Hacked Off

Latest Episodes:

078. Alyssa Miller: Threat Modelling and DevSecOps Oct 22, 2020

Show notes

Threat modelling is broader than just security, and DevSecOps is more than just secure code. Application Security Advocate, Alyssa Miller talks passionately about the importance of a collaborative approach to security, where implementing a culture of building efficiently and understand security as you go, can help with getting ahead of the game. 0'22 Alyssa Miller - the Application Security Advocate 2'20 What is threat modelling? 4'32 Where do you begin with threat modelling? 9'45 Continuous improvement - being more secure tomorrow than we are today! 13'39 The user story 19'32 It's not about WHO is hacking you, but WHAT they're hacking 23'04 Monitor, mitigate and protect 27'45 Implementing threat modelling into DevSecOps to make security more efficient Alyssa's Social Media: https://twitter.com/AlyssaM_InfoSec https://www.linkedin.com/in/alyssam-infosec/ https://alyssasec.com/ Listening Time: 38 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma Guest: Alyssa Miller, Application Security Advocate at Snyk

077. Keeping Mobile Devices Secure Oct 15, 2020

Show notes

Mobile Device Management increases security, reduces risk and plays an important role in Government certified assurance models. Holly Grace discusses the role of device management for Cyber Essentials, and the challenges that come with employees using their own devices at work. Key points: 1'08 What is Mobile Device Management (MDM)? 3'05 Device Management for Cyber Essentials 8'27 Bring your own device (BYOD) 11'30 Passwords, pass codes and pin numbers Listening Time: 14 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma

076. Joe Thorpe: Hacking Mobile Apps Oct 08, 2020

Show notes

We speak to fellow co-worker and Senior Security Consultant at Secarma, Joe Thorpe, who specialises in app testing. He gives us the low down on hacking mobile apps, how they're similar to web apps, which vulnerabilities are most common and how to choose the right testing for your mobile app. Key points: 0'43 What is mobile application testing? 3'43 Similarities to web application testing 4'49 Finding vulnerabilities in mobile apps 7'21 Hacking mobile apps with Frida and bypassing root detection 9'33 Choosing the right kind of testing for you mobile app 13'09 The Tinder app vulnerability 14'48 The most common vulnerabilities Useful links: Mobile App OWASP Top 10 - https://owasp.org/www-project-mobile-top-10/ Mobile Application Testing - https://www.secarma.com/services/penetration-testing/mobile-application-penetration-testing.html Listening Time: 17 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma Guest: Joe Thorpe, Senior Security Consultant at Secarma

075. Month in Review: Cyber Attacks aren't always Financially Motivated! Oct 01, 2020

Show notes

In September's Month in Review, Holly Grace is delighted to announce that this month's hacks aren't just all about ransomware! From political motivation to notoriety, she discusses the different kind of motives a hacker may have, and the kind of attacks they might use to get what they want. Key Points: 0'55 Financially Motivated: KuCoin Hack 3'07 Insider Threat: AT&T Hack 7'09 Politically Motivated: Op Payback 12'00 Different types of attacks Listening Time: 16 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma

074. Martin Lethbridge: There’s more to Firewalls than Blocking Packets Sep 24, 2020

Show notes

There's more to firewalls than simply installing them and leaving them to it! WatchGuard's Senior Sales Engineer Martin Lethbridge, joins Holly Grace Williams to discuss common firewall misconceptions, and how to get the most out of your firewall to ensure your organisation is safe. 0'22 Guest introduction 2'10 Firewall misconceptions - they aren't just for your network perimeter 6'52 Protecting your laptop on 'dirty networks' - working from home or remotely 11'59 Security vs convenience 17'43 The importance of VLAN and network segmentation 19'45 Don't just block it, monitor it, review it, maintain it 26'53 Deep packet inspection 38'41 Why you need to update your firewall 41'47 What you need to do when you go back to the office after lockdown Useful links: Martin's LinkedIn - https://www.linkedin.com/in/martinlethbridge/ Watchguard - https://www.guardsite.co.uk/ Firewall Configuration Security Review - https://www.secarma.com/services/cybersecurity-assessment/firewall-configuration-security-review.html Listening Time: 57 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma Guest: Martin Lethbridge, Senior Sales Engineer at Watchguard

073. Vulnerabilities in Firewalls Sep 17, 2020

Show notes

Although perimeter breaking vulnerabilities are quite rare they're certainly not unheard of - Firewalls aren't perfect systems and they can have vulnerabilities too. In this week's episode, Holly Grace looks at some previous critical vulnerabilities in firewalls and tries to highlight some key lessons learned. 4'37 The firewall vulnerability 'BEIGNCERTAIN' 7'22 Protecting your organisation against threat actors gaining internal network access 10'47 How to protect firewall interface Useful link: Firewall Configuration Security Review - www.secarma.com/services/cybersec…urity-review.html Listening time: 14 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma

072. An Intro: Firewall Security Sep 10, 2020

Show notes

Our latest 'Intro' podcast takes a look at Firewall Security. Holly discusses different types of firewalls, the importance of network segmentation and Firewall Configuration Security Reviews, and how firewalls are targeted during a pentest. 1'30 How firewalls are they targeted during a Penetration Test? 8'29 Network segmentation 11'08 How threat actors jump between networks 13'56 Next Generation Firewalls 19'14 Web Application Firewalls Useful links: Firewall Configuration Security Review - https://www.secarma.com/services/cybersecurity-assessment/firewall-configuration-security-review.html Listening time: 24 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma

071. Month In Review: Bribery & Bug Bounties Sep 03, 2020

Show notes

From bribery to bug bounties! In August's Month in Review podcast, Holly Grace discusses the failed social engineering attack on a Tesla employee, and the uproar off the back of Slack's minimal payout to a researcher for a critical security bug. Key points: 1'20 The failed social engineering attack against Tesla 3'05 How to test your organisation against bribery 8'21 Critical security bug discovered through Slack's bug bounty program 10'06 How much is a bug worth? Let us know your thoughts on the Slack Bug Bounty over social media: Twitter - @Secarma LinkedIn - @Secarma Ltd Listening time: 15 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma

070. How Vulnerability Scanners Work Aug 27, 2020

Show notes

Whilst Secarma perform Penetration Testing which is in-depth approach to security testing, organisations can get additional assurance through ongoing automated security scanning Nick Blundell, AppCheck's Head of R&D, joins us on our podcast to discuss how vulnerability scanners work, their pros and cons, and how they compliment Penetration Testing to achieve a balance of depth and frequency. 0'20 Nick's background 2'00 How do you map web applications? 4'52 How do scanners work 22'29 Making scanners more intelligent 28'02 Penetration Testing plus Vulnerability Scanning 30'52 Why is automated scanning hard? 53'17 How does a scanner handle authentication? Useful links: https://www.secarma.com/services/cybersecurity-assessment/vulnerability-scanning.html Listening Time: 1 hour Hosted by: Holly Grace Williams, Managing Director at Secarma Guest: Nick Blundell, Head of R&D at AppCheck

069. An Introduction to the OWASP Top 10 Aug 20, 2020

Show notes

The OWASP Top 10 is a list of the 10 most common web application vulnerabilities. This podcast provides an introduction to this awareness document, and why it's so beneficial to organisations and their journey to better security. Key Points: 1'00 Who are the Open Web Application Security Project? 2'18 What is the OWASP Top 10? 7'55 The current OWASP Top 10 list 9'04 Why it's such a useful document 10'19 Other 'Top 10' lists 11'27 The OWASP Top 10 isn't the be all and end all! Listening time: 17 minutes Hosted by: Holly Grace Williams, Managing Director at Secarma

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected