7 Minute Security

View Top 200 Chart

Back to Rankings Page

News
**7 Minute Security**

7 Minute Security is a weekly information security podcast focusing on penetration testing, blue teaming and building a career in security. The podcast also features in-depth interviews with industry leaders who share their insights, tools, tips and tricks for being a successful security engineer.

Latest Episodes:

7MS #471: Cyber News - Ransomware Should Run Somewhere Edition Jun 09, 2021

Show notes

Hey everybody, happy June! Our pal Joe is back to cover some great security stories with us, including:

Peloton's leaky API
Some Colonial Pipeline discussion (story 1, story 2)
Amazon Sidewalk doesn't really share your Internet connection with neighbors/strangers. The Hacker News article doesn't do an awesome job of clearing that up either.

7MS #470: First Impressions of Meraki Networking Gear Jun 02, 2021

Show notes

Today we're doing something new - a first impressions episode of Meraki networking gear. Note: this is not a sponsored episode, but rather a follow up to episode #460 where I talked about throwing all my UniFi gear into the ocean and replacing it with Meraki gear. At the end of that episode I asked if anybody was interested in a "first impressions" of the gear, and it turns out (at least 6) people are interested, so here we are! TLDL:

Pros

Super easy plug-and-play setup
The mobile app can control just about everything - ports, SSIDs, Internet on/off timers and more!
Verbose logging
Top-notch support from experienced technicians

Cons

Cost! Big $$$
"Cloud only" - can't install this gear in a LAN-only configuration
Client VPN is a bit clunky to setup

7MS #469: Interview with Philippe Humeau of CrowdSec May 26, 2021

Show notes

Hey friends! Today we're talking with Philippe Humeau, CEO of CrowdSec, which is "an open-source massively multiplayer firewall able to analyze visitor behavior & provide an adapted response to all kinds of attacks. It also leverages the crowd power to generate a global IP reputation database to protect the user network."

I came into this interview not knowing much at all about CrowdSec, so I peppered Philippe with questions such as:

What is CrowdSec?
What problem does it solve?
Who are your competitors?
You're open source...so how do you make $? What's your five-year plan?
You're dealing with a lot of data and metrics...how are you handling data privacy laws and concerns such as GDPR?
What if I fall in love with CrowdSec and want to contribute to making it better?

It was a really fun, transparent and energetic interview - hope you enjoy it!

7MS #468: Eating the Security Dog Food - Part 3 May 20, 2021

Show notes

Today we continue the series on eating your own security dog food! Specifically, we talk about:

Keeping a log and procedure for sanitizing systems
Keeping a log and procedure for provisioning systems
A big "gotcha" to be aware of when using Windows system dropboxes - make sure your Windows user account doesn't expire, because Splashtop doesn't have any way to update it! To prevent this, set the account not to expire:

wmic useraccount where "Name='LocalAdminAccount'" set PasswordExpires=false

If you want more tips on building pentest dropboxes, check out this series

Oh, and today's song that I sang obnoxiously is If I Were a Dog.

7MS #467: How to Succeed in Business Without Really Crying - Part 9 May 12, 2021

Show notes

Hey everybody! I stayed in a hotel for the first time in over a year and boy oh boy...I hope I didn't get COVID from the bedsheets!

Anyhow, on that journey I thought of some things that I think will help your business on the marketing/project management/sales side to be more successful and less annoying. DISCLAIMER: I have no formal training in these areas, but I've been on both sides of the table for a number of years, and I think I'm getting a better idea of what clients do and don't like during the sales process. These things include:

Reduce layers of people complexity - don't have 17 of your people on the client intro/pitch call and then ghost them once they actually want to buy something!
Keep project management just complicated enough - I like project management tools and spreadsheet task-trackers like Smartsheet but I'm trying to let the client lead as far as how much detail they need when tracking their projects. By default, we create a document with a high level map of project milestones, timelines and key contact information. We update that as often as the client likes.
Personalize responses to Web leads - if you have an info@ or sales@ address for your business, I think you should personalize the response you give folks who write in. They wrote you for a reason! Don't just copy/paste some generic "Hey you wanted info about our company so here it is blah blah blah" response, that doesn't make people feel like you give a rip about their needs. Think of something personal to say in the reply. "Oh, I see you're in Minnesota. I'm a big Twins fan!" Something like that. Simple, easy and personal.
Don't sign people up for junk without asking - in this episode I give an example of a vendor we looked at (but didn't select) for some services, and the company decided to automatically sign ups up for a bunch of electronic and paper mailings. That's super annoying!
Don't stink at LinkedIn - in the last episode of this series, I told you about a guy who (to me) wins LinkedIn and the Internet because he sent me a personalized video LinkedIn invitation - it was awesome! Be more like that guy, and less like the mosquitoes who send invites like "Hi, I noticed you're human and figured we should be LinkedIn BFFs" and then sign you up for a non-stop barrage of sales pitches!
Bug people "just enough" - if you've had an awesome scoping call for a potential project and the client has received and reviewed the SOW, stay in touch with them periodically - even if it feels like you're being ghosted.

7MS #466: Attacking and Defending Azure AD Cloud (CARTP) May 05, 2021

Show notes

Welp, I need another security certification like I needed a bunch to the retinas, but even after all the fun (and pain) of CRTP I couldn't help but sign up for the maiden voyage of Attacking and Defending Azure AD Cloud - a.k.a. CARTP. This cert comes to us from our friends over at Pentester Academy, and is all about pwning things in Azure AD which is mostly new ground for me.

I this episode I talk about some of the TTPs covered in week 1 of this course, as well as:

Likes:

Courses offered on Saturday (I'm usually pooped for these sessions, but it's easier than taking time during the work week)
Student portal - and especially the student guide! - is more polished, easy to read, and easy to copy/paste from.

Dislikes:

On Saturdays I'm a sleepy Brian. :-)
I still wish the course was designed such that we would go through various hands-on-keyboard exercises with the instructor, not just watch.
Use of Discord as main comms channel - it causes anxiety for me...too many blips and bloops and blurps with all the notifications. It's also frustrating that the instructor takes questions from Discord sometimes without repeating the question, thus making it hard to figure out what everybody was talking about if I watch the Zoom reply.

7MS #465: Cyber News - The FBI Might Be Getting Into the IR Biz Edition Apr 28, 2021

Show notes

Hey friends! Today Joe "The Machine" Skeen (a.k.a. Gh0sthax) and I talk about some of our favorite news stories, including:

FBI removes hacker back doors
NSA: 5 security bugs under active nation-state cyberattack
Ubiquiti is accused of covering up a 'catastrophic' data breach — and it's not denying it. On a side note, enjoy our podcast about how we lost our love for Ubiquiti a while back: 7MS #460: Why I'm Throwing My UniFi Gear Into the Ocean
Codecov users warned after backdoor discovered in devops tool

7MS #464: Interview with Christopher Fielder of Arctic Wolf Apr 22, 2021

Show notes

Today our friend Christopher Fielder of Arctic Wolf joins us on the show again (check out his first appearance in episode #444 - this time to talk about the security journey, and how to start out in your "security diapers" and mature towards a stronger infosec program. Specifically, we talk about:

When the company has one person in charge of IT/security, how can you start taking security seriously without burning this person out? First, it's probably a good idea to take note of what you have as far as people, tools and technology to help you meet your security goals.
Early in this process, you should inventory what you have (see CIS controls) so you know what you need to protect. A few tools to help you get started:
- Nmap
- Rumble
- LanSweeper
- Witnessme
As you go about any phase of your security journey, don't ever think "I'm good, I'm secure!"
Quarterly/yearly vulnerability scans just won't cut it in today's threat landscape - especially your external network. Consider scanning it nightly to catch show-stoppers like Hafnium early)
Limiting administrative privileges is SUPER important - but don't take our word for it, check out this report from Beyond Trust for some important stats like "...enforcing least privilege and removing admin rights eliminates 56% of critical Microsoft vulnerabilities."
Install LAPS, because if an attacker gets local admin access everywhere, that's in many ways just as good as Domain Admin!
Train your users on relevant security topics. Then train them again. Then....again. And after that? Again.
There are many ways to conduct tabletop exercises. They don't have to be crazy technical. Start with the internal tech teams, practice some scenarios and get everybody loosened up. Then add the executives to those meetings so that everybody is more at ease.
How do you know when it's time to ask for help from an outside security resource?
Not sure what kind of shape your company's security posture is in? Check out Arctic Wolf's free security maturity assessment.

7MS #463: DIY Pentest Dropbox Tips - Part 5 Apr 14, 2021

Show notes

In the last two episodes of this series (#449 and #450) we've been diving into how to not only speed up the process of spinning up a DIY pentest dropbox, but how to automate nearly the entire build process!

In today's episode we talk specifically about how to streamline the Windows 10 build process. As previously mentioned, this article is awesome for creating a core Win 10 answer file that will format C:, setup a local admin, login once to the configured desktop and then do whatever things you want it to do. Personally, I like having a single batch file get fired off that:

Sets the timezone with tzutil /s "Central Standard Time"
Stops the VM from falling asleep with powercfg.exe -change -standby-timeout-ac 0
Grabs and runs a PS file that does a ton of downloading and unzipping of files with:

invoke-webrequest https://somesite/somefile.zip -outfile c:\somewhere\somefile.zip expand-archive c:\somewhere\somefile.zip -destinationpath "c:\somewhere\extracted\"

Installs Windows updates with:

Install-PackageProvider -name nuget -force Install-Module PSWindowsUpdate -force Import-Module PSWindowsUpdate Get-WindowsUpdate Install-WindowsUpdate -AcceptAll -IgnoreReboot

Sets a new name for the machine:

Write-Host "Picking a new name for this machine...you'll need to provide your admin pw to do so" Rename-Computer -LocalCredential administrator -PassThru Write-Host "New name accepted!"

Does a set of actions depending on the IP range with this code (which sets the IP address to a variable and then does stuff if the machine sits in that subnet):

$ip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1] f ($ip -like "192.168.0.*") { Invoke-Webrequest https://somesite/somefile.ps1 -OutFile c:\someplace\somefile.ps1 }

Also, I talk in this episode about how I try to host these "seed" files as securely as possible using Amazon Lightsail instances, the built-in firewall, and LetsEncrypt.

7MS #462: Pentesting with the Hak5 Key Croc Apr 07, 2021

Show notes

Today we talk through our first engagement using Hak5 Key Croc to steal and exfil data. In the past, my internal monologue when a new Hak5 toy is released sounds like this:

"I certainly don't need another Hak5 doo-dad! The last one didn't ever work that great, and ended up in a drawer full of past Hak5 doo-dads that didn't work that great."
"Whaaaaat? A new cool and hip video for the INSERT_CATCHY_HAK5_TOOL_NAME is out? Pffft. I don't need that."

5 seconds go by...

"Well it's just $100, shut up and take my money!"
"It came in the mail today! It has a cool envelope and everything!"
"Hrm, I followed the quick start video and 3 of the 10 steps don't work for me. I'll hit the forums. Huh, everybody seems to be having this problem.

5 days go by...

"Neat! With a little help from SassyGal67 and StarWarsFreak_XXL on the forums, I hacked together my own fix for these issues. Now the core functionality of the device works, but the GUI is totally broken and you have to factory reset it with every use. Cool!"

Deep breath. Tosses doo-dad in a drawer full of past Hak5 doo-dads that didn't work that great.

So with all that said, was our experience with the Key Croc any different? Check out today's episode to find out!

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected