that was cool in the sense that the way it was, the research was provided was all open. Right. Like you said, you saw the prompts. And then like I said, it actually like tickled me out of pink a little bit. And thinking about, oh, here comes the rise of the QA developer.

[Rich Stroffolino]

Yeah, it gets you thinking about these challenges.

[Christina Shannon]

Right? The underdog is right.

[Rich Stroffolino]

Yeah. And yeah, I applaud Cloudflare for being as public with that and, you know, knowing that they would get a healthy dose of skepticism to completely open up that process. I think we need a little bit more of that in the industry, Christina, before we get out of here. Where can people find you on the cyberspace if they're so inclined to give you a follow, see what you're up to on LinkedIn.

[Christina Shannon]

That's a great place to find me. Yeah, I'm always there.

[Rich Stroffolino]

And are you hiring over there at Kik Consumer Products?

[Christina Shannon]

Yes, we have a few roles on my team and then we're always hiring, generally speaking. But yes, we are.

[Rich Stroffolino]

Fantastic. Give those a look if you are in the market. Well, Christina Shannon, CIO over at Kik Consumer Products. I didn't acknowledge it before, but we had bacon for you. Our producer Steve put up bacon for you for being our prestigious fourth guest. Thank you so, so much for being on the show. The bacon is back. Thank you Steve. And thank you of course Christina for just making the show fantastic and a fun time. Truly, truly appreciate it.

[Christina Shannon]

Thank you Rich. It's always good to be here.

[Rich Stroffolino]

Thanks also to our sponsor for today. Thanks also to our sponsor for today, Vanta A New Way to grc. Thanks again to everybody in the audience today. We can't always get every single comment up on the screen, but that doesn't mean we don't appreciate them and indeed love them with all of our hearts. Don't forget you can send us feedback. Also email feedbacksoseries.com we'd love to read some of those if relevant on the show. You can also just send us love and I will take that into my heart as well. Please join us next week for Super Cyber Friday. It's back baby, with our topic Hacking what it Takes to Become a ciso. An hour of critical thinking about the skills you need to move up to the top cyber leadership role. After that we'll have another that's at 1pm and then we'll have another episode of our Week in Review starting at 3:30 Eastern. To register for both or for more information or just if you're a fan of webpages, go to our events [e-mail] in the meantime, you can get your daily news fix every single day through cybersecurity headlines. Give us about six minutes. We'll get you all caught up. Until the next time we meet. For myself, for our glorious producer Steve Prentice, for Christina Shannon, for the big boss man David Spark, and everyone on the CISO series team, here's wishing you and yours to have a Super Sparkly day. Cyber security headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.