Hacked Off

Latest Episodes:

058. Starting Security From Scratch Apr 23, 2020

Show notes

Many security guides out there presume that you're implementing security on an existing system or an existing product; look at what has been missed and improving things incrementally - but what if you're building something completely new? If it's a new product or a new company, things can be a different. When you're struggling with security many experts will tell you that you should have started sooner - but where exactly do you start? You can't PenTest a product before you've written your first line of code, so what should you do first? It's difficult to fit it all in without making an episode that goes on for days - but in today's episode Holly Grace looks at some of the common aspects to security starting with design and building up to implementation, and response. Key Points: 2'35 Testing too late makes it harder 4'15 Design, Implementation, and Protection 5'30 Security Policy: Updates, Passwords, and Authentication 6'45 Awareness Training: Why the policy is that way 10'42 Policies and Implementation not matching 15'10 How frequently should you Pen Test? 19'05 Response: Logs, Alert, and Hunting Links Secarma's Cybersecurity Maturity Assessment - https://www.secarma.com/services/cybersecurity-assessment/maturity-assessment.html NIST Cybersecurity Framework - https://www.nist.gov/cyberframework NCSC Cyber Assessment Framework - https://www.ncsc.gov.uk/collection/caf/cyber-assessment-framework Listening Time: 24 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

057. Lockdown: Final Apr 16, 2020

Show notes

In this episode we follow up on recent news events including the Travelex Ransom payment, fraud linked to Covid-19, and US-Cert Guidance on the cyber risks from North Korea - plus Secarma announce a Charity Support Fund. Key Points: 2'45 Travelex: Paying the Ransom 4'28 Business Continuity and Getting Through Lockdown 5'25 FTC report on Covid-19 Fraud 8'35 Blurring nation states and organised crime 11'10 Cryptojacking Attacks and the ICO 13'33 Extortion Campaigns 16'43 Charity Support Fund Links Charity Support Fund: https://blog.secarma.com/charity-support-fund.html US-Cert Guidance: https://www.us-cert.gov/sites/default/files/2020-04/DPRK_Cyber_Threat_Advisory_04152020_S508C.pdf FTC Report: https://www.ftc.gov/system/files/attachments/coronavirus-covid-19-consumer-complaint-data/covid-19-daily-public-complaints.pdf Listening time: 19 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

056. Lockdown: Part 3 Apr 09, 2020

Show notes

We look into the importance of protecting user privacy and the difficulty of anonymising data - both in regards to COVID19 as well as broadly for businesses. Key Points: 0'45 The benefits of location-tracking 3'15 The risks of location tracking 6'36 Reducing risk through pseudonymisation 10'07 The risk of sharing data 12'00 Balancing benefit and protection 14'10 The 5 Data protection questions Listening time: 20 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

055. Lockdown: Part 2 Apr 02, 2020

Show notes

In Lockdown Episode 2 we're talking about video conferencing vulnerabilities, staff complacency, and security awareness risks brought on by job role changes. Key Points: 2'00 Zoom under security researcher scrutiny 6'03 Stealing passwords from video-conferences 9'30 Network architecture and working from home 13'05 Staff complacency and risk 14'35 Job role changes and risk 16'12 Attack surface reduction Listening time: 18 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

054. Lockdown: Part 1 Mar 26, 2020

Show notes

For this episode we're starting a new mini-series, investigating how recent news events are impacting companies; in part 1 we're looking at performing effective internal infrastructure tests, remotely. Key points: 5'08 Assessing VPN security 6'41 Differences with remote testing 8'30 Our (VOT) Virtual Onsite Testing Solution 9'30 Hackers hacking home WiFi 11'00 Making remote-internal testing effective Download on iTunes: apple.co/2Ji61Ek Listening time: 13 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

053. COVID-19: The Impact on Your Business Mar 19, 2020

Show notes

What do you do when a pandemic hits and you are forced to send your entire workforce to work from home? Is your business ready for the technical and security risks that comes with that? What have you missed? COVID-19 is presenting organisations with new challenges and testing their business continuity plans. Holly Grace Williams talks about these challenges and a few things you may not have already considered. 1'58 The challenges of working from home 8'43 The perfect time to be hacked 10,27 Phishing 13'38 Events 16'18 Web traffic Download on iTunes: apple.co/2Ji61Ek Listening time: 18 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

052. An Intro: Wireless Security Mar 12, 2020

Show notes

Secarma's Technical Director, Holly Grace Williams, discusses how threat actors could bypass your wireless security through guest WIFI, pre shared keys, or even enterprise wireless security. She talks about the benefits of network segmentation and how your networks may not be as separate as you think! Key Points: 1'20 Network segmentation 3'38 Technologies to protect wireless networks 5'56 Open wireless networks 11'12 Pre shared keys(PSK) 13'12 Cracking hashes 19'57 Enterprise security Download on iTunes: apple.co/2Ji61Ek Listening time: 25 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

051. The Truth about Cybersecurity Marketing Buzzwords! Mar 05, 2020

Show notes

There seems to be a colour for all the different types of cybersecurity teams these days, but is there any value behind these marketing buzzwords and what do they really mean? Holly Grace Williams takes us through the different 'team' definitions and how to look beyond their colourful names! Key Points: 1'41 The difference between penetration testing and red teaming 3'25 Red Teaming and Blue Teaming 4'13 Purple Teaming 9'04 White Teaming 9'56 Gold Teaming 11'19 Looking past the marketing buzzwords! 14'33 TIBER - Threat intelligence based ethical Red Teaming 16'30 Atomic Red Teaming Download on iTunes: apple.co/2Ji61Ek Listening time: 20 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

050. Month in Review: The Redcar and Cleveland Borough Breach Feb 27, 2020

Show notes

On Saturday 8th February 2020, Redcar & Cleveland Council was hit with, what is thought to be, ransomware. Holly Grace Williams discusses the wider impact of hacking a council, and the brand damage that can come from this kind of attack. Key points: 1'27 What happened to Redcar & Cleveland Council? 1'50 Do people really understand what ransomware is? 4'll The timing of ransomware attacks 6'44 Why restoring from backup is not always as simple as it sounds 8'17 The wider impact of councils being hacked 13'04 Dealing with brand damage from a breach 21'39 How can you have confidence in an organisation's security? Download on iTunes: apple.co/2Ji61Ek Listening time: 26 minutes Hosted by: Holly Grace Williams, Technical Director at Secarma

049. James Mckinlay: Why I turned antivirus off! Feb 20, 2020

Show notes

Is your antivirus working for you? It wasn't for James Mckinlay, the Group Information Security Officer at Barbican Insurance, so he made the controversial decision to switch it off! James discusses why he made this decision and infrastructure he built to replace it. Key points: 1'18 The decision to turn off antivirus 2'35 Alternatives to antivirus 4'10 Application whitelisting 13'28 Cyber Essentials 16'53 To patch or not to patch 23'00 Other things we turned off 34'50 Not everyone should switch their antivirus off! Download on iTunes: apple.co/2Ji61Ek Listening time: 40 minutes Hosted by: Holly Grace Williams | Technical Director at Secarma Guest: James Mckinlay | Group Information Security Officer at Barbican Insurance

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected