Chris Farris

Everyone compares Agentic AI to SkyNet and HAL.

Iran decided to take out AWS regions Ukraine decided to take out fulfillment centers of Russia’s largest on-line retailer Moscow is iching to start shit. eu-central-1 is about 2000km from Moscow.

IBM said it clearly in 1979: a computer can never be held accountable, therefore a computer must never make a management decision.

Everyone talks about whether AI agents should reason about harm before acting.

Asimov’s Zeroth Law – ‘a robot may not harm humanity, or by inaction allow humanity to come to harm’ – is the law that turns robots into philosopher-kings.

Chris built his Three Laws of Agentic AI as an Asimov riff – substituting EU AI Act harm for physical injury, stateful data for human obedience, and externalized memory for self-preservation.

In 1979, IBM warned that a computer must never make a management decision because it can never be held accountable.

Wendy Nather coined the Security Poverty Line in 2011.

MUTUAL NON-DISCLOSURE AGREEMENT (Hereinafter referred to as the "Agreement," though "Trap" would be equally accurate) This Mutual Non-Disclosure Agreement ("Agreement") is entered into as of the date of the Recipient's signature ("Effective Date"), by and…

We have decades of experience with how we give an EA access to an executive’s life.

Early next year, AWS will launch one of the largest changes to its cloud product in decades.

This will be the first re:Invent I’ve missed since 2015 (we don’t talk about 2020 - never happened - FAKE NEWS), but I’ve relocated to Portugal and, for various reasons, had to miss skip it this year.

A brief primer on how to think about threat modeling GenAI applications.

With the US Government acting in an erratic and hostile manner towards its traditional allies, it makes sense for companies not typically subject to US Jurisdiction to reconsider their threat models when using the big three cloud providers.

I’ve spoken a lot about Security Invariants, but all of them have been implemented using Organizational Policies.

I’ve finally settled on the wording for Farris’s Three Laws of Cloud Security Auto Remediation: A bot must never harm stateful data or allow stateful data to come to harm.

In previous posts, I took AWS to task for not making the customer’s security Job Zero.

It’s once again pre:Invent, that magical season where AWS announces new features related to their legacy products (cloud) before they jump all-in on Generative AI magician gimmicks at re:Invent in Las Vegas.

In order to profit effectively from a ransomware attack, a threat actor needs to have something to offer in return for payment.

Cloud Hygiene is a Cloud Security problem, and we need to cleanup the pollution in our cloud environments

In September 2024, I returned to Stockholm to give a talk at Sec-T.