AI
PII Breach Response: The First 30 Minutes
When PII leaks, the first action is a Jira ticket with a name, date, and unique ID. The rapid assessment runs 10 to 30 minutes. The goal is avoiding analysis paralysis: time-box the work, identify what data is exposed, check context, and notify legal and management with a brief. McCoy’s intake form asks engineers to spend 30 to 60 minutes documenting the application, its data, and key stakeholders. With stakeholders listed in advance, a 30-minute response becomes check, check, check.
Architecture Reviews That Change Engineer Behavior
Engineers walk in with a gateway-load-balancer-lambda diagram that tells security nothing. McCoy runs 30-minute reviews in draw.io, adding one layer per meeting: segment the user data, label it a red system, float input sanitization. No security control goes in without engineer buy-in. After four or five meetings, the team reaches an architecture where social security numbers sit in a write-only segment. XSS cannot read what the application cannot reach, so the original leak becomes structurally impossible.
Security Controls vs Design Principles: The Maintenance Trap
Every security control needs an owner. Someone monitors it, maintains it, and pays for it. A security team can realistically support 20 to 200 controls before that overhead consumes all available time. Design principles are different: once embedded in an architecture, engineers own them. A new team member inherits the design and replicates it across other systems without security team involvement. McCoy’s caution before recommending any control is to ask who will own it across the full life cycle of that application.
DoS Runbooks and Malware: Write the Response Before the Incident
A DoS runbook takes 30 minutes to write. McCoy built a V1 in under 30 minutes with AI. It covers who to notify, how to block attacking IPs, options to scale the gateway, and a one-click go-dark option for 2 a.m. when the extortion note arrives. For malware, he categorizes users into three groups: weak users making mistakes, bad users running cracked software or publishing source code, and malicious insiders implanting backdoors. Each group gets a different response escalation path.
APT Breach: Planning Before the Infrastructure Burns
When an APT is inside, Jira is gone, Confluence is gone, the work laptop cannot be trusted. McCoy’s framework: establish secondary communications on a separate device, assign area owners for operations, log capture, and documentation, and run twice-daily sync meetings. Fall-back tooling is bought on a personal credit card: new Confluence space, new GitHub, new Slack. Rebuild on a different cloud. If Azure was compromised, move to GCP or AWS. For fintech, the hard constraint is 48 hours before the business closes.
Notable Quotes
It is your time to shine and burn Jon McCoy · ▶ Watch (2:51)
a simple thought game what do you wish Jon McCoy · ▶ Watch (29:35)
Key Takeaways
- A 30-minute intake form filled out at project start cuts breach response time significantly.
- Security design principles replicate across teams on their own; security controls require permanent ownership and budget.
- Write DoS and malware runbooks before the attack. A first draft takes 30 minutes with AI assistance.