BrakeSec Education Podcast - TopPodcast.com

View Top 200 Chart

Back to Rankings Page

BrakeSec Education Podcast — News
BrakeSec Education Podcast

A podcast about the world of Cybersecurity, Privacy, Compliance, and Regulatory issues that arise in today’s workplace. Co-hosts Bryan Brake, Brian Boettcher, and Amanda Berlin teach concepts that aspiring Information Security professionals need to know, or refresh the memories of seasoned veterans.

Copyright: © Copyright 2019. All rights reserved

Latest Episodes:

2021-041-0day disclosure, Randori, FBI email server pwnage Nov 16, 2021

Show notes

https://www.bleepingcomputer.com/news/security/us-education-dept-urged-to-boost-k-12-schools-ransomware-defenses/

https://securityaffairs.co/wordpress/124570/cyber-crime/fbi-hacked-email-server.html

https://www.zdnet.com/article/security-company-faces-backlash-for-waiting-12-months-to-disclose-palo-alto-0-day/

https://www.randori.com/blog/why-zero-days-are-essential-to-security/

https://twitter.com/_MG_/status/1459024603263557633

"Hey... did anyone notice that PAN 0day was fixed in a version that was released over a year ago?

Guess it wasn't easy to notice under all the loud opinions about ethics."

https://twitter.com/_MG_/status/1459038747807285253/photo/1

2021-040-Sweden's parents rebel over poor App design, US government forcing patching of systems, and Vuln chaining Nov 08, 2021

Show notes

News stories covered this week, as well as links of note:

https://www.wired.co.uk/article/sweden-stockholm-school-app-open-source

https://curtbraz.medium.com/a-konami-code-for-vuln-chaining-combos-1a29d0a27c2a

https://docs.google.com/presentation/d/17gISafUZzEyjV7wkdHaTQZmtxstBqECa/edit#slide=id.p4

https://www.securityweek.com/braktooth-new-bluetooth-vulnerabilities-could-affect-millions-devices

https://offsec.almond.consulting/intro-to-file-operation-abuse-on-Windows.html

https://searchsecurity.techtarget.com/news/252509040/CISA-cracks-the-whip-on-patching-vulnerabilities

https://cyber.dhs.gov/bod/22-01/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

2021-039-Minimum Viable vendor security sheet, Federal logging requirements, and more! Nov 02, 2021

Show notes

https://securityaffairs.co/wordpress/123948/security/2021-list-of-most-common-hardware-weaknesses.html?

https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf

https://www.darkreading.com/application-security/tech-companies-create-security-baseline-for-enterprise-software

https://security.googleblog.com/2021/10/launching-collaborative-minimum.html

https://mvsp.dev/mvsp.en/index.html

https://www.standardfusion.com/blog/assessing-vendor-risk-with-questionnaires/

SPONSOR-Blumira's Nato Riley on Log Classification, Security Maturity, Nov 01, 2021

Show notes

From Nato's email:Hi Bryan,

Discussing the challenges that come with not having good logging in place could be a great topic! We could make it partly about how security maturity works, in the idea that security generally starts with awareness and visibility.

The topic sort of gets into the idea that knowing is half the battle, so logging can be transformative for helping a company properly secure themselves from online risks!

What do you think of this topic idea?

https://www.blumira.com/careers/

https://thenewstack.io/logging-and-monitoring-why-you-need-both/

https://prometheus.io/

https://www.sentinelone.com/blog/the-10-commandments-of-logging/

https://towardsdatascience.com/why-should-you-care-about-logging-442a195b80a1

https://www.g2.com/products/blumira-automated-detection-response/reviews#survey-response-4908309

(wouldn't you know it… a couple additional google searches, and I find this -brbr)https://www.executivegov.com/2021/08/omb-creates-maturity-framework-for-event-log-management/) https://insidecybersecurity.com/sites/insidecybersecurity.com/files/documents/2021/may/cs2021_0089c.pdf

Logging maturity in the US gov (OMB policy doc): https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf

Are there examples of devices that don't give out logs? What if your vendor does not allow you to have logs? Can you create logs based on the activity of the device? What would that look like?

Types of logs: Application logs

Network logs

Endpoint security logs

OS logs

IDS/IPS logs

Vuln scanner logs

2021-038-Liz Saling, 5 pillars of building a good team Oct 25, 2021

Show notes

Blog post that inspired this episode:

https://lizsaling.com/SWE-team-five-pillars/

Liz Saling (@lizsaling)

https://www.mindtools.com/pages/article/newLDR_86.htm

http://www.mspguide.org/tool/tuckman-forming-norming-storming-performing

https://michaelhyatt.com/3-roadblocks-to-avoid-for-optimal-team-performance

Erin meyer is the one who did the netflix study!

https://bigthink.com/the-present/high-performing-teams/

https://alicedartnell.com/blog/why-smart-goals-are-stupid/

NEWS:

Unlocking 'god' mode on windows 11: https://www.bleepingcomputer.com/news/microsoft/how-to-unlock-windows-11s-god-mode-to-access-advanced-settings/

https://www.reddit.com/r/netsec/comments/q9f63y/creating_a_basic_python_reverse_shell_listener/

NFT malware (NFTs that empty wallets): https://www.theregister.com/2021/10/17/in_brief_security/

2021-037-Tony Robinson, leveraging your home lab for job success - Part2 Oct 17, 2021

Show notes

Tony Robinson (@da_667)

Thought we'd put in a little news to round out the show

https://www.bbc.com/news/world-us-canada-58863678 - nuclear secrets hidden in a peanut butter sandwich

https://www.theregister.com/2018/04/20/rsa_security_conference_insecure_mobile_app/

https://www.vice.com/en/article/jg8w9b/the-twitch-hack-is-worse-for-streamers-than-for-twitch

https://nakedsecurity.sophos.com/2021/10/08/apache-patch-proves-patchy-now-you-need-to-patch-the-patch/

https://www.securityweek.com/fontonlake-linux-malware-used-targeted-attacks

https://securityaffairs.co/wordpress/123182/breaking-news/medtronic-recalled-insulin-pumps-controllers.html

Similar device on ebay: https://www.ebay.com/itm/324762812721

https://www.zdnet.com/article/brewdog-exposed-data-of-200000-shareholders-for-over-a-year/

https://tpetersonkth.github.io/cve/2021/10/02/Analysis-of-CVE-2019-9053.html

https://0xdf.gitlab.io/

www.leanpub.com/avatar2 MSRP = $30 USD

Book changes

What is the end goal?

Upskill?

Independent consultant?

Promotion?

Bug bounties?

Lab setup -

Lab setup types

Cloud based -

Desktop/laptop/NUC -

Server -

Good VMs to

https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ - 90 day WIndows machines

What other home lab equipment have would be helpful?Testing IoT/embedded devices?

Car hacking?

Malware analysis? https://bazaar.abuse.ch/

Virus Total Intelligence

Honeypots

@malware_traffic - https://twitter.com/malware_traffic/status/1446627364147023877

Analyzing binaries?

Patch analysis (patch tuesday, print nightmare, etc)?

https://wumb0.in/extracting-and-diffing-ms-patches-in-2020.html

https://www.netresec.com/?page=networkminer

Soldering?

Oscillators for voltage checks?

Wireless?

Old cellphones (mobile apps, don't need cellular)

Personal assistant devices (used IoT devices?)

Accessing data stored on devices

Specific software licenses?

Burp?

If I'm trying to break into infosec, how do I use my lab to sell myself to an employer?

Does the employer care?

How can someone show what they've learned in a way that shows the value?

2021-036-Tony Robinson, twtich breach, @da_667 lab setup new book edition! -part1 Oct 14, 2021

Show notes

Tony Robinson (@da_667)

Thought we'd put in a little news to round out the show

https://www.bbc.com/news/world-us-canada-58863678 - nuclear secrets hidden in a peanut butter sandwich

https://www.theregister.com/2018/04/20/rsa_security_conference_insecure_mobile_app/

https://www.vice.com/en/article/jg8w9b/the-twitch-hack-is-worse-for-streamers-than-for-twitch

https://nakedsecurity.sophos.com/2021/10/08/apache-patch-proves-patchy-now-you-need-to-patch-the-patch/

https://www.securityweek.com/fontonlake-linux-malware-used-targeted-attacks

https://securityaffairs.co/wordpress/123182/breaking-news/medtronic-recalled-insulin-pumps-controllers.html

Similar device on ebay: https://www.ebay.com/itm/324762812721

https://www.zdnet.com/article/brewdog-exposed-data-of-200000-shareholders-for-over-a-year/

https://tpetersonkth.github.io/cve/2021/10/02/Analysis-of-CVE-2019-9053.html

https://0xdf.gitlab.io/

www.leanpub.com/avatar2 MSRP = $30 USD

Book changes

What is the end goal?

Upskill?

Independent consultant?

Promotion?

Bug bounties?

Lab setup -

Lab setup types

Cloud based -

Desktop/laptop/NUC -

Server -

Good VMs to

https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ - 90 day WIndows machines

What other home lab equipment have would be helpful?Testing IoT/embedded devices?

Car hacking?

Malware analysis? https://bazaar.abuse.ch/

Virus Total Intelligence

Honeypots

@malware_traffic - https://twitter.com/malware_traffic/status/1446627364147023877

Analyzing binaries?

Patch analysis (patch tuesday, print nightmare, etc)?

https://wumb0.in/extracting-and-diffing-ms-patches-in-2020.html

https://www.netresec.com/?page=networkminer

Soldering?

Oscillators for voltage checks?

Wireless?

Old cellphones (mobile apps, don't need cellular)

Personal assistant devices (used IoT devices?)

Accessing data stored on devices

Specific software licenses?

Burp?

If I'm trying to break into infosec, how do I use my lab to sell myself to an employer?

Does the employer care?

How can someone show what they've learned in a way that shows the value?

2021-035-GRC selection discussion, TechSecChix, and the 'job description problem' Sep 29, 2021

Show notes

GRC tools (Governance Risk and Compliance)

@ki_twyce_

@TechSecChix

INfosec unplugged

Security Happy Hour

Eric's cyberpoppa show

Cyber Insight show - cohost

Blumira is hiring

https://www.blumira.com/careers/

https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html

https://www.pwc.ch/en/insights/fs/10-pitfalls-when-implementing-grc-technology-and-how-to-avoid-them.html

https://www.oxial.com/all/how-to-go-about-choosing-your-grc-solution/

Why do we need a GRC tool?

https://resilience.acoss.org.au/the-six-steps/managing-your-risks/risk-register

What are our business goals? (to make money... :D )

Are we mature enough to be measuring ourselves?

How can we use this to be more efficient?

https://www.standardfusion.com/blog/the-future-of-grc-7-things-to-look-out-for/

Centralized Controls. ...
Support for Future Standards. ...
Automation
Integrations (my add… helpdesk integrations, 3rd party)
Scalability. ...
Customizable Reporting. ...
Flexibility. ...
Task Delegation

GRC tool use in other areas

IT - makes more informed budget decisions, determines directions in business goals, asset mgmt

Finance - Make better financial decisions, profitability

Infosec- vuln mgmt,

Compliance

HR - determine hiring requirements

Legal - ensures ethical management of the organization, reduces breach,

How do you implement GRC?

https://www.crowe.com/insights/6-steps-for-a-successful-grc-implementation

Step 0: everyone's input and use cases
Determine the total value gained by using a centralized GRC platform
1. Missing data
2. Duplicate processes
3. Duplicate data
4. Manual steps that can be removed or automated
5. Workflows to assist heavily manual areas such as communications, emails, approvals, and reporting
Identify operational gaps to prioritize the areas you need to improve.
Get your team on board with an effectively communicated plan.
Build a strong foundation to support your GRC program
Deploy a standardized GRC implementation across the board.
Let the GRC framework evolve and grow after it's implemented.

2021-034-Khalilah Scott, good GRC tool practices - part1 Sep 29, 2021

Show notes

GRC tools (Governance Risk and Compliance)

@ki_twyce_

@TechSecChix

INfosec unplugged

Security Happy Hour

Eric's cyberpoppa show

Cyber Insight show - cohost

Blumira is hiring

https://www.blumira.com/careers/

https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html

https://www.pwc.ch/en/insights/fs/10-pitfalls-when-implementing-grc-technology-and-how-to-avoid-them.html

https://www.oxial.com/all/how-to-go-about-choosing-your-grc-solution/

Why do we need a GRC tool?

https://resilience.acoss.org.au/the-six-steps/managing-your-risks/risk-register

What are our business goals? (to make money... :D )

Are we mature enough to be measuring ourselves?

How can we use this to be more efficient?

https://www.standardfusion.com/blog/the-future-of-grc-7-things-to-look-out-for/

Centralized Controls. ...
Support for Future Standards. ...
Automation
Integrations (my add… helpdesk integrations, 3rd party)
Scalability. ...
Customizable Reporting. ...
Flexibility. ...
Task Delegation

GRC tool use in other areas

IT - makes more informed budget decisions, determines directions in business goals, asset mgmt

Finance - Make better financial decisions, profitability

Infosec- vuln mgmt,

Compliance

HR - determine hiring requirements

Legal - ensures ethical management of the organization, reduces breach,

How do you implement GRC?

https://www.crowe.com/insights/6-steps-for-a-successful-grc-implementation

Step 0: everyone's input and use cases
Determine the total value gained by using a centralized GRC platform
1. Missing data
2. Duplicate processes
3. Duplicate data
4. Manual steps that can be removed or automated
5. Workflows to assist heavily manual areas such as communications, emails, approvals, and reporting
Identify operational gaps to prioritize the areas you need to improve.
Get your team on board with an effectively communicated plan.
Build a strong foundation to support your GRC program
Deploy a standardized GRC implementation across the board.
Let the GRC framework evolve and grow after it's implemented.

2021-033-Kim_Crawley, 8 steps to better security-Part2 Sep 20, 2021

Show notes

8 Steps to Better Security: A Simple Cyber Resilience Guide to Business is done all final editing and will be published by @WileyTech on October 5th.

Pre-orders are available now via Amazon, Barnes & Noble, and other retailers.

Sponsored Link: https://amzn.to/3k3pDAN

Amazon teaser: "Harden your business against internal and external cybersecurity threats with a single accessible resource.

In 8 Steps to Better Security: A Simple Cyber Resilience Guide for Business, cybersecurity researcher and writer Kim Crawley delivers a grounded and practical roadmap to cyber resilience in any organization. Offering you the lessons she learned while working for major tech companies like Sophos, AT&T, BlackBerry Cylance, Tripwire, and Venafi, Crawley condenses the essence of business cybersecurity into eight steps.

Written to be accessible to non-technical businesspeople as well as security professionals, and with insights from other security industry leaders, this important book will walk you through how to:

Foster a strong security culture that extends from the custodial team to the C-suite
Build an effective security team, regardless of the size or nature of your business
Comply with regulatory requirements, including general data privacy rules and industry-specific legislation
Test your cybersecurity, including third-party penetration testing and internal red team specialists

Perfect for CISOs, security leaders, non-technical businesspeople, and managers at any level, 8 Steps to Better Security is also a must-have resource for companies of all sizes, and in all industries.

"

Related Podcasts