BrakeSec Education Podcast

Latest Episodes:

Establishing your Information Security Program - Part 2 Jul 07, 2014

Show notes

This is the continuation of our podcast from last week with Phil Beyer.

We started out talking about risk registers, and we end the podcast with a little Q&A about positions in companies (Chief Risk Officer, Chief Data Protection Officer), and whether these positions are useful.

Risk registers - http://en.wikipedia.org/wiki/Risk_register

Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Choose your adventure! Jul 03, 2014

Show notes

Hello valued Listener! I want to do another video, and I thought that you might want to decide which one piece of software I highlight. So here are three options: 1. Nikto 2. Nmap 3. OpenVAS You can send me your choice to my twitter (@bryanbrake) or to my gmail account (bds.podcast@gmail.com). I will be taking input until 0000 UTC on Sunday July 6th (1800 Saturday 5 July US/Eastern). You can only vote once.

Establishing your Information Security Program - Part 1 Jun 30, 2014

Show notes

Establishing an Information Security program can make or break an organization. So what do you need to get that started?

We have friend of the show Phil Beyer come in and discuss with us the five steps of the creation of an Information Security Program. Join us for Part 1, and next week, we'll finish up with a little Q&A, as well as what a 'risk register' is.

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

OWASP Top Ten: 1-5 Jun 23, 2014

Show notes

We finished up the OWASP Top Ten List. We discussed Injection, XSS, and other goodness. Find out what makes the Top 5 so special.

http://risky.biz/fss_idiots - Risky Business Interview concerning Direct Object Reference and First State Superannuation

http://oauth.net/2/ - Great information on OAUTH 2.0.

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

OWASP Top Ten: Numbers 6 - 10 Jun 16, 2014

Show notes

As we wade through the morass of the Infosec swamp, we come across the OWASP 2013 report of web app vulnerabilities. Since Mr. Boettcher and I find ourselves often attempting to explain these kinds of issues to people on the Internet and in our daily lives, we thought it would be prudent to help shed some light on these.

So this week, we discuss the lower of the top 10, the ones that aren't as glamorous or as earth shaking as XSS or SQLI, but are gotchas that will bite thine ass just as hard.

Next week is the big ones, the Top 5... all your favorites, in one place!

OWASP Top 10 (2013) PDF: http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-%202013.pdf

Costs of finding web defects early (2008): http://www.informit.com/articles/article.aspx?p=1193473&seqNum=6

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Talk with Guillaume Ross - Part 2 (all things cloud) Jun 09, 2014

Show notes

This is part 2 of our podcast interview with Guillaume Ross, Infosec professional who is well versed with the intricacies of various cloud architectures, whether they are IaaS, PaaS, or SaaS. This part of the podcast discussed how contracts are established, and we ask if smaller cloud providers have a chance against behemoths like Google, Amazon, and Microsoft.

Links brought up during the interview:

Rich Mogull's $500 Epic fail - https://securosis.com/blog/my-500-cloud-security-screwup

Rich Mogull's write up on how the aftermath and investigation - https://securosis.com/tag/cloud+security

Amazon VPC: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html

Azure Endpoints (how-to): http://azure.microsoft.com/en-us/documentation/articles/virtual-machines-set-up-endpoints/?rnd=1

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

It all goes in "the cloud" (Part 1) Jun 01, 2014

Show notes

Brian and I interviewed Mr. Guillaume Ross (@gepeto42), an Information Security professional who helps organizations get themselves situated into cloud based solutions. We get a better understanding of why people would want to put their info into the 'cloud' and how they are different than traditional co-lo and datacenters.

Guillaume's Blog: http://blog.binaryfactory.ca/

AWS (amazon) Security Best Practices WhitePaper: http://aws.amazon.com/whitepapers/aws-security-best-practices/

Amazon EC2 FAQ: http://aws.amazon.com/ec2/faqs/

Microsoft's Azure FAQ:http://azure.microsoft.com/en-us/support/faq/?rnd=1

"cloud computing icon" courtesy of smartdatacollective.com

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Video 2: BONUS!!!! Kismet Video! May 27, 2014

Show notes

As promised, I am posting a video I made explaining how to setup Kismet to do wireless scans.

The only pre-requisites you need are Vmware (it will work the same in VirtualBox), and a VM of Kali linux. The only real difference is the message that asks where the wireless adapter should connect to.

It's my first attempt editing a video, so please be kind

Wireless scans with Kismet and Aircrack-ng May 26, 2014

Show notes

Mr. Boettcher and I had a great time this week. We talked all about doing wireless audits for PCI using Kismet and Aircrack-ng, and talked about some capabilities of both.

Alfa AWUS051NH (works in Kali/Backtrack) (no sponsor link): http://www.amazon.com/gp/offer-listing/B002BFO490/ref=dp_olp_0?ie=UTF8&condition=all

kismetwireless.net

Using Karma with a pineapple to fool clients into connecting unencrypted: http://www.troyhunt.com/2013/04/your-mac-iphone-or-ipad-may-have-left.html

Tutorial on hacking various wireless: http://cecs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm

Premium content by Bryan! I made a video as well that describes using your wireless dongle to make your Kali Linux into a powerful areal wireless sniffer. http://brakeingsecurity.com/bonus-kismet-video

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

PGP and GPG -- protect your data May 18, 2014

Show notes

Sharing information between people and organizations can be a sensitive issue, especially if the information being shared is of mutual importance.

This week, we break down PGP and it's open source cousin GPG. We discuss how last week's podcast about hashing, encoding, and encryption are all bundled up neatly with PGP, and give you some examples of software you can use on Mac, Windows, and Linux.

GPG4Win - http://www.gpg4win.org/

GPG Suite (Mac OS) - https://gpgtools.org/

public PGP key server - pgp.mit.edu

NoStarch Press book: http://www.nostarch.com/pgp.htm

gpg commandline tutorial - http://irtfweb.ifa.hawaii.edu/~lockhart/gpg/gpg-cs.html

Icon courtesy of NoStarch Press

Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Our TOPPODCAST Picks

Follow Us

Stay Connected

BrakeSec Education Podcast

Related Podcasts

Links

Stay Connected