BrakeSec Education Podcast

Latest Episodes:

2015-008- Make your web Apps more secure with Content Security Policy (part 1) Feb 16, 2015

Show notes

Pawel Krawczyk did an interview with us about Content Security Policy. Learn about what it is, and whether or not the latest browsers can support it.

We also talk about how you can get around it, if there are ways to avoid it if you are a bad guy, and how you can get the most out of it.

If you're a web developer, and want to reduce your site's chances of allowing XSS, you'll want to take a listen to this.

https://w3c.github.io/webappsec/specs/content-security-policy/#changes-from-level-1

https://w3c.github.io/webappsec/specs/content-security-policy/#directive-sandbox

2015-007-SANS_Top20_14and15--Proving_Grounds_Microcast with Megan Wu! Feb 10, 2015

Show notes

Extra special treat this week! We do a continuation of our review of the Top 20 Security Controls, in which we do #14 and #15, which all of you will find very interesting.

But the real reason we are posting this today is the Call for Papers and Call for Mentors for the Bsides Las Vegas Proving Grounds! We invited Magen Wu (@tottenkoph) on to discuss. If you've ever asked yourself "I'd like to give a talk, but they'd never put me on" NOW IS YOUR CHANCE! :)

This is a great opportunity if you're a veteran speaker, or just want to give back to the community at large... You can mentor a n00b to help them create a topic, help them hone their paper, and be with them when they give the talk at Bsides Las Vegas in July.

Many thanks to @tottenkoph and @securitymoey. They need your help, both as a mentor and a mentee. This is also an excellent networking opportunity. You get 1-on-1 access to an often influential mentor, someone in the infosec community, and your talk will be seen by several hundred people. hmmm.... maybe I should put one in :D

-----

SANS #14-10:

Ensure that the log collection system does not lose events during peak activity, and that the system detects and alerts if event loss occurs (such as when volume exceeds the capacity of a log collection system). This includes ensuring that the log collection system can accommodate intermittent or restricted-bandwidth connectivity through the use of handshaking / flow control.

------

"Dirty Rhodes" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

2015-006- Is your ISP doing a 'man-in-the-middle' on you? Feb 07, 2015

Show notes

During our research with Lee Brotherston, who we had on last week for our podcast on threat modeling, we got to listen to one of his talks about how his ISP in Canada was actively doing a Man-in-Middle injection of a banner into sites that he visited.

We were intrigued, and also gobsmacked (I can say that, right?) about the brashness of an ISP not apparently understanding the security implications of this, so we had him back on totalk about the finer points of his research. The bad news? Other ISPs, including American ISPs are using this technology.

This is one of those podcasts that you need to tell your friends about, cause it's truly surprising the lengths ISPs go to injecting content into your pages.

We also have a short message about the Bsides Las Vegas Proving Grounds this year... If you've wanted to present a paper at a conference, and have a mentor guide you through the process, hit them up on the Proving Grounds page at http://www.bsideslv.com

Show notes (lots of info): https://docs.google.com/document/d/1YLkiRE1SVIyWquWc-iQrESWlT10rSJmW1VcrOX3kQZ0/edit?usp=sharing

"Dirty Rhodes" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

2015-005: Threat Modeling with Lee Brotherston Feb 01, 2015

Show notes

Threat Modeling... ranks right up there with Risk Assessments in importance... You gotta figure out how the applications you're creating or the systems you're engineering are secure. It really takes knowing your application and really, knowing the enemies/factors that can cause your application to fail, from santizing inputs on a web app, to making sure that your code doesn't have use-after-free bugs.

Brakeing Down Security talked about conducting threat modeling and application reviews with Lee Brotherston (@synackpse) from Leviathan Security (@LeviathanSecurity) this week. We discuss types of risk analysis, including one named 'Binary Risk Analysis', which may simplify assessment of your computer systems.

Show notes = https://docs.google.com/document/d/1K-eycek2Xud7loVC4yrHg6eHCY0oyztV_ytbY433oYk/edit?usp=sharing

"Dirty Rhodes" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

2015-004-SANS Top 20: 20 to 16 Jan 25, 2015

Show notes

Mr. Boettcher and I went over the bottom 5 of the SANS Top 20 security controls that businesses should implement. When put into the right order, you should be able to have an environment that is able to withstand most any attack.

We also talk about 5 'Quick Fixes' that will put you on the right track with becoming more secure.

You may be surprised at what is considered a priority... have a listen: (QR code links to the mp3)

Show notes: https://docs.google.com/document/d/1JuRJ-RPTmw50pTeO82rb9_rC8tFf53eiUzkppfwQvs0/edit?usp=sharing

"Dirty Rhodes" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

All About Tor Jan 17, 2015

Show notes

Brakeing Down Security tackles the 'Deep Web' this week... yep, we talk about Tor. If you don't have a lot of experience with this or wonder how it works, we give you a little history and help you understand the traffic flow works.

We even give you some advice on de-identification and things you shouldn't allow when traveling the Deep Web, like Javascript, Flash, and Java.

Show Notes:

https://docs.google.com/document/d/1vBI_bg_0RzF_sSNMj84xQpEZGUrxtAkB8SxZ08MzUi0/edit?usp=sharing

"Dirty Rhodes" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Episode 2: Big Trouble in Small Businesses Jan 10, 2015

Show notes

Security's the same, the world around... and is a necessity in businesses of all sizes, from the mega-corporations, all the way down to the business with 10 employees in a garage in suburbia.

This week, Mr. Boettcher and I discuss security in small businesses. What is needed to make security part of the culture of a new company. We discuss some open source tools to ensure that networks are monitored properly, logs are collected, collated, and analyzed. And better yet, these are on the cheap, which is helpful for a small business on a tight budget.

QR code links directly to the episode...

http://www.ihotdesk.co.uk/article/801717385/Most-small-businesses-have-faced-InfoSec-breach-recently

https://blog.whitehatsec.com/infosec-europe-wrapup/

http://www.infosectoday.com/Articles/DRPlanning.htm

"Dirty Rhodes" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

2015-001- "unhackable" or "attacker debt" Jan 04, 2015

Show notes

This is a quick little podcast I did without Mr. Boettcher about a Twitter discussion that occurred when Dr. Neil Degrasse Tyson mentioned that we should just make computers 'unhackable'.

The first episode of the 2015 season of Brakeing Down Security is here!

Tweet from Dr. Neil Degrasse Tyson

https://twitter.com/neiltyson/status/551378648578916353

Rebuttal from Kevin Johnson

https://twitter.com/secureideas/status/551510885441998848

"Dirt Rhodes"

Kevin MacLeod (incompetech.com)

Licensed under Creative Commons: By Attribution 3.0

http://creativecommons.org/licenses/by/3.0/

Is Compliance running or ruining Security Programs? Dec 26, 2014

Show notes

We at Brakeing Down Security world headquarters don't understand the concept of 'End of the Year' podcast, so consider this the "End-End of the Year" podcast.

We talked about the order of things... whether Compliance is a detriment to Security, and who should be running who.

So pull up a glass of eggnog, grabbing another cookie, and put another log on the fire, cause Brakeing Down Security is throwing out one more for the year! Happy Holidays... all of them... :)

Brakeing Down/Defensive Security Mashup! Dec 21, 2014

Show notes

It's a Super Deluxe sized Brakeing Down Security this week...

It's something you've dreamed of forever (or not), but Jerry Bell and Andrew Kalat from Defensive Security Podcast stopped by and we made ourselves a podcast baby... Boy, was it ugly :)

I'm just kidding, we had a great time discussing some news, and going over what we learned... and any good end-of-year podcast must have predictions...

We also discussed Sony, caused it's huge news of the year, and talked about Target, because we love dissing PCI... ;)

There might be a few bad words, so if you have small ears around, be advised...

When you're done, check out the other 96 episodes of Defensive Security, and check out our 55 other episodes..

http://www.defensivesecurity.org/

Twitter handles:

Andrew Kalat: https://twitter.com/lerg

Jerry Bell: https://twitter.com/Maliciouslink

Icon provided by DefensiveSecurity.org... I'd imagine they'd let us use it, since they were on the podcast ;)

Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Our TOPPODCAST Picks

Follow Us

Stay Connected

BrakeSec Education Podcast

Related Podcasts

Links

Stay Connected