Erlend G.
Norway · Co-founder / Chief Executive Officer at Secure Practice AS
Norwegian University of Science and Technology (NTNU)
4 followers
About
Erlend G. is a security and people specialist with 15 years of experience focused on cyber awareness and preparedness. As the founder of Secure Practice, he has trained thousands of SMEs through interactive cyber exercises and won the EU Digital Skills Award for his efforts.
Skills
- Cyber awareness
- Cyber preparedness
- Systems engineering
- Human-machine interaction (HMI)
- Work package management
- Project management
- Horizon 2020
- Digital security
- Risk management
- Software service life-cycle
11 skills in total
Experience
-
Co-founder/CEO
Secure Practice
Aug 2017 — Present
Trondheim Area, Norway
-
Co-founder/CISO/DPO
SheSpeaksCyber
Jun 2025 — Present
-
Research Scientist
SINTEF
Aug 2011 — Jul 2017
Trondheim Area, Norway
5 experiences in total
Education
-
Norwegian University of Science and Technology (NTNU)
Master of science, Informatics, Systems engineering and human-machine interaction (HMI)
2009-2011
-
University of Essex
Exchange program, Information Science
Jan 2009 — Jan 2009
5 education entries in total
Recent posts
Websites are going offline due PHP2Shell, with WordPress and 70% of the Internet affected. The biggest risk here may however be not the most obvious one, and may eventuall affect a lot more people than we'd like to think.
A vulnerable webshop based on e.g. WooCommerce may of course leak data about customers and purchases, which may be bad enough. But there are only so many of these out there which actually generate substantial amounts of data, and hopefully their owners see the need to protect their business by patching quickly.
🟣 The more quiet risk is what cybercriminals can do with ordinary, trusted websites, like your local sports club, other volunteer organizations and small businesses.
🟣 Phishing is still a prevalent threat to individuals and organizations, and malicious domains are deployed in the millions.
🟣 But what is even better than a new phishing domain, is an old one – one which is otherwise considered fully legit and trusted, with an excellent web reputation for years.
Exploiting the PHP2Shell vulnerability could be done to deploy phishing website content – for instance fake login pages – inside the web domains/addresses of otherwise trusted websites.
🟣 People have for years been taught to check primarily domain names they visit.
🟣 Spam filters are taught to trust domains names which are good on reputation.
🟣 Website admins rarely (never?) check site integrity beyond patching status.
That makes, in my opinion, the biggest risk of this vulnerability the otherwise unnoticed existence of phishing kits on less (or not at all) maintained websites. A risk which will only grow during the time of attacks going mainstream – and then persist until each site is taken down, one by one. Which may indeed take some time!