TopPodcast.com
Menu
  • Home
  • Top Charts
  • Top Networks
  • Top Apps
  • Top Independents
  • Top Podfluencers
  • Top Picks
    • Top Business Podcasts
    • Top True Crime Podcasts
    • Top Finance Podcasts
    • Top Comedy Podcasts
    • Top Music Podcasts
    • Top Womens Podcasts
    • Top Kids Podcasts
    • Top Sports Podcasts
    • Top News Podcasts
    • Top Tech Podcasts
    • Top Crypto Podcasts
    • Top Entrepreneurial Podcasts
    • Top Fantasy Sports Podcasts
    • Top Political Podcasts
    • Top Science Podcasts
    • Top Self Help Podcasts
    • Top Sports Betting Podcasts
    • Top Stocks Podcasts
  • Podcast News
  • About Us
  • Podcast Advertising
  • Contact
Not in our directory?
Add Show Here
Podcast Equipment
Center

toppodcastlogoOur TOPPODCAST Picks

  • Comedy
  • Crypto
  • Sports
  • News
  • Politics
  • True Crime
  • Business
  • Finance

Follow Us

toppodcastlogoStay Connected

    View Top 200 Chart
    Back to Rankings Page
    News

    BrakeSec Education Podcast

    A podcast about the world of Cybersecurity, Privacy, Compliance, and Regulatory issues that arise in today’s workplace. Co-hosts Bryan Brake, Brian Boettcher, and Amanda Berlin teach concepts that aspiring Information Security professionals need to know, or refresh the memories of seasoned veterans.

    Advertise

    Copyright: © Copyright 2019. All rights reserved

    • Apple Podcasts
    • Google Play
    • Spotify

    Latest Episodes:
    meeting new people, walking on your keyboard causes issues, even google gets phone numbers wrong. Jul 21, 2023
    Show notes

    Check out our sponsor (BLUMIRA) at https://blumira.com/brake

    youtube channel link: https://youtube.com/c/BDSPodcast

    Full video on our youtube Channel! https://www.youtube.com/watch?v=BkBeLuM_urk

    https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/

    https://www.darkreading.com/remote-workforce/hacker-infected-foiled-by-own-infostealer

    https://therecord.media/cisa-warnings-adobe-microsoft-citrix-vulnerabilities

    https://www.itsecurityguru.org/2023/07/18/millions-of-keyboard-walk-patterns-found-in-compromised-passwords/

    https://therecord.media/airline-customer-support-phone-number-fraud-google

    https://twitter.com/Shmuli/status/1680669938468499458

    https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

    https://www.jdsupra.com/legalnews/tabletop-exercises-as-risk-mitigation-5278057/

    https://www.darkreading.com/vulnerabilities-threats/linux-ransomware-poses-significant-threat-to-critical-infrastructure

    https://bevyengine.org/ - Rust game engine https://godotengine.org/ - a more mature Rust game engine

    https://flappybird.io/ - which I suck at, BTW

    Intro/outro music: "Flex" by Jeremy Blake Courtesy of YouTube Music Library (used with proper permissions)


    Bsides Seattle and Austin, SecureBoot patch, and more May 27, 2023
    Show notes

    BrakeSec Show Outline – No Guest

    Show Topic Summary (less than 300 words)

    Bsides Seattle and Bsides Austin

    Youtube VOD: https://youtube.com/live/UGRaRSYj7kc

    Questions and potential sub-topics (5 minimum):

    1. Bsides Seattle update and Bsides Austin

    1. Patching the unpatchable

    1. https://en.wikipedia.org/wiki/Parkerian_Hexad

    1. Power and influence (is power bad? Is influence?)

    5. https://deliverypdf.ssrn.com/delivery.php?ID=357001027119125105074103081006094117005092014048001013007086030071009081068110103025024041103038045036033080107020112080097022024073029064061065125002071028013110008011045013116002084024000066075067001126004101003027004086091007025096080019022003104&EXT=pdf&INDEX=TRUE (A Theory of Creepy: Technology, Privacy and Shifting Social Norms)

    (contact info for people to reach out later):

    Additional information / pertinent Links (would you like to know more?):

    (contact info for people to reach out later):

    https://www.bleepingcomputer.com/news/security/microsoft-shares-guidance-to-detect-blacklotus-uefi-bootkit-attacks/

    https://www.bleepingcomputer.com/news/security/malware-dev-claims-to-sell-new-blacklotus-windows-uefi-bootkit/

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast

    Email: bds.podcast@gmail.com


    lynsey wolf, conducting insider threat investigations, CASB and UEBA utlization to good use. Apr 30, 2023
    Show notes

    Show Topic Summary (less than 300 words)

    Insider threat still exists, Lynsey Wolf talks with us about HR's role in insider threat, how prevalent investigations are in the post-pandemic work from home environment.

    Questions and potential sub-topics (5 minimum):

    1. What is the difference between insider threat and insider risk?

    1. Motivators of insider threat (not much different than espionage,IMO -bryan) (MICE: Money, Ideology, Compromise, and Ego.) https://thestack.technology/pentagon-leaks-insider-threat-sysadmin/

    1. 75% of all insider threats are being kicked off by HR departments. In short, it's proactive.

    1. "How did HR figure that out?" How are investigations normally initiated? What tools are they implementing to check users or predicting a disgruntled employee?" UEBA? CASB? Employee surveys that are 'anonymous'? Someone who reported others and it was dismissed? What if HR 'gets it wrong' or 'it's a hunt to find people no into 'groupthink' or 'not a culture fit'? https://www.cbsnews.com/news/french-worker-fired-for-not-being-fun-at-work-wins-lawsuit-cubik-responds/

    1. How can organizations be mindful of how and what data is collected to mitigate risk without affecting employee trust? And who watches the watchers to ensure data is handled responsibly? Are there any privacy guidelines companies need to understand before they implement such a system? (GDPR? CCPA? Privacy notices? Consent to monitoring on login? https://securiti.ai/blog/hr-employee-data-protection/ )

    1. Are companies causing the thing they are protecting against? (making an insider threat because they've become repressive?) (hoping there's an 'everything in moderation idea here… finding the happy medium between responsible 'observability' and 'surveillance')

    1. Lots of 'insider threat' tools, including from EDR companies. Do companies do a good job of explaining to employees why you need EDR?

    1. Quiet Quitting - latest term for companies to use to describe "employee has a side gig". How does this figure into insider threat? Is it assumed that people only have one 'thing' they do, or did the lack of a commute give people more time during the pandemic to diversify?

    1. Solutions for employees? Separate their work and private/side gig? Learn what their contract states to keep conflicts of interest or your current/past employer from taking your cool side project/start-up idea away from you? Solutions for companies?

    Additional information / pertinent Links (would you like to know more?):

    (contact info for people to reach out later):

    https://www.cisa.gov/detecting-and-identifying-insider-threats

    https://venturebeat.com/data-infrastructure/how-observability-has-changed-in-recent-years-and-whats-coming-next/

    https://ccdcoe.org/library/publications/insider-threat-detection-study/

    https://resources.sei.cmu.edu/asset_files/TechnicalReport/2016_005_001_454627.pdf (insider threat ontology)

    https://www.intelligentcio.com/apac/2022/08/01/survey-reveals-organizations-see-malicious-insiders-as-a-route-for-ransomware/

    https://www.helpnetsecurity.com/2022/04/08/organizations-insider-threats-issue/

    https://www.fortinet.com/resources/cyberglossary/what-is-ueba

    https://www.gartner.com/en/information-technology/glossary/cloud-access-security-brokers-casbs

    https://thecyberwire.com/glossary/mice

    https://qohash.com/the-high-price-of-trust-the-true-cost-of-insider-threats/

    https://abc7chicago.com/classified-documents-jack-teixeira-air-national-guard-arrest/13126206/ (Air National Guardsman accused in military records leak makes 1st court appearance - story still developing as of 16 April 2023)

    https://www.theverge.com/2020/8/4/21354906/anthony-levandowski-waymo-uber-lawsuit-sentence-18-months-prison-lawsuit

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec

    Youtube: https://youtube.com/c/BDSPodcast


    3CX supply chain attack, Mark Russinovich and Sysinternals, CISA ransomware notifications, and emotional intelligence Apr 08, 2023
    Show notes

    Show Topic Summary (less than 300 words)

    3CX supply chain attack, Mark Russinovich and Sysinternals, ransomware notifications from CISA, and emotional

    intelligence

    Youtube VOD: https://www.youtube.com/watch?v=afZHiBUr-2g

    Questions and potential topics (5 minimum):

    1. https://www.straitstimes.com/tech/downloading-a-cracked-version-of-fifa-23-or-hogwarts-legacy-for-free-it-s-probably-malware

    1. https://leadershipfreak.blog/2023/03/27/the-7-powers-of-questions/

    1. https://securityintelligence.com/articles/is-it-time-to-hide-your-work-emails/

    1. https://www.lollydaskal.com/leadership/what-remote-leaders-do-differently-to-be-successful/

    1. https://www.lollydaskal.com/leadership/the-role-of-emotional-intelligence-in-leadership-why-it-matters/

    1. https://www.cybersecuritydive.com/news/3cx-mandiant-investigate-supply-chain-attack/646543/

    1. https://www.bleepingcomputer.com/news/security/openai-chatgpt-payment-data-leak-caused-by-open-source-bug/

    1. https://www.cybersecuritydive.com/news/cisa-pre-ransomware-notification/646041/

    1. https://www.sentinelone.com/labs/the-life-and-times-of-sysinternals-how-one-developer-changed-the-face-of-malware-analysis/

    Additional information / pertinent Links (would you like to know more?):

    https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/

    https://www.orangecyberdefense.com/global/blog/research/3cx-voip-app-supply-chain-compromise

    https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/

    https://www.linkedin.com/feed/update/urn:li:activity:7047156405715300352/

    Sigma Rule - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_malware_3cx_compromise_susp_children.yml

    https://en.wikipedia.org/wiki/Information_Sharing_and_Analysis_Center

    https://www.cisa.gov/news-events/news/cisa-establishes-ransomware-vulnerability-warning-pilot-program

    https://www.fda.gov/media/166614/download

    https://www.amazon.com/Windows-Internals-Part-architecture-management/dp/0735684189

    https://medium.com/@martin-thissen/llama-alpaca-chatgpt-on-your-local-computer-tutorial-17adda704c23

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast

    Email: bds.podcast@gmail.com


    Dish Network is still busted, John Deere avoiding OSS requests, Is DAST dead? Mar 24, 2023
    Show notes

    Show Topic Summary (less than 300 words)

    Dish Network is still busted due to ransomware, your Pixel phone baseband RCE, Nothing runs like a Deere (away from OSS requests, anyway), and "Are we past DAST?"

    Questions and potential sub-topics (5 minimum):

    1. https://techcrunch.com/2023/03/15/dish-customers-kept-in-the-dark-as-ransomware-fallout-continues/

    1. https://medium.com/@cmanojshrestha/hack-any-social-media-account-using-cookie-stealing-attack-a6cdc4caafc1

    1. https://boringappsec.substack.com/p/edition-18-the-diminishing-returns

    1. https://www.theregister.com/2023/03/17/john_deere_sfc_gpl/

    1. https://www.bleepingcomputer.com/news/security/alleged-breachforums-owner-pompompurin-arrested-on-cybercrime-charges/ (thanks D Mathews!)

    1. https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/

    1. https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

    Additional information / pertinent Links (would you like to know more?):

    https://www.shopbiscoff.com/lotus-biscoff-xl-two-pack-case-bulk-size

    https://twitter.com/InfoSystir/status/1636847843683041280?s=20

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast

    Email: bds.podcast@gmail.com


    Nickolas Means talks about Security, Devops velocity, blameless orgs, and conferences infosec should attend Mar 04, 2023
    Show notes

    Guest info

    Name and Title:

    Nickolas Means, VP of Engineering at SYM

    Email/Social Media Contact:

    @nmeans on Twitter, @nmeans@ruby.social on Mastodon

    Time Zone (if other than Pacific):

    Central (Austin, TX)

    Show Topic Summary / Intro

    We welcome Nickolas Means to the stream. Nick is the VP of Engineering at Sym, the adaptive access tool built for developers. He's been an engineering leader for more than a decade, focused on helping teams build velocity through trust and autonomy. He's also a regular speaker at conferences around the world, teaching more

    effective software development practices through stories of real-world engineering triumphs and failures.

    He's also the co-host of "Managing Up" a podcast with Management tips, stories, and interviews to help navigate the challenges of managing creative and technical teams.

    Questions and potential sub-topics (5 minimum):

    1. 'blameless environment' during an incident. We can discuss working an incident and if a 'blameless' environment the exception or the rule (stories from the trenches are always welcome)

    1. Building a compliance program without tanking your engineering velocity... I'd like to speak about that in terms of overall security (product security, scanning, license checks, and more)

    1. Is there a playbook to building more efficient dev and security teams? Can cross training dev in basic security, or security in sprint planning processes make a better experience for all?

    1. Will we ever solve 'shifting left'? What does Shifting Left really mean to engineering teams, or is that a term security people created to try and speak 'dev/eng'?

    1. 'Managing Up'... security is often asked to do a lot. Be STO when you don't manage the resources, timeline, etc. When teams are small, you're either in the operational/tactical, when management wants a 'tactical/strategic' view. What can the overall business do to create a good working relationship out of the gate? "Make a dashboard" is all well and good, except when your org lacks maturity across the board. What are some realistic expectations management should have when the company is small? (I will provide additional context during the stream)

    Additional information / pertinent Links (would you like to know more?):

    https://managingup.show/ - Managing Up Podcast "Management tips, stories, and interviews to help navigate the challenges of managing creative and technical teams."

    https://symops.com/ - Adaptive access management tools built for engineers

    https://www.ted.com/talks/brene_brown_the_power_of_vulnerability?language=en

    https://www.terraform.io/

    https://news.stanford.edu/2022/12/05/explains-recent-tech-layoffs-worried/

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec

    Youtube: https://youtube.com/c/BDSPodcast


    SPECIAL INTERVIEW: John Aron and Jerod Brennen Feb 10, 2023
    Show notes

    BrakeSec Show Outline (all links valid as of 27 Jan 2023, subject to change)

    Is it scheduled?

    Yes || No|| Completed

    Date:

    2023/01/26

    Guest info

    Name and Title:

    John Aron, Founder/CEO of Aronetics

    Email:

    john@aronetics.com

    Time Zone (if other than Pacific):

    Eastern Standard

    Guest info

    Name and Title:

    Jerod Brennen

    Email:

    jerod@brennenconsulting.com

    Time Zone (if other than Pacific):

    EST

    Show Topic Summary (less than 300 words)

    Clear the fog of marketing truths and viable solutions that actually deter and defend adversarial action.

    Questions and potential sub-topics (5 minimum):

    1. Edge devices everywhere

    1. A paradigm culture shift is necessary

    1. How/What kind of culture shift is needed?

    1. In 2007, Steve Jobs unveiled the iPhone with no mention of how to keep it safe

    1. While DARPA that created GPS, shares a sorry - not sorry

    4. Working from Home or the office, how can you guarantee security with travel between both?

    1. This type of computing isn't possible in government circles.

    5. The New York Times 2019 Fall Special - So the internet didn't turn out the way we hoped.

    1. How can we restore sanity and normalcy to using a computer when there is a persistent threat everywhere?

    2. Who is under 'persistent threat'?

    6. Jerod: decentralization of technologies and empowering makers and people

    Additional information / pertinent Links (would you like to know more?):

    Even Nobodies Have Fans Now. (For Better or Worse.) - The New York Times.pdf(local copy)

    (local copy defeats paywall)

    )

    So the Internet Didn't Turn Out the Way We Hoped. Now What_ - The New York Times.pdf (local copy defeats paywall)

    https://identity.foundation/

    https://www.scmp.com/news/china/science/article/3206384/chinese-scientists-claims-new-quantum-code-breaking-algorithm-raise-eyebrows-us

    https://www.amazon.com/Fourth-Turning-American-Prophecy-Rendezvous/dp/0767900464

    https://www.investopedia.com/tech/what-dao/

    https://www.jimcollins.com/books.html ("good to great", and "Built to Last" were called out)

    https://www.amazon.com/Tyranny-Twenty-Lessons-Twentieth-Century/dp/0804190119

    John's Bsides San Diego slides: https://www.aronetics.com/wp-content/uploads/2023/01/Losing-Control-Aronetics-6-Oct-2022-FIN.pdf

    John's WiCys talk slides: Pending -

    Sidechannel (Fractional CISO organization) https://sidechannel.com/ (Jerod's organization)

    https://www.aronetics.com/ - (John's company)

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec


    Layoff discussions, another TMO breach, OneNote Malware, and more! Jan 24, 2023
    Show notes

    Lots of Layoffs (meta, Microsoft, Amazon, Sophos, Alphabet, Google) talk about the future effects of that, did it affect security? Attack surface management is risk management, Breaches and the TSA no-fly list leaked, and more!

    Full youtube video: https://www.youtube.com/watch?v=1Dgq8FpnWPw

    Questions and/or potential sub-topics (5 minimum):

    Layoffs (fear, uncertainty, doubt), what it means for people,

    https://www.lollydaskal.com/leadership/5-warning-signs-you-are-being-led-by-a-weak-leader/

    "No fly list leaked" https://www.vice.com/en/article/93a4p5/us-no-fly-list-leaks-after-being-left-in-an-unsecured-airline-server

    Attack Surface Management: https://flashpoint.io/blog/what-is-attack-surface-management/

    https://www.bleepingcomputer.com/news/security/beware-hackers-now-use-onenote-attachments-to-spread-malware/

    https://securityaffairs.com/141102/hacking/eof-cisco-routers-exposed-rce.html

    https://www.linkedin.com/posts/threatintelligence_threat-intel-cheat-sheet-by-cyber-threat-activity-7021035081184026624-3GWH? (issues with "step 0")

    Additional information / pertinent Links (would you like to know more?):

    https://www.sec.gov/ix?doc=/Archives/edgar/data/0001283699/000119312523010949/d641142d8k.htm - TMO's 8k filing

    https://www.bleepingcomputer.com/news/security/verizon-notifies-prepaid-customers-their-accounts-were-breached/

    https://en.wikipedia.org/wiki/Maia_arson_crimew

    https://discord.gg/brakesec

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec


    GPS car hacks, Google Threat report, notable topics of 2020, satellite threat modelling, twitter breach(?) Jan 10, 2023
    Show notes

    topics

    1. What were the biggest stories of 2022?
    1. Any notable trends that you saw
    1. https://acut3.github.io/bug-bounty/2023/01/03/fetch-diversion.html (fetch Diversion)
    1. I got 5 million steps in 2022! Looking to jog/run 350 miles
    1. https://medium.com/@jdowde2/the-security-threat-of-and-in-file-path-strings-d75ee695eb3a (danger of , and .. in file paths
    1. Google's threat Horizon's report

    Additional information / pertinent Links (would you like to know more?):

    https://services.google.com/fh/files/blogs/gcat_threathorizons_full_jan2023.pdf (google's Threat Horizons report)

    https://securityboulevard.com/2023/01/google-cybersecurity-action-team-threat-horizons-report-5-is-out/

    https://medium.com/malware-buddy/6-useful-infographics-for-threat-intelligence-240d6aca333e

    https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps \youtube.c

    https://hbr.org/2016/09/excess-management-is-costing-the-us-3-trillion-per-year

    https://thenewstack.io/circleci-secrets-catastrophe/

    https://www.nbc29.com/2023/01/06/twitter-leak-exposes-235-million-email-addresses-hack/

    https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps

    Show Points of Contact:

    Amanda Berlin: @infosystir @hackershealth

    Brian Boettcher: @boettcherpwned

    Bryan Brake: @bryanbrake @bryanbrake@mastodon.social

    Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec


    Josh-Whalen-risk-management-data_visualization-tools, value-creating activities -p2 Dec 20, 2022
    Show notes

    Full stream video on Youtube: https://youtu.be/i1xpAfNFCvY

    John's Youtube channel, to find more training/contact information: https://www.youtube.com/channel/UC3ctyx980M8jLa_cEiQveLQ

    https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration

    ADKAR model: https://www.prosci.com/methodology/adkar

    CCE framework: https://inl.gov/cce/

    Dashboard (non-sponsored link): https://monday.com

    Diagrammming tool: https://figma.com

    https://www.sciencedirect.com/topics/computer-science/system-analysis

    Amazon book: https://www.amazon.com/Engineering-Safer-World-Systems-Thinking/dp/0262533693


    Previous 1 2 3 4 5 48 Next

    Related Podcasts

    Inside Strategic Coach: Connecting Entrepreneurs With What Really Matters

    1

    Inside Strategic Coach: Connecting Entrepreneurs With What Really Matters Business
    WSJ Your Money Briefing

    2

    WSJ Your Money Briefing Business
    FORTUNE Unfiltered with Aaron Task

    3

    FORTUNE Unfiltered with Aaron Task Business
    FORTUNE OnStage Presents: The Most Powerful Women

    4

    FORTUNE OnStage Presents: The Most Powerful Women Business
    Slate Money

    5

    Slate Money Business
    In The Dark – The New Yorker

    6

    In The Dark – The New Yorker Business News
    footer-logo

    Contact Us

    Toll Free: 844-670-7747

    Links

    • Home
    • Top Charts
    • Networks
    • Apps
    • Independents Podcasts
    • Podcast Advertising
    • Podcast News
    • Contact Us
    • About Us
    • Analytics & Insights

    Stay Connected

      Privacy, Terms of Use & Our Code of Ethics Protecting Content Creators Copyrights