BrakeSec Education Podcast

Latest Episodes:

Managing messaging with management, becoming a CISO with Mary Gardner from Goldiknox Apr 09, 2024

Show notes

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information and experiences and do not represent views of past, present, or future employers.

Recorded: 08 Apr 2024

Youtube VOD: https://www.youtube.com/watch?v=K8qApvsFtqw

Show Topic Summary:

If you want to get in the mind of a board member, I submit to you my discussion with Mary Gardner we did last night on #brakesec #education. Join Mary and I as we discuss the functions of a board, messaging to various levels of leadership and teams, and what it takes to make that leap to being a CISO. And when you're done, and you need someone to help your org get more mature, contact the team at GoldiKnox. #cybersecurity #informationsecurity #ciso #leadership #GRC

Questions and topics:

https://hbr.org/2023/05/boards-are-having-the-wrong-conversations-about-cybersecurity
1. "Just 69% of responding board members see eye-to-eye with their chief information security officers (CISOs). Fewer than half (47%) of members serve on boards that interact with their CISOs regularly, and almost a third of them only see their CISOs at board presentations. "
2. They obviously have different priorities, so what brings everyone to the table to discuss? Are they even worried about security?
Tactical goals vs. org goals and aligning them
What are boards most worried about these days?
1. Staying relevant in the face of AI?
2. What tech will protext them from the newest threats?
GRC is forced security, security is completely optional, Compliance requires some sort of security

Additional information / pertinent LInks (Would you like to know more?):

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth

Brian Boettcher: @boettcherpwned

Bryan Brake: https://linkedin.com/in/brakeb

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

Discord: https://discord.gg/brakesec

p2-accidentalCISO, building trust in new places Feb 13, 2024

Show notes

Full Youtube VOD: https://www.youtube.com/watch?v=uX7odQTBkyQ

Questions and topics:

Let's talk about Mindful Business Podcast
1. What's the topics you cover?
Topic #1: discuss your experiences when you were a new leader.
1. What worked? What didn't? What would you have done differently?
2. Do you emulate your manager's style? What have been your go-to management resources?
3. What is a good piece of advice that you've been given or that you impart to others that relates to leadership?
Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc)
Topic #3: What are bare minimums for building 'secure' Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates
Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security?

Additional information / pertinent LInks (Would you like to know more?):

Twitter/Mastodon: https://twitter.com/AccidentalCISO https://infosec.exchange/@accidentalciso
The Mindful Business Security Show: https://www.mindfulsmbshow.com/ https://twitter.com/mindfulsmbshow

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth

Brian Boettcher: @boettcherpwned

Bryan Brake: https://linkedin.com/in/brakeb

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

AccidentalCISO on BrakeSecEd, talking Leadership, SaaS development, and Appsec Feb 02, 2024

Show notes

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information, and do not represent views of past, present, or future employers.

Recorded: 28 Jan 2024

Youtube VOD: https://youtube.com/live/uX7odQTBkyQ

Questions and topics:

Let's talk about Mindful Business Podcast
1. What's the topics you cover?
Topic #1: discuss your experiences when you were a new leader.
1. What worked? What didn't? What would you have done differently?
2. Do you emulate your manager's style? What have been your go-to management resources?
3. What is a good piece of advice that you've been given or that you impart to others that relates to leadership?
Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc)
Topic #3: What are bare minimums for building 'secure' Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates
Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security?

Additional information / pertinent LInks (Would you like to know more?):

Twitter/Mastodon: https://twitter.com/AccidentalCISO https://infosec.exchange/@accidentalciso
The Mindful Business Security Show: https://www.mindfulsmbshow.com/ https://twitter.com/mindfulsmbshow

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth

Brian Boettcher: @boettcherpwned

Bryan Brake: https://linkedin.com/in/brakeb

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

1st show of 2024! Our 10th Anniversary... Jan 09, 2024

Show notes

It's our 10th anniversary and the first show of our 2024 season!

Amanda was on "7 minute security"

https://7minsec.com/projects/podcast

Check out the complete VOD at https://youtu.be/vbmEtkxhAMg

Explicit language warning

www.brakeingsecurity.com

https://twitch.tv/brakesec

https://bit.ly/brakesecyt

Brakesec Call to Action 2023 Dec 18, 2023

Show notes

Youtube Video: https://youtu.be/IUDPlQaQg8M

https://forms.gle/rf145MoN7cskwMjf8 is the link to the survey. Your information (should you choose to identify yourself) will not be shared outside of the BrakeSec Team.

Thank all of you for listening and for your input.

RSS feed for the audio podcast is at https://www.brakeingsecurity.com/rss website: https://www.brakeingsecurity.com

How to get more headcount, BLUFFs Vulnerability, and Ranty Clause debuts! Dec 04, 2023

Show notes

Show Topic Summary:

Ms. Berlin proposes a question of how to gather more headcount with metrics, we discuss the BLUFFS bluetooth vulnerability, and "Ranty Claus" talks about CISA's remarks of putting the onus on device product makers to remove choice for customers and implement secure defaults.

#youtube VOD: https://www.youtube.com/watch?v=emcAzTx9z0c

Questions and topics:

Additional information / pertinent LInks (Would you like to know more?):

https://cyberscoop.com/jen-easterly-secure-by-design/
https://www.cisa.gov/resources-tools/resources/stop-passing-buck-cybersecurity
Examples of companies forcing changes https://www.bleepingcomputer.com/news/microsoft/microsoft-will-roll-out-mfa-enforcing-policies-for-admin-portal-access/
https://github.com/aya-rs/aya - eBPF implementation in Rust
https://ossfortress.io/
https://www.darkreading.com/endpoint-security/critical-logofail-bugs-secure-boot-bypass-millions-pcs

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth

Brian Boettcher: @boettcherpwned

Bryan Brake: @bryanbrake on Mastodon.social, https://linkedin.com/in/brakeb

Brakesec Website: https://www.brakeingsecurity.com

Twitter: @brakesec

Youtube channel: https://youtube.com/c/BDSPodcast

Twitch Channel: https://twitch.tv/brakesec

25Oct - okta breached (again), Energy company hit by supply chain attack, and you can help hire the best people Oct 26, 2023

Show notes

Subscribe on Twitch using Amazon Prime and watch us live: https://twitch.tv/brakesec

Check out our VODs on Youtube: https://www.youtube.com/@BrakeSecEd Join the BrakeSecEd discord: https://discord.gg/brakesec

News:

https://www.darkreading.com/remote-workforce/1password-latest-victim-okta-customer-service-breach

https://www.documentcloud.org/documents/24075435-bhi-notice

https://www.bleepingcomputer.com/news/security/us-energy-firm-shares-how-akira-ransomware-hacked-its-systems/

https://www.bleepingcomputer.com/news/security/ransomware-isnt-going-away-the-problem-is-only-getting-worse/

https://www.shacknews.com/article/137505/ransomware-group-capcom-2020-arrested

https://www.bleepingcomputer.com/news/security/flipper-zero-can-now-spam-android-windows-users-with-bluetooth-alerts/

https://www.nasdaq.com/articles/three-cybersecurity-sectors-that-resist-economic-downturns

Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs Sep 23, 2023

Show notes

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.

Guest Bio: Nicole is the Chief Product Officer at Axio. Nicole has spent her career building awareness around the benefits of usable security and human-centered security as a way to increase company revenue and create a seamless user experience.

Youtube VOD Link: https://youtube.com/live/tFaAB9an47g

Questions and topics: Usable security: is it an oxymoron?

What determines if the security is 'usable' or no? We sacrifice security for a better UX, what can be done to alleviate that? Or is it some sort of sliding scale in "poor UX, amazing security or awesome UX, poor security" Examples of poor UX for 'people': MFA, and password managers.

SEC updates and 'material events' and how that would affect security, IR, and other company reporting functions.

Also, additional documentation (Regulation S-K Item 106) https://www.linkedin.com/posts/nicole-sundin-5225a1149_sec-adopts-rules-on-cybersecurity-risk-management-activity-7090065804083290112-ISD8

Are companies ready to talk about their cybersecurity? Can the SEC say "you're not doing enough?"

What is 'enough'?

Are we heading toward yet another audit needed for public companies, similar to SOX?

When does an 8-K get publicly disclosed?

Materiality is based on a "reasonable investor"?

So, you don't need to announce that until you're certain, and it's based on what you can collect? Cyber Risk Management and some good examples of how to set up a proper cyber risk organization

Additional Links:

https://csrc.nist.gov/CSRC/media/Projects/usable-cybersecurity/images-media/Is%20Usable%20Security%20an%20Oxymoron.pdf

http://web.mit.edu/Saltzer/www/publications/protection/Basic.html

https://www.sec.gov/news/press-release/2023-139

https://www.sec.gov/news/statement/munter-statement-assessing-materiality-030922

https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/sec-final-cybersecurity-disclosure-rules.html

https://www.nasa.gov/centers/ames/research/technology-onepagers/hc-computing.html

https://securityscorecard.com/blog/what-is-cyber-security-performance-management/

John Aron, letters of marque, what does a "junior" job look like with AI? Sep 03, 2023

Show notes

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.

Guest Bio: John is the CEO of Aronetics. An avid climber and runner, John has spoken at many conferences about topics like ZeroTrust, BIOS/UEFI security, communication security, and malware. Aronetics is a technology-enabled service provider.

Youtube VOD: https://youtube.com/live/5dIVTwVZLAU

Linkedin VOD: https://www.linkedin.com/video/live/urn:li:ugcPost:7101738254823030784

Show Topic Summary:

John joins us to discuss "letters of Marque" in an effort for hackers to 'hack back'... the overreliance on automation, and communication siloes. We also talk about what a 'junior position' in infosec looks like with AI doing all the "Level 1 SOC Analyst" type roles normally given to someone fresh to the security industry.

Questions and topics:

Is infosec over reliant on automation? Automation comes with its own challenges.
1. Documentation woes
1. Automation is usually found in userland

Aronetics' Thor provides defense and counter-offense tamper-proof technology digitally tied to

Letter of Marque - good idea, or geopolitical disaster waiting to happen?

Siloes and communication -best ways to overcome those in an org and outside?

How do we overcome siloing?

Overcoming security challenges?Identity management - 2FA is everywhere, there's already ways around 2FA, so what now? 3FA? Biometrics? Make everyone carry around physical tokens that we can lose?

Blog post: https://www.aronetics.com/post-quantum-cryptography/ What do we need to protect against? Nation states with quantum computers? Rubber hose cryptography?

Crime thrives in areas of low visibility. https://www.aronetics.com/unknown/

https://www.aronetics.com/inside-the-breach/ (threat detection - the crime thrives in low vis areas)

Show points of Contact:

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/c/BDSPodcast

Twitch Channel: https://twitch.tv/brakesec

Amanda Berlin: @infosystir@infosec.exchange (Mastodon) @hackershealth

Brian Boettcher: @boettcherpwned

Bryan Brake: @bryanbrake on Mastodon.social

Megan Roddie - co-author of "Practical Threat Detecion Engineering" Aug 25, 2023

Show notes

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.

Buy here: https://subscription.packtpub.com/book/security/9781801076715

Amazon Link: https://packt.link/megan

Youtube VOD: https://www.youtube.com/watch?v=p1_jQa9OQ2w

Show Topic Summary:

Megan Roddie is currently working as a Senior Security Engineer at IBM. Along with her work at IBM, she works with the SANS Institute as a co-author of FOR509, presents regularly at security conferences, and serves as CFO of Mental Health Hackers. Megan has two Master's degrees, one in Digital Forensics and the other in Information Security Engineering, along with many industry certifications in a wide range of specialties. When Megan is not fighting cybercrime, she is an active competitor in Muay Thai/Kickboxing. She is a co-author of "Practical Threat Detection Engineering" from Packt publishing, on sale now in print and e-book. Buy here: https://subscription.packtpub.com/book/security/9781801076715

https://packt.link/megan ← Amazon redirect link that publisher uses if you want something easier on the notes

Questions and topics:

Of the 3 models, which do you find you use more and why? (PoP, ATT&CK, kill chain)
What kind of orgs have 'detection engineering' teams? What roles are involved here, and can other teams (like IR) be involved or share a reverse role there?
Lab setup requires an agent… any agent for ingestion or something specific?
How does Fleet or data ingestion work for Iot/Embedded device testing? Anything you suggest?
How important is it to normalize your log output for ingestion? (app, web, server all tell the story)

Additional information / pertinent LInks (Would you like to know more?):