BrakeSec Education Podcast - TopPodcast.com

View Top 200 Chart

Back to Rankings Page

BrakeSec Education Podcast — News
BrakeSec Education Podcast

A podcast about the world of Cybersecurity, Privacy, Compliance, and Regulatory issues that arise in today’s workplace. Co-hosts Bryan Brake, Brian Boettcher, and Amanda Berlin teach concepts that aspiring Information Security professionals need to know, or refresh the memories of seasoned veterans.

Copyright: © Copyright 2019. All rights reserved

Latest Episodes:

SPONSOR: Blumira's Patrick Garrity Sep 16, 2021

Show notes

Blumira-

Per crunchbase:"Blumira's end-to-end platform offers both automated threat detection and response, enabling organizations of any size to more efficiently defend against cybersecurity threats in near real-time. It eases the burden of alert fatigue, complexity of log management and lack of IT visibility. Blumira's cloud SIEM can be deployed in hours with broad integration coverage across cloud, endpoint protection, firewall and identity providers including Office 365, G Suite, Crowdstrike, Okta, Palo Alto, Cisco FTD and many others."

Contact sales@blumira.com

Patrick Garrity, VP of Operations.

Patrick has years of experience in the security industry building and scaling usable security products. He currently leads Blumira's product, sales and marketing teams. Prior to joining Blumira, he led sales engineering, product marketing and international expansion for Duo Security.

Twitter = @Thisisnottap

https://www.ibm.com/cloud/blog/top-5-advantages-of-software-as-a-service

https://www.outsource2india.com/software/articles/software-as-a-service.asp

5 Advantages of SaaS

Reduced time to benefit. Software as a service (SaaS) differs from the traditional model because the software (application) is already installed and configured. ...

Lower costs. ...

Scalability and integration. ...

New releases (upgrades) ...

Easy to use and perform proof-of-concepts.

5 Disadvantages of SaaS

Insufficient Data Security.

SaaS-based application model.

Difficulty with Regulations Compliance.

Cumbersome Data Mobility.

Low Performance.

Troublesome Software Integration.

Limit Attack Surface

https://www.wallix.com/blog/top-10-ways-to-limit-attack-surface

https://www.okta.com/identity-101/what-is-an-attack-surface/

https://securityscorecard.com/blog/what-is-cyber-attack-surface-management

2021-032--Author_Kim_crawley-8-Simple_Rules_for_Cybersecurity Sep 14, 2021

Show notes

8 Steps to Better Security: A Simple Cyber Resilience Guide to Business is done all final editing and will be published by @WileyTech on October 5th.

It is available now via Kindle.

Pre-orders are available now via Amazon, Barnes & Noble, and other retailers.

Sponsored Link: https://amzn.to/3k3pDAN

Amazon teaser: "Harden your business against internal and external cybersecurity threats with a single accessible resource.

In 8 Steps to Better Security: A Simple Cyber Resilience Guide for Business, cybersecurity researcher and writer Kim Crawley delivers a grounded and practical roadmap to cyber resilience in any organization. Offering you the lessons she learned while working for major tech companies like Sophos, AT&T, BlackBerry Cylance, Tripwire, and Venafi, Crawley condenses the essence of business cybersecurity into eight steps.

Written to be accessible to non-technical businesspeople as well as security professionals, and with insights from other security industry leaders, this important book will walk you through how to:

Foster a strong security culture that extends from the custodial team to the C-suite
Build an effective security team, regardless of the size or nature of your business
Comply with regulatory requirements, including general data privacy rules and industry-specific legislation
Test your cybersecurity, including third-party penetration testing and internal red team specialists

Perfect for CISOs, security leaders, non-technical businesspeople, and managers at any level, 8 Steps to Better Security is also a must-have resource for companies of all sizes, and in all industries.

2021-031- back in the saddle, conference discussion, company privacy Sep 03, 2021

Show notes

"bel paese, ma più caldo del buco del culo di Satana"

https://www.theverge.com/22648265/apple-employee-privacy-icloud-id

https://mysudo.com/

https://arstechnica.com/information-technology/2021/09/npm-package-with-3-million-weekly-downloads-had-a-severe-vulnerability/

https://www.bleepingcomputer.com/news/security/bluetooth-braktooth-bugs-could-affect-billions-of-devices/

www.infoseccampout.com

www.log-md.com

@infosystir

@bryanbrake

@brakesec

@hackershealth

@boettcherpwned

2021-030-incident response, business goal alignment, showing value in IR -p2 Aug 22, 2021

Show notes

https://blog.teamascend.com/6-phases-of-incident-response

https://www.securitymetrics.com/blog/6-phases-incident-response-plan

Recent vulnerabilities got Bryan thinking about incident response.

Are organizations speedy enough to keep up?

If the spate of vulns continue, what can we do to ensure we are dealing with the most important issues?

How do we communicate those issues to management?

How should we handle the workload?

Testing of your IR costs money, do you have budget for that? (verodin, red-team)

Restoring backups, extra VPC or azure environment

Incidents occur

You have to minimize issues, right? But is there a good way of doing that?

Simplify your environment?

Spend time working on the CIS 20? You gotta plan for that and show value vs effort.

Incident response is an ever changing landscape.

What is the goal of IR?

Minimize damage

Identify affected systems

Recover gracefully and quickly?

Does your environment allow for quick recovery?

What does 'return to normal' look like?

The goal of business

Make money

Incidents should just be considered part of doing business (risks)

The more popular, the more likely the attack

Incident timeframe = criteria for getting back to normal.

PICERL is a cycle, and one of continual improvement. Incident response is not 'one and done'.

2021-029- incident response, PICERL cycle, showing value in IR, aligning with business goals -p1 Aug 15, 2021

Show notes

https://blog.teamascend.com/6-phases-of-incident-response

https://www.securitymetrics.com/blog/6-phases-incident-response-plan

Recent vulnerabilities got Bryan thinking about incident response.

Are organizations speedy enough to keep up?

If the spate of vulns continue, what can we do to ensure we are dealing with the most important issues?

How do we communicate those issues to management?

How should we handle the workload?

Testing of your IR costs money, do you have budget for that? (verodin, red-team)

Restoring backups, extra VPC or azure environment

Incidents occur

You have to minimize issues, right? But is there a good way of doing that?

Simplify your environment?

Spend time working on the CIS 20? You gotta plan for that and show value vs effort.

Incident response is an ever changing landscape.

What is the goal of IR?

Minimize damage

Identify affected systems

Recover gracefully and quickly?

Does your environment allow for quick recovery?

What does 'return to normal' look like?

The goal of business

Make money

Incidents should just be considered part of doing business (risks)

The more popular, the more likely the attack

Incident timeframe = criteria for getting back to normal.

PICERL is a cycle, and one of continual improvement. Incident response is not 'one and done'.

2021-028-Rebekah Skeete - social engineering techniques and influences Aug 08, 2021

Show notes

BlackGirlsHack was created to share knowledge and resources to help black girls and women breakthrough barriers to careers in information security and cyber security. The vision for Black Girls Hack (BGH) is to provide resources, training, mentoring, and access to black girls and women and increase representation and diversity in the cyber security field and in the executive suites.

Rebekah Skeete CyberBec @rebekahskeete

Tennisha Martin ~@misstennish

https://blackgirlshack.org/

https://www.twitter.com/blackgirlshack - black girls hack

https://www.twitter.com/thefluffy007 - jasmine jackson

Background

https://hitz.com.my/trending/trending-on-hitz/people-that-walk-fast-are-reported-to-be-less-happ

Vegas conference - Blacks in Cyber Village

https://forum.defcon.org/node/236946

https://www.blacksincyberconf.com/bic-village

https://www.youtube.com/c/BlacksInCybersecurity

https://www.blacksincyberconf.com/ctf

https://www.marketwatch.com/story/retired-black-nfl-players-and-their-families-call-for-race-norming-practice-to-end-01621018741

https://en.wikipedia.org/wiki/Blind_men_and_an_elephant

https://fuzzcon.forallsecure.com/

https://www.dianainitiative.org/

Social Engineering topics

Misophonia - or phonophobic

https://www.washingtonpost.com/national/health-science/misophonia-is-a-newly-identified-condition-for-people-hypersensitive-to-sound/2014/12/01/7c392782-69ba-11e4-a31c-77759fc1eacc_story.html

https://thecyberwire.com/podcasts/8th-layer-insights

https://terranovasecurity.com/examples-of-social-engineering-attacks/

How all either are directly influenced by.

News, and cool links to read.

https://chubk.com/youtuber-who-specializes-in-unmasking-scammers-ended-up-being-tricked-even-deleting-his-own-youtube-channel/ -LOL

SE write-up of a legitimate company (archive.org)

https://web.archive.org/web/20190124114926/https://medium.com/@0xf3d/dissecting-arbitraging-co-in-depth-youve-been-scammed-again-21306de00fe5

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-027-Black Girls Hack COO Rebekah Skeete! Aug 02, 2021

Show notes

BlackGirlsHack was created to share knowledge and resources to help black girls and women breakthrough barriers to careers in information security and cyber security. The vision for Black Girls Hack (BGH) is to provide resources, training, mentoring, and access to black girls and women and increase representation and diversity in the cyber security field and in the executive suites.

Rebekah Skeete CyberBec @rebekahskeete

Tennisha Martin ~@misstennish

https://blackgirlshack.org/

https://www.twitter.com/blackgirlshack - black girls hack

https://www.twitter.com/thefluffy007 - jasmine jackson

Background

https://hitz.com.my/trending/trending-on-hitz/people-that-walk-fast-are-reported-to-be-less-happ

Vegas conference - Blacks in Cyber Village

https://forum.defcon.org/node/236946

https://www.blacksincyberconf.com/bic-village

https://www.youtube.com/c/BlacksInCybersecurity

https://www.blacksincyberconf.com/ctf

https://www.marketwatch.com/story/retired-black-nfl-players-and-their-families-call-for-race-norming-practice-to-end-01621018741

https://en.wikipedia.org/wiki/Blind_men_and_an_elephant

https://fuzzcon.forallsecure.com/

https://www.dianainitiative.org/

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-026-Triaging threat research, Jira vulns, Serious Sam vuln, Systemd vulns, and HiveNightmare Jul 28, 2021

Show notes

https://www.mindtools.com/pages/article/newHTE_95.htm

https://www.infoq.com/news/2021/07/microsoft-linux-builder-mariner/

https://www.productplan.com/glossary/action-priority-matrix/

More PrintNightmare issues: https://www.bleepingcomputer.com/news/microsoft/windows-10-july-security-updates-break-printing-on-some-systems/

""After installing updates released July 13, 2021 on domain controllers (DCs) in your environment, printers, scanners, and multifunction devices that are not compliant with section 3.2.1 of RFC 4556 spec might fail to print when using smart card (PIV) authentication," Microsoft explained."

https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/

"Shlayer, discovered in 2018, is constantly maintained and also evolving. The graph below is representative of Shlayer continually being a go-to piece of malware that attackers use to compromise the victim's machine. We observed an uptick in Shlayer detections occurring before the release of CVE-2021-30657 (the Gatekeeper bypass) that was being exploited by Shlayer. This vulnerability was subsequently patched on April 26, 2021."

https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/

https://access.redhat.com/security/cve/cve-2021-33910

"It works by enabling attackers to misuse the alloca() function in a way that would result in memory corruption. This, in turn, allows a hacker to crash systemd and hence the entire operating system. Practically speaking, this can be done by a local attacker mounting a filesystem on a very long path. This causes too much memory space to be used in the systemd stack, which results in a system crash." There's no way to remedy this problem. While it's not present in all current Linux distros, you'll find it in most distros such as the Debian 10 (Buster) and its relatives like Ubuntu and Mint. Therefore, you must, if you value keeping your computers working, patch your version of systemd as soon as possible. You'll be glad you did.

https://www.bleepingcomputer.com/news/security/atlassian-asks-customers-to-patch-critical-jira-vulnerability/

https://redmondmag.com/articles/2021/07/21/serioussam-windows-flaw.aspx

https://securityaffairs.co/wordpress/120576/security/apple-cve-2021-30807-zero-day.html?

https://github.com/GossiTheDog/HiveNightmare

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-025-Dan Borges, Author of Adversarial Techniques from Packt Publishing Jul 19, 2021

Show notes

Dan Borges - Author @1njection

Buy the book on Amazon: https://www.amazon.com/Adversarial-Tradecraft-Cybersecurity-real-time-computer-ebook-dp-B0957LV496/dp/B0957LV496?_encoding=UTF8&me=&qid=&linkCode=ll1&tag=bdspod-20&linkId=8f2daf0b3563cbbc2cee6a2d2138149d&language=en_US&ref_=as_li_ss_tl

https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/amp/

Cool near real time updates on the hack: https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident

https://twitter.com/DAlperovitch/status/1412033278081708034

https://github.com/ahhh/Cybersecurity-Tradecraft/tree/main/

https://www.amazon.com/Network-Attacks-Exploitation-Matthew-Monte/dp/1118987128

https://en.wikipedia.org/wiki/Best_response

https://labs.bishopfox.com/tech-blog/sliver

https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164

Www.Globalcptc.org

Virtual CCDC:

How easy was the process working with Packt?

Did they approach you or vice versa?

5 D's of Physical Security

The five D's of security seek to do one or more of the following: Deter, Detect, Delay, Deny and Defend.

https://www.securitymagazine.com/articles/82833-the-5-ds-of-outdoor-perimeter-security

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-024-Dan Borges, Author of Adversarial Techniques from Packt Publishing Jul 10, 2021

Show notes

Dan Borges - Author @1njection

Buy the book on Amazon: https://www.amazon.com/Adversarial-Tradecraft-Cybersecurity-real-time-computer-ebook-dp-B0957LV496/dp/B0957LV496?_encoding=UTF8&me=&qid=&linkCode=ll1&tag=bdspod-20&linkId=8f2daf0b3563cbbc2cee6a2d2138149d&language=en_US&ref_=as_li_ss_tl

https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/amp/

Cool near real time updates on the hack: https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident

https://twitter.com/DAlperovitch/status/1412033278081708034

https://github.com/ahhh/Cybersecurity-Tradecraft/tree/main/

https://www.amazon.com/Network-Attacks-Exploitation-Matthew-Monte/dp/1118987128

https://en.wikipedia.org/wiki/Best_response

https://labs.bishopfox.com/tech-blog/sliver

https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164

Www.Globalcptc.org

Virtual CCDC:

How easy was the process working with Packt?

Did they approach you or vice versa?

5 D's of Physical Security

The five D's of security seek to do one or more of the following: Deter, Detect, Delay, Deny and Defend.

https://www.securitymagazine.com/articles/82833-the-5-ds-of-outdoor-perimeter-security

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

#AmazonMusic: https://brakesec.com/amazonmusic

#Spotify: https://brakesec.com/spotifyBDS #Pandora: https://brakesec.com/pandora

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel: http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site: https://brakesec.com/bdswebsite

#iHeartRadio App: https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: bds.podcast@gmail.com

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Related Podcasts