8th Layer Insights

Latest Episodes:

Blending Awareness, Social Engineering, and Physical Penetration Testing -- A Conversation with Jayson E. Street Aug 29, 2023

Show notes

On today's show, Perry sits down with Jayson E. Street to discuss his unique blend of social engineering, physical penetration testing, and security awareness. Jayson refers to this as being trained by a simulated adversary. At the heart of Jayson's method is intense boldness in his approach to social engineering and penetration testing coupled with an equally intense passion for helping his clients and their employees improve their overall security posture and mindsets. It's about education rather than exploitation.

Guest: Jayson E. Street (LinkedIn) (Twitter) (Website)

YouTube videos of Jayson

Jasyon's book (Amazon Associate link)

Dissecting the Hack: The V3rb0t3n Network

Perry's Books (Amazon Associate links)

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Be sure to check out Perry's other show, Digital Folklore. It's all about the oddities and importance of online culture. Head over to the show's website (https://digitalfolklore.fm/) to see our custom artwork, subscribe to the newsletter, shop for merch, support the show on Patreon, and more. Want to check out what others are saying? Here's some recent press about the show: https://digitalfolklore.fm/in-the-news. Season 2 starts September 4, 2023.

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

8Li cover art by Chris Machowski @ https://www.RansomWear.net/.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

How to Fool the White House (Encore) Aug 08, 2023

Show notes

Hey all! I'm at BlackHat and Defcon this week. If you're there, track me down. I'd love to meet you!

This week's episode is an encore of one of my favorites. My interview with James Linton (a.k.a. The Email Prankster). In 2017, James went on a virtual joyride exploiting the ways that people interact with emails. One of the most interesting things about James' story is that his exploits didn't rely on any type of highly technical method(s); they were simple display name deceptions. But that didn't stop him from fooling CEOs from some of the worlds largest banks, celebrities, and high ranking staff members in the White House.

James' success using these simple methods serves as a warning for us all. We don't fall for scams because they are technically sophisticated or because we are stupid. We fall for scams because we are human.

Guest: James Linton (LinkedIn) (Website)

Books and Resources:

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, & Storyblocks.

Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: hello [at] 8thLayerInsights [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

We are the Champions Jul 26, 2023

Show notes

There has been a lot of buzz for the past few years about the benefits and importance of establishing security champions programs. These are groups of people in your organization who become vital, responsible, and proactive contributing evangelists to the security culture of your organization. I often refer to them as "culture carriers." And, while there is general agreement that these are good programs to have, establishing them is currently a bit of a dark art.

On today's show, Perry sits down with Sarah Janes of Layer 8 security to discuss the importance of champion programs and tease out a few best practices.

Guest: Sarah Janes (LinkedIn) (Twitter) (Website)

Perry's Books (Amazon Associate links)

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

8Li cover art by Chris Machowski @ https://www.RansomWear.net/.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Something Wicked This Way Comes: PenTesting Your Environment w/Chad Peterson of NetSPI Jun 20, 2023

Show notes

On this episode, Perry sits down with Chad Peterson, Managing Director at NetSPI, to discuss the importance of penetration testing. We touch on aspects of social engineering, discussing complex security issues with Boards of Directors, the prevalence of Ransomware, and some of the unique challenges facing the healthcare industry.

Guest: Chad Peterson (LinkedIn) (Twitter)

Books & References (Books are Amazon Associate links)

CISO Desk Reference Guide: A Practical Guide for CISOs by Bill Bonney, Gary Hayslip, & Matt Stamper
Penetration Testing: A Hands-On Introduction to Hacking by Georgia Weidman
Practical Social Engineering: A Primer for the Ethical Hacker by Joe Gray
Ransomware Protection Playbook by Roger Grimes
The Smartest Person in the Room: The Root Cause and New Solution for Cybersecurity by Christian Espinosa

Perry's Books (Amazon Associate links)

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Perry's new show, Digital Folklore kicked-off Jan 16, 2023. It's all about the oddities and importance of online culture. Check out the website (https://digitalfolklore.fm/) to see our custom artwork, subscribe to the newsletter, check out our merch, Patreon, and more. Want to check out what others are saying? Here's some recent press about the show: https://digitalfolklore.fm/in-the-news

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

8Li cover art by Chris Machowski @ https://www.RansomWear.net/.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Carrots, Sticks, and Culture: The Art and Science of Social Signaling Jun 06, 2023

Show notes

On this episode, what cybersecurity professionals need to understand about how social signaling and incentives really work.

Today's episode features a conversation with Uri Gneezy. In the field of cybersecurity, we are very interested in identifying proactive and positive ways to encourage the behavior we want. That's where Uri comes in. Uri is a well-known behavioral economist and professor of economics and strategy in the Rady School of Management at the University of California at San Diego.

Most of us recognize that many of our behaviors, beliefs, and values are caught rather than taught. So, if you are interested in developing a positive security culture in your workplace, then it’s important to understand the dynamics of how people both receive and signal their security-related beliefs and values so that associated behaviors become a natural result.

Listen in as Perry sits down with Uri to discuss key findings from Uri's new book, Mixed Signals: How Incentives Really Work. This is a fascinating deep dive into Uri’s research that has immediate applicability for anyone needing to design programs that work with, rather than against, human nature.

Guest: Uri Gneezy (LinkedIn) (Twitter) (Website)

Books & References (Books are Amazon Associate links)

Mixed Signals: How Incentives Re ally Work, by Uri Gneezy
The Why Axis: Hidden Motives and the Undiscovered Economics of Everyday Life by Uri Gneezy & John List

Perry's Books (Amazon Associate links)

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

8Li cover art by Chris Machowski @ https://www.RansomWear.net/.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Hacking the Paranormal -- a conversation with Banachek May 23, 2023

Show notes

In this episode, Perry Carpenter sits down with renowned mentalist and skeptic, Banachek. Banachek (Steve Shaw) grew up with a fascination in magic and a frustration with psychic frauds. As a teenager, he contacted magician and skeptic, James “The Amazing” Randi and ended up working with Randi on a special initiative known as Project Alpha, which set out to expose a general lack of objectivity in parapsychology research. Banachek served as the director for the James Randi Educational Foundation’s “One Million Dollar Paranormal Challenge” for 15 years and is now the President of the James Randi Educational Foundation.

Perry and Banachek discuss Project Alpha, the ways of fake psychics and fraudulent faith healers, and issues associated with confirmation bias and framing effects. They also discuss Banachek’s new live mentalism show in Las Vegas, which incorporates theatrical mindreading and other mentalism effects along with a storyline that explores Banachek’s life, antics, and passion for critical thinking.

Guest:

Banachek (Website) (twitter): Mentalist (Performing in Las Vegas add 'social' for 30% off tickets), Skeptic, President of the James Randi Educational Foundation
This episode also featured a quick comment from: George Finney: (LinkedIn); Chief Security Officer at Southern Methodist University; Founder of Well Aware Security

Books and References (Book links are 'Amazon Associate' links which help support the show):

Brian Brushwood's podcast, World's Greatest Con
Banachek Wikipedia entry
Project Alpha Wikipedia entry
James Randi Wikipedia entry
Article about Houdini's efforts to debunk fake mediums
The Discoverie of Witchcraft Wikipedia entry
The Psychology of the Ouija
Barnum Effect Wikipedia entry
James Randi & Project Alpha Video
Project Alpha lookback -- James Randi and Michael Edwards
Psychological Subtleties vol 1, by Banachek
Behind the Scenes with the Mediums, by David Abbott
The Discoverie of Witchcraft
Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors by Perry Carpenter

Music and Sound Effects by Blue Dot Sessions & Storyblocks.

Artwork by Chris Machowski.

Learn more about your ad choices. Visit megaphone.fm/adchoices

What Cybersecurity Pros can Learn from Star Wars May 09, 2023

Show notes

This week's episode is a late Star Wars ("May the 4th Be With You") celebration. We check out a couple interesting articles about security-related lessons embedded in the Star Wars movies, and Perry sits down with Adam Shostack, author of the new book, Threats: What Every Engineer Should Learn From Star Wars to discuss threat modeling principles using Star Wars related examples.

Guest: Adam Shostack (LinkedIn) (Twitter) (Website)

Books & References (Books are Amazon Associate links)

Threats: What Every Engineer Should Learn From Star Wars, by Adam Shostack
Threat Modeling: Designing for Security, by Adam Shostack
Threat modeling videos from Adam
Threat modeling and security-related games by Adam
Adam's whitepapers
BlackPoint: Learn Their Lesson, They Did Not
Gary Hibbard LinkedIn post

Perry's Books (Amazon Associate links)

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Perry's new show, Digital Folklore kicked-off Jan 16, 2023. Check out the website (https://digitalfolklore.fm/) to see our custom artwork, subscribe to the newsletter, check out our merch, Patreon, and more. Want to check out what others are saying? Here's some recent press about the show: https://digitalfolklore.fm/in-the-news

Voice Acting for this episode:

Darth Vader voice over artist: https://business.fiverr.com/freelancers/mistercorley
Darth Vader breathing sound: https://www.youtube.com/watch?v=MBi01iy2db8&ab_channel=chefhawk

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

8Li cover art by Chris Machowski @ https://www.RansomWear.net/.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Postcards from the Intersection of Cybersecurity and Folklore Apr 25, 2023

Show notes

Welcome to season 4, episode 1 of 8th Layer Insights!

On this episode, Perry speaks with Josiah Dykstra (Senior Fellow, Office of Innovation at the National Security Agency) about the new book he co-authored with Eugene Spafford and Leigh Metcalf. The book is titled Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls that Derail Us, This topic coincides well with Perry's recent studies into folklore and urban legends for his other podcast, Digital Folklore.

Guests:

Josiah Dykstra (LinkedIn) (Twitter) (Website)
Chelsey Weber-Smith (LinkedIn) (Twitter) (Website)
Mason Amadeus (LinkedIn) (Twitter) (Website)

Books & References (Books are Amazon Associate links)

American Hysteria Podcast episode, Urban Legends in the Internet Wilderness with the Digital Folklore Podcast
Cybersecurity Myths and Misconceptions: Avoiding the Hazards and Pitfalls that Derail Us, by Eugene Spafford, Leigh Metcalf, and Josiah Dykstra
Essential Cybersecurity Science: Build, Test, and Evaluate Secure Systems, by Josiah Dykstra
Folklore 101: An Accessible Introduction to Folklore Studies, by Jeana Jorgensen
Folklore Rules: A Fun, Quick, and Useful Introduction to the Field of Academic Folklore Studies, by Lynne S. McNeill

Perry's Books (Amazon Associate links)

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

8Li cover art by Chris Machowski @ https://www.RansomWear.net/.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Season 3 finale: What's the deal with Authentication, MFA, and Password Managers? Jan 24, 2023

Show notes

For the last episode of season 3, I thought we'd talk about something that's been in the news quite a lot recently: Authentication and Password Managers. As security professionals, we've decried the password for decades. Multifactor authentication (MFA) has started to gain popularity... but not without its own issues. Security leaders and tech teams may have once again hoped for a silver bullet, only to be disappointed to find out that crafty attackers can easily bypass MFA. We've also been touting the benefits of Password Managers for quite a while. After all, in a world where most of us have to manage upwards of 200 passwords in a year, who can keep up? No human can have great password hygiene across all those accounts. But password managers also face their own problems as illustrated by a recent high-profile incident.

Our guest today is Roger Grimes. He has a multi-decade cybersecurity career and is the author of 13 cybersecurity books, countless articles, and is a highly sought-after industry luminary. ... Oh -- and he has opinions. Listen in as Roger and I discuss the current state of authentication, MFA, password managers, and more.

Guests:

Roger Grimes (LinkedIn) (Twitter)

Want to submit a question to have answered in a future episode?

If you’ve got a question or comment that you’d like me to try to answer or respond to, leave a voice message at https://www.speakpipe.com/8Li. Frankly, that would make it more engaging than if I just read your questions. But, if you aren’t able to record a message or don’t want your voice on the show, then you can email me your questions at perry@8thLayerMedia.com. I’d love to hear from you and answer any questions you have about my thoughts on security topics, creativity, online culture, podcasting… or anything else you have on your mind.

Books & References:

Password Managers Can Be Hacked Lots of Ways and Yes, You Should Still Use One, by Roger Grimes
Roger's Password Masterclass
Roger's Hacking MFA presentation
Hacking Multifactor Authentication, by Roger Grimes
Cryptography Apocalypse: Preparing for the Day When Quantum Computing Breaks Today's Crypto, by Roger Grimes
Ransomware Protection Playbook, by Roger Grimes
A Data-Driven Computer Defense: A Way to Improve Any Computer Defense, by Roger Grimes
Hacking the Hacker: Learn from the Experts Who Take Down Hackers, by Roger Grimes
LastPass Security Incident, December 22, 2022
LinkedIn 2FA Hacking demo by Kevin Mitnick
The Humane Interface: New Directions for Designing Interactive Systems, by Jef Raskin
Wired Magazine Article -- The Best Password Managers to Secure Your Digital Life

Perry's new show, Digital Folklore kicked-off Jan 16. Check out the website (https://digitalfolklore.fm/) to see our custom artwork, subscribe to the newsletter, check out our merch, Patreon, and more. Want to check out what others are saying? Here's some recent press about the show: https://digitalfolklore.fm/in-the-news

Perry's Books

Transformational Security Awareness: What Neuroscientists, Storytellers, and Marketers Can Teach Us About Driving Secure Behaviors, by Perry Carpenter
The Security Culture Playbook: An Executive Guide To Reducing Risk and Developing Your Human Defense Layer by Perry Carpenter & Kai Roer

Production Credits:

Music and Sound Effects by Blue Dot Sessions, Envato Elements, Storyblocks, & EpidemicSound.

Artwork by Chris Machowski @ https://www.RansomWear.net/ and Mia Rune @ https://www.MiaRune.com.

8th Layer Insights theme music composed and performed by Marcos Moscat @ https://www.GameMusicTown.com/

Want to get in touch with Perry? Here's how:

LinkedIn
Twitter
Instagram
Email: perry [at] 8thLayerMedia [dot] com

Learn more about your ad choices. Visit megaphone.fm/adchoices

Quick announcement and sneak peek of my new show: Digital Folklore Jan 10, 2023

Show notes

Hey all!

An announcement and something special!

First, the announcement:

Here's your chance to participate in the final episode of 8Li season 3. If you’ve got a question or comment that you’d like me to try to answer or respond to, leave a voice message at https://www.speakpipe.com/8Li. Frankly, that would make it more engaging than if I just read your questions. But, if you aren’t able to record a message or don’t want your voice on the show, then you can email me your questions at perry@8thLayerMedia.com. I’d love to hear from you and answer any questions you have about my thoughts on security topics, creativity, online culture, podcasting… or anything else you have on your mind.

Now for something special:

Here's a quick 10 minute sneak peek from episode 1 of my new show, Digital Folklore. Season 1 kicks off Jan 16.

This episode introduces us to two "monsters" who were birthed on the internet, but couldn't be contained there. Their names are Slenderman and Momo, and they are great examples of a few key folkloric concepts. So join us as we take a look at Slenderman and Momo and learn about ostension, monster theory, moral panics, and the defining traits that make something folklore as opposed to just a simple online expression of creativity.

Guests appearing on the full episode include:

Dr. Vivian Asimos, author of Digital Monsters and Digital Mythology and the Internet's Monster: The Slender Man
Ben Brock Johnson, Amory Sivertson, and Quincy Walters from WBUR's podcast, Endless Thread
Chelsey Weber-Smith, host of American Hysteria
Kathleen Hale, author of Slenderman: Online Obsession, Mental Illness, and the Violent Crime of Two Midwestern Girls

Season 1 begins Jan 16, 2023. Subscribe or follow so you don't miss out! You can sign-up for our newsletter and learn more about the show at https://digitalfolklore.fm.

Support the Digital Folklore Podcast on Patreon: https://patreon.com/digitalfolklore

Find us on the socials:

Thanks so much!

Learn more about your ad choices. Visit megaphone.fm/adchoices