BrakeSec Education Podcast

Latest Episodes:

Tanya Janca on secure coding practices, Swagger docs, and why documentation matters Jul 24, 2022

Show notes

Tanya Janca, also known as @SheHacksPurple, is the best-selling author of 'Alice and Bob Learn Application Security'. She is also the founder of We Hack Purple, an online learning academy, community and podcast that revolves around teaching everyone to create secure software. Tanya has been coding and working in IT for over twenty years, won countless awards, and has been everywhere from startups to public service to tech giants (Microsoft, Adobe, & Nokia). She has worn many hats; startup founder, pentester, CISO, AppSec Engineer, and software developer. She is an award-winning public speaker, active blogger & streamer and has delivered hundreds of talks and trainings on 6 continents. She values diversity, inclusion, and kindness, which shines through in her countless initiatives.

https://shehackspurple.ca/

BrakeSec is: Amanda Berlin @infosystir Brian Boettcher @boettcherpwned Bryan Brake @bryanbrake

www.brakeingsecurity.com

PYPI enables 2FA, some devs have a problem with this Jul 14, 2022

Show notes

Full #twitch VOD here (prime sub or paid sub required): https://www.twitch.tv/videos/1528342722

https://github.com/untitaker/python-atomicwrites

https://thehackernews.com/2022/07/pypi-repository-makes-2af-security.html

Twitch streams (175+ hours of content!): Https://twitch.tv/brakesec

www.brakeingsecurity.com

Twitter:

@infosystir

@boettcherpwned

@brakesec

@bryanbrake

JW Goerlich on Training, phishing exercises, security metrics,getting the most from user training Jul 05, 2022

Show notes

JW Goerlich -

"Wolfgang is a cyber security strategist and an active part of the Michigan security community. He co-founded the OWASP Detroit chapter and organizes the annual Converge and BSides Detroit conferences. Wolfgang has held roles such as the Vice President of Consulting, Security Officer, and Vice President of Technology Services. He regularly advises clients on topics ranging from risk management, incident response, business continuity, secure development life cycles, and more."

https://jwgoerlich.com/

RSA talks and discussion

Phishing tests -

https://www.securityweek.com/research-simulated-phishing-tests-make-organizations-less-secure

https://hbr.org/2021/04/phishing-tests-are-necessary-but-they-dont-need-to-be-evil

What are the goal of these tests?

That someone will click and activate (is that not a given?)

What made them popular in the first place?

Is this an example of management not taking security seriously, so we needed proof?

https://www.csoonline.com/article/3619610/best-practices-for-conducting-ethical-and-effective-phishing-tests.html

FTA: "This will only undermine the efforts of cybersecurity teams as a whole, alienating the very people they aim to engage with, Barker adds. "People generally don't like to be tricked, and they don't usually trust the people who trick them. One counterargument I often hear is that criminals use emotive lures in a phish, so why shouldn't we? Well, criminals also cause physical damage to property, take systems offline, and disrupt services, but physical social engineers and pen-testers don't—for good reason. Simulations should not cause active harm.""

Is this part of a larger issue? Why do we treat these tests the way we do?

Typical scenario?Mgmt does not believe or trust their internal people to tell them what is wrong, and takes a 3rd party source/product to tell them the same thing.

Are these stories Apocryphal? Or just my experience?

RSA conference, Zero Trust, SSO, 2FA, and multi-cloud tenancy with J Goerlich Jun 25, 2022

Show notes

jon-dimaggio-part2-threat intel-hacking back-analyzing malware Jun 16, 2022

Show notes

Author of the #noStarch book "The Art of Cyberwarfare" (https://nostarch.com/art-cyberwarfare) Topics: discusses his book, threat intel as a service, why people enjoy malware analysis? Should people 'hack back' and what legal issues are around that? How do you soften the messaging if you have an insider threat team?

www.infoseccampout.com for more information about our 2022 conference in Seattle, WA on 26-28 August 2022!

Our full 90 minute stream with Jon, including 30 minutes of audio you won't get on the audio podcast is available at the $5 USD Patreon level, or via our VOD at our Twitch Broadcast site (https://twitch.tv/brakesec) Twitch VOD Link: https://www.twitch.tv/videos/1308277609

Thank you to our Patreon and Twitch supporters for their generous donations and subs and bits!

Jon DiMaggio_Art-of-cyberwarfare_hacking_back-insider-threat-messaging_P1 Jun 09, 2022

Show notes

www.infoseccampout.com for more information about our 2022 conference in Seattle, WA on 26-28 August 2022!

Thank you to our Patreon and Twitch supporters for their generous donations and subs and bits!

news, infosystir's talk at RSA, conti has an 'image' problem May 24, 2022

Show notes

https://www.reuters.com/technology/tesla-cars-bluetooth-locks-vulnerable-hackers-researchers-2022-05-17/

https://portswigger.net/daily-swig/us-revises-policy-regarding-computer-fraud-and-abuse-act-will-not-prosecute-good-faith-research

https://www.securityweek.com/conti-ransomware-operation-shut-down-after-brand-becomes-toxic

https://portswigger.net/daily-swig/chicago-public-schools-data-breach-blamed-on-ransomware-attack-on-supplier

https://www.helpnetsecurity.com/2022/05/23/protect-kubernetes-cluster/

https://www.darkreading.com/application-security/malicious-package-python-repository-cobalt-strike-windows-macos-linux

https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/

https://www.darkreading.com/application-security/6-scary-tactics-used-in-mobile-app-attacks

Mieng Lim, Ransomware actions, using insurance to offset risk, good IR/PR comms May 15, 2022

Show notes

Full VOD here (must subscribe to Twitch): https://www.twitch.tv/videos/1478955254

Mieng Lim, VP of Product at Digital Defense by HelpSystems

Topic she will discuss:

Outsmarting RaaS: Strategies to Implement Before, During, and After a Ransomware Attack

Webinar: https://www.digitaldefense.com/resources/videos/webinar-outsmarting-raas-strategies-against-ransomware-attacks/

https://www.digitaldefense.com/blog/infographic-the-latest-ransomware-facts/

https://www.digitaldefense.com/wp-content/uploads/2020/07/Digital-Defense-Inc.-Ransomware-Infographic-070621.jpg

https://www.digitaldefense.com/blog/the-terrifying-truth-about-ransomware/

Prepared questions from Mieng:

Belief that "malicious actors today are using cutting edge techniques for the majority of attacks"
Belief that "majority of compromises are via zero-day vulnerabilities"
Organizations continue to leave systems unpatched with years old vulnerabilities
Belief that "my organization doesn't have anything a malicious actor would be interested in…I'm not a target"
My organization has cyber insurance and that's enough.
"I don't have budget to buy all the products/hire the staff needed to protect my network."

https://www.techrepublic.com/article/initial-access-brokers-how-are-iabs-related-to-the-rise-in-ransomware-attacks/

https://www.pandasecurity.com/en/mediacenter/security/ransomware-statistics/

As new approaches to ransomware like double extortion continue to pay off, attackers are demanding higher ransom payouts than ever before. The average ransom demand in the first half of 2021 amounted to $5.3 million — a 518% increase compared to 2020. The average ransom payment has also increased by 82% since 2020, reaching a whopping $570,000 in the first half of 2021 alone.

The FBI's Internet Crime Complaint Center (IC3) received 2,084 ransomware complaints in the first half of 2021. (FBI and CISA)

At least one employee downloaded a malicious mobile application in 46% of organizations in 2021. (Check Point)

https://www.marsh.com/us/services/cyber-risk/insights/ransomware-paying-cyber-extortion-demands-in-cryptocurrency.html

@infosystir

@boettcherpwned

@bryanbrake (on Mastodon & Twitter)

@brakeSec

Discord Invite! "please click OK to accept the Code of Conduct in the 'Rules-and-info' channel" https://discord.gg/brakesec

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

Apple Podcasts: https://podcasts.apple.com/us/podcast/brakeing-down-security-podcast/id799131292

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

#Patreon: https://brakesec.com/BDSPatreon

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Mieng-Lim-Ransomware-Best-Practices-p1 May 11, 2022

Show notes

Mieng Lim, VP of Product at Digital Defense by HelpSystems

Topic she will discuss:

Outsmarting RaaS: Strategies to Implement Before, During, and After a Ransomware Attack

Webinar: https://www.digitaldefense.com/resources/videos/webinar-outsmarting-raas-strategies-against-ransomware-attacks/

https://www.digitaldefense.com/blog/infographic-the-latest-ransomware-facts/

https://www.digitaldefense.com/wp-content/uploads/2020/07/Digital-Defense-Inc.-Ransomware-Infographic-070621.jpg

https://www.digitaldefense.com/blog/the-terrifying-truth-about-ransomware/

Prepared questions from Mieng:

Belief that "malicious actors today are using cutting edge techniques for the majority of attacks"
Belief that "majority of compromises are via zero-day vulnerabilities"
Organizations continue to leave systems unpatched with years old vulnerabilities
Belief that "my organization doesn't have anything a malicious actor would be interested in…I'm not a target"
My organization has cyber insurance and that's enough.
"I don't have budget to buy all the products/hire the staff needed to protect my network."

https://www.techrepublic.com/article/initial-access-brokers-how-are-iabs-related-to-the-rise-in-ransomware-attacks/

https://www.pandasecurity.com/en/mediacenter/security/ransomware-statistics/

The FBI's Internet Crime Complaint Center (IC3) received 2,084 ransomware complaints in the first half of 2021. (FBI and CISA)

At least one employee downloaded a malicious mobile application in 46% of organizations in 2021. (Check Point)

https://www.marsh.com/us/services/cyber-risk/insights/ransomware-paying-cyber-extortion-demands-in-cryptocurrency.html

@infosystir

@boettcherpwned

@bryanbrake (on Mastodon & Twitter)

@brakeSec

Discord Invite! "please click OK to accept the Code of Conduct in the 'Rules-and-info' channel" https://discord.gg/brakesec

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora