Hacked Off

Latest Episodes:

018. Your Security Awareness Training isn't Working Jun 06, 2019

Show notes

Just 27% of businesses in the UK reported that staff had attended internal or external training on cybersecurity in the last 12 months* and more often than not, what is being taught is either incomplete or no longer relevant. This talk, which our Technical Director Holly Grace Williams presented at InfoSecurity Europe, discusses the miseducation of cybersecurity aspects such as physical security, phishing and malicious websites and why trying to oversimplify security is a part of the problem. Key points: 2’11 Physical access isn’t just tailgating 10’02 ‘Diffused responsibility’ lowers the chance of a challenge 16’49 Phishing isn’t just emails 19’15 HTTPS doesn’t stop phishing 21’19 Identifying suspicious links 23’00 Cross-site scripting 29’29 Password cracking *https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/791940/Cyber_Security_Breaches_Survey_2019_-_Main_Report.PDF Download on iTunes: apple.co/2Ji61Ek Listening time: 36 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

017. Equifax Breach: The Inside Story May 30, 2019

Show notes

In 2017 Equifax, one of the largest credit agencies in the world, became the victim of a major breach resulting in over 150 million records being stolen. In this podcast we speak to Graeme Payne, the CIO of Equifax during their breach about the lessons learnt and his personal experience. 0’48 Graeme Payne, guest introduction 3’48 The timeline of the Equifax breach 6’47 How incident planning can help businesses be better prepared for a breach 10’13 Announcing a breach – The lessons learnt from disclosing a major hack 16’04 How do you get the board more interested in security? 19’14 Is there a benefit for organisations to have a CISO? 26’03 How organisations can ensure they are covering all cybersecurity bases 27’33 Personal experience of a breach 37’16 The aftermath Download on iTunes: apple.co/2Ji61Ek Listening time: 44 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma Guest: Graeme Payne, Cybersecurity Executive Advisor and former CIO of Equifax

016. An Intro: A Checklist for Security May 23, 2019

Show notes

Looking to take the first steps to ensuring your business is secure but not sure where to start? Holly Grace takes a fresh look at some basic, fundamental security steps that every business should be adopting. Highlights include: 0’53 Software updates 2’08 Passwords 4’06 Network Segmentation 5’40 Manage out of band 6’26 If you don’t need it, disable it! 8’58 Pre-shared keys 10’09 Network access control 11’15 Credential stuffing 12’50 Restrict user input 15’01 Trust but verify! Download on iTunes: apple.co/2Ji61Ek Listening time: 19 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

015. An Intro: The Stages of Penetration Testing May 16, 2019

Show notes

We’ve previously discussed the difference between Penetration Testing and Red Teaming, so in this episode we delve a little deeper into the different stages of PenTesting. For organisations who are considering this security assessment, it’s is an excellent starting point to better understand the process. The discussion includes: 2’00 What is a Penetration Test? 3’02 How is it performed? 5’03 An example of a vulnerability: SQL Injection 6’52 What kind of vulnerabilities do we look for? The OWASP top ten* 8’07 What we do when we find a vulnerability 11’50 Reporting after a penetration test *https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project Download on iTunes: apple.co/2Ji61Ek Listening time: 15 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

014. An Intro: Hardware Hacking May 09, 2019

Show notes

The ‘Internet of Things’ is evolving fast and more and more companies are seeing the value it can bring by increasing business productivity and efficiency. However, adding IOT devices to a company can increase security vulnerabilities in a way that businesses might not have considered. We take a look at hardware hacking as an aspect of penetration testing and how IoT can affect an organisation's security. Key points discussed include: 0’28 Hardware hacking as an aspect of penetration testing 2’31 How you perform hardware testing 07’05 Why should your company be concerned about hardware hacking? 8’58 How is this different to traditional testing? Download on iTunes: apple.co/2Ji61Ek Listening time: 12 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

013. An Intro: Cloud Security Testing May 02, 2019

Show notes

Cloud computing offers many benefits, such as scalability and elasticity; but with new technologies and terminologies some companies worry about the security implications. In this week's episode Holly Grace gives us an intro to Cloud Security Testing perspectives. Here's what she covers: 0’52 Perspectives when looking at Cloud hosted systems 3’15 Where are things the same? 4’41 Where do we start in terms of Cloud security? 6’10 What should we have tested? 6’38 When Cloud has gone wrong! NCSC Cloud Security Guidance: https://www.ncsc.gov.uk/collection/cloud-security Download on iTunes: apple.co/2Ji61Ek Listening time: 11 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

012. An Intro: Is a bug bounty program right for your business? Apr 25, 2019

Show notes

In 2018 it was reported that there had been a 36% increase in total bug bounty payouts*, but does this mean this kind of security testing is best for your business? We take a look at the pros and cons of bug bounty programs and how it compares to penetration testing. Key points include: 1’13 A brief definition of penetration testing and bug bounties 1’53 How the costing works 3’05 The difference between a penetration test and a bug bounty 6’46 The difficulty with reporting bug bounties 7’42 The negatives and positives of the output of both pen testing and bug bounties 9’36 The time Uber was held to ransom by a bug hunter! 14’32 Summary * https://www.bugcrowd.com/resource/2018-state-of-bug-bounty-report/ Download on iTunes: apple.co/2Ji61Ek Listening time: 17 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

011. An Intro: Social Engineering and Physical Access Apr 18, 2019

Show notes

Security risks aren’t always found through vulnerability scanning and hacking. Holly Grace talks us through how physical access testing and social engineering can be used to demonstrate security risks in a target organisation. This introduction to social engineering talks about how these assessments are performed and their benefits, through some funny on-the-job stories. 1’43 What is social engineering? 3’25 Three common Phishing attacks 7’00 Training staff to recognise the signs of a social engineering 15’40 What is physical access? 17’13 How physical access assessments are performed 28’18 The time Holly got stopped by a security guard! Download on iTunes: apple.co/2Ji61Ek Listening time: 32 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

010. An Intro: Becoming a Penetration Tester Apr 11, 2019

Show notes

We’re often asked about the career pathway to becoming an ethical hacker, or penetration tester. So, we thought it would be best to let a current penetration tester share her thoughts on working in the industry. Whether you’re interested in penetration testing, computer science or security in general, Holly Grace's intro to becoming a penetration tester is packed full of tips you can use when getting started in cybersecurity. 1’00 What is a penetration tester? 1’35 What makes a good candidate? 4’10 Paths into pentesting. 5’00 Practising pentesting 6’36 Do I need programming skills? 7’30 The benefits of attending security conferences 8’36 Exams and certifications Useful links: Damn vulnerable web app http://www.dvwa.co.uk/ Download on iTunes: apple.co/2Ji61Ek Listening time: 12 minutes For more information, follow us on Twitter @secarma or @secarlabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

009. An Intro: Penetration Testing vs Red Teaming Apr 04, 2019

Show notes

You’ve probably heard of the term ‘penetration testing’ and ‘red teaming’, but are you clear about what they really mean? Our Principal Security Consultant, Holly Grace Williams talks us through the difference between these two security tests, elaborating why you’d choose them, how they work and the benefits of each one. 1’44 What is penetration testing? 3’55 What is a Red Team engagement? 7’42 Summary Download on iTunes: apple.co/2li61Ek Listening time: 9 minutes For more information, follow us on Twitter @secarma or @secarmalabs or email us at podcast@secarma.com Hosted by: Holly Grace Williams, Technical Director at Secarma

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected