Phillip Wylie Show

Latest Episodes:

Marina Ciavatta: From Journalism to Physical Pen Testing & Social Engineering Jan 28, 2025

Show notes

Summary

In this episode of the Phillip Wylie Show, Marina Ciavatta shares her unique journey into the world of physical pen testing and social engineering. From her origins in journalism to her current role as a red teamer, Marina discusses the challenges and experiences she has faced in the field. She shares thrilling stories of her pen tests, including moments of fear and unexpected encounters, while also emphasizing the importance of training and awareness in cybersecurity. Marina provides insights for those looking to enter the field, highlighting the blend of creativity and strategy required for successful penetration testing.

Takeaways

• Marina's journey began with event organizing and content production in cybersecurity.

• Physical pen testing requires a deep understanding of security protocols and ethical considerations.

• Experience in event management can enhance skills in physical pen testing.

• Being caught during a pen test can provide valuable insights into security effectiveness.

• Security guards play a crucial role in preventing unauthorized access.

• Creative approaches, such as using costumes, can aid in infiltration during pen tests.

• Combining social engineering with physical pen testing can yield better results.

• Training and awareness are essential for both red and blue teams in cybersecurity.

• Practicing social engineering ethically can help develop skills without causing harm.

• Marina emphasizes the importance of leaving positive feedback in security reports.

Sound Bites

• "I had to crawl a lot on the floor."

• "Being caught is part of the job."

• "I tend to collect my costumes as I go."

Chapters

00:00 Introduction to Marina's Journey

06:53 Breaking into Cybersecurity: Tips for Newcomers

13:20 Getting Caught: Lessons from the Field

29:55 Combining Social Engineering with Physical Pen Testing

34:37 Training and Ethical Considerations in Social Engineering

Resources

https://www.linkedin.com/in/mciavatta/

https://x.com/MarinaCiavatta

https://linktr.ee/marinaciavatta

Phillip's New Free Penetration Testing Methodology Training on Just Hacking Training

https://www.justhacking.com/uc/uc-penetration-testing-methodology/

Chris Wysopal: From L0pht to Veracode, an OG Hacker's Journey Jan 20, 2025

Show notes

Summary

In this episode of the Phillip Wylie Show, Chris Wysopal, a renowned hacker and cybersecurity expert, shares his journey from his early days of hacking to founding Veracode. He discusses the evolution of hacking culture, the importance of hands-on experience in cybersecurity, and the challenges posed by generative AI in software development. Wysopal emphasizes the need for understanding coding and the risks associated with supply chain security in the ever-evolving landscape of cybersecurity.

Takeaways

• Chris Wysopal's journey into hacking began with a modem in college.

• The hacker culture has evolved from building to breaking into systems.

• Starting Veracode was driven by a passion for application security technology.

• The CTO role is flexible and evolves with the company's needs.

• Hands-on experience is crucial for aspiring cybersecurity professionals.

• Understanding coding is beneficial, but not strictly necessary for cybersecurity roles.

• Supply chain security is a growing concern in the cybersecurity landscape.

• Generative AI is changing the way software is developed and tested.

• Automated tools are essential for managing increased code vulnerabilities.

• Security must be integrated seamlessly into the development process.

Resources

https://www.linkedin.com/in/wysopal/

https://x.com/WeldPond

https://en.wikipedia.org/wiki/Chris_Wysopal

https://www.linkedin.com/company/veracode/

Chapters

00:00 Introduction to Chris Wysopal

07:55 The Evolution of Hacking Culture

15:35 The Role of a CTO and Company Evolution

23:22 Advice for Aspiring Cybersecurity Professionals

29:47 Cybersecurity Risks in 2025

35:03 Generative AI and Its Impact on Security

STÖK: Hacking, Content Creation, and Good Vibes Jan 09, 2025

Show notes

Summary

In this episode of the Phillip Wylie Show, Stök shares his journey from a technical background in infrastructure to becoming a successful bug bounty hunter and content creator. He emphasizes the importance of communication skills in the cybersecurity field, offers tips for aspiring content creators, and discusses the significance of building a personal brand. Stök also highlights the need for balance in life, the value of understanding target needs in bug bounty hunting, and the challenges of dealing with online criticism.

Takeaways

• Stök transitioned from infrastructure to web hacking.

• Communication skills are crucial in bug bounty reporting.

•Content creation can open many professional doors.

• Being authentic helps in building a personal brand.

• Understanding the target's needs is key in bug bounty.

• Balancing hobbies with work is essential for mental health.

• Starting with simple tools is enough for bug bounty beginners.• Automation should aid, not replace manual testing.

• Building a personal brand requires consistency and authenticity.

• Online criticism is common; focus on constructive feedback.

Chapters

00:00 Introduction to Stök and His Journey

01:21 The Allure of Bug Bounty Hunting

06:15 Stök 's Technical Background and Transition to Web Hacking

08:32 The Path to Bug Bounty: A Personal Story

13:48 The Importance of Communication in Bug Bounty

16:57 Content Creation Tips and Building a Personal Brand

22:22 Dealing with Criticism and Haters

29:04 Building an Authentic Personal Brand

32:04 The Importance of Hobbies and Balance

35:39 Getting Started in Bug Bounty Hunting

Resources

https://www.linkedin.com/in/fredrikalexandersson/

https://x.com/stokfredrik

https://www.stokfredrik.com/

Han Kanthi: Han's Journey From Corporate to Startup Jan 08, 2025

Show notes

Summary

In this episode of the Phillip Wylie Show, host Phillip Wylie speaks with Han Kanthi, a seasoned entrepreneur and cybersecurity expert. They discuss Han's journey from the corporate world to starting his own company, the importance of data security, and how AI is transforming the cybersecurity landscape. Han shares insights on building a motivated team, the challenges of sales, and the significance of proactive data security measures in today's digital age.

Takeaways

Han Kanthi has over 25 years of corporate experience before starting his entrepreneurial journey.

The adoption of AI has significantly revamped Han's platform.
Networking and attending smaller conferences can yield better results than larger events.
Proactive data security is crucial in preventing breaches.
Han emphasizes the importance of a motivated and young team in a startup.
Lessons from the corporate world are invaluable for entrepreneurs.
Sales acumen can be developed through networking and experience.
AI is being leveraged for anomaly detection in data security.
The journey of entrepreneurship is challenging but rewarding.
Data security is a critical aspect of cybersecurity that needs attention.

Resources https://www.linkedin.com/in/kanthi/ https://www.linkedin.com/company/kdex-global/ https://www.linkedin.com/company/anciledspm/ http://www.ancile.ai http://www.kdexglobal.com/

Celina Stewart: Demystifying Cyber Risk Management Dec 31, 2024

Show notes

Summary

In this episode of the Phillip Wylie Show, Celina Stewart, Directory of Cyber Risk Management at Neuvik, discusses her journey in cybersecurity, focusing on the often-overlooked area of risk management. She emphasizes the importance of translating technical cybersecurity insights into business language, the need for diverse career paths in the field, and the value of education and certifications. The conversation also covers frameworks for effective risk management, the challenges faced in the industry, and the importance of communication between technical and non-technical teams.

Takeaways

Risk management is essential for understanding business impact.
There is a significant divide between offensive security and risk management.
Non-technical skills can be valuable in cybersecurity roles.
Understanding risk can enhance communication with executives.
Education and certifications are important for a career in risk management.
Familiarity with NIST frameworks is crucial for risk management professionals.
Risk quantification is a specialized skill that is in demand.

Effective communication is key to translating technical findings for business leaders.

Mindset shifts are necessary for executives to embrace risk management.

There are numerous opportunities for diverse backgrounds in cybersecurity.

Sound Bites

"Risk management is crucial in cybersecurity."

"Communication is key in risk management."

"Mindset shifts are needed in risk management."

Resources

https://www.linkedin.com/in/celina-r-stewart/

https://neuvik.com/

SquareX CISO Series: David Malicoat & Vivek Ramachandran Dec 25, 2024

Show notes

Summary

In this episode, Phillip Wylie engages with David Malicoat and Vivek Ramachandran to discuss the evolving role of the Chief Information Security Officer (CISO) in today's cybersecurity landscape. They explore the unique challenges faced by CISOs, particularly in the context of direct marketing and data protection, the impact of AI and automation on security practices, and the limitations of traditional security solutions. The conversation also delves into the future challenges for CISOs and the importance of adapting to new threats in an increasingly digital world.

Takeaways

David Malicoat emphasizes the importance of understanding threats in the context of specific tools.

The browser is becoming a critical endpoint for security measures.

CISOs need to identify and address vulnerabilities among users.
AI and automation are essential for scaling security efforts.
Traditional security solutions often fall short in addressing modern threats.
The demand for effective cybersecurity solutions is continuously increasing.
CISOs must prioritize application security (AppSec) in their strategies.
There is a need for better visibility into user behavior and security risks.
The uptake of SASE solutions has not met expectations in the industry.
Future cybersecurity strategies must focus on browser security and threat detection.

Sound Bites

"The uptake on SASE just hasn't been there."
"I need to understand how that threat looks."
"We need to make AppSec a priority."

Chapters

00:00 Introduction to the CISO Perspective

09:38 The Journey into Cybersecurity and Podcasting

13:52 Challenges in Direct Marketing and Data Protection

18:46 Addressing Browser-Based Vulnerabilities

22:09 Enhancing Security Awareness Training

23:13 AI and Automation in Cybersecurity

26:36 Navigating Risks with AI Tools

27:33 Browser DLP: A New Approach to Security

31:23 Limitations of Traditional Security Solutions

32:27 The Evolution of Secure Web Gateways

35:53 Architectural Vulnerabilities in Web Security

40:00 Challenges Faced by CISOs

41:43 Future Directions for Square X and Browser Security

Resources Get your free Chrome plugin: ⁠⁠⁠http://sqrx.io/pw_x⁠⁠⁠ ⁠⁠⁠https://www.linkedin.com/company/getsquarex/⁠⁠⁠ ⁠⁠⁠https://twitter.com/getsquarex⁠⁠⁠ ⁠⁠⁠https://www.instagram.com/getsquarex/

https://www.linkedin.com/in/david-malicoat-cissp/

https://www.theprofessionalciso.com/

https://www.linkedin.com/in/vivekramachandran/

SquareX CISO Series: Robert Pace & Vivek Ramachandran Dec 24, 2024

Show notes

Summary

In this episode, Phillip Wylie engages with Robert Pace and Vivek Ramachandran to discuss the evolving landscape of cybersecurity, particularly focusing on browser security, fraud prevention in real estate, and the challenges posed by remote work and BYOD policies. They emphasize the importance of education, transparency, and innovative solutions in addressing security threats. The conversation also highlights the need for organizations to adapt to new technologies and approaches to effectively manage risks and protect their assets.

Takeaways

Education is crucial for residents to understand security risks.

Risks and vulnerabilities are universal across industries.

The browser has become the primary endpoint for security.

Traditional security measures may not address modern threats.

BYOD policies need to be flexible and secure.

Transparency in security solutions builds trust with users.

Organizations must adapt to the evolving threat landscape.

Effective communication with vendors is essential for security.

Policy-based access control can streamline security processes.

User-centric policies can enhance security without hindering productivity.

Sound Bites

"Risks do not discriminate."
"The browser is the new endpoint."
"We need to manage risk intelligently."

Chapters

00:00 Introduction and Backgrounds

03:29 Cybersecurity Landscape and Education

06:45 Fraud Prevention in Real Estate

09:39 Transparency in Security Solutions

12:32 Understanding Industry-Specific Threats

15:41 The Role of EDR and Browser Security

18:33 BYOD and Remote Work Policies

27:19 Dynamic Policy Management in Cybersecurity

37:17 The Future of Browser Security

46:28 Innovations in Security Solutions for 2025

https://www.linkedin.com/in/robert-pace097/

https://www.linkedin.com/in/vivekramachandran/

Int Eighty of Dualcore: Hack All The Things Dec 23, 2024

Show notes

Summary

In this episode of the Phillip Wylie Show, Int Eighty from Dualcore shares insights into his journey in cybersecurity and music. He discusses the evolution of bug bounty programs, the importance of hands-on experience in cybersecurity education, and his personal hacker origin story. Int Eighty also delves into red teaming, physical pentesting, and career hacking strategies for aspiring professionals. He emphasizes the significance of leveraging AI in cybersecurity and shares his experiences as a musician in the hacking community.

Takeaways

Int Eighty has performed at various cybersecurity events, including Nolacon and Bugcrowd events.

Bug bounty programs have evolved to provide opportunities for hackers globally.

Hands-on experience is crucial in cybersecurity education, often lacking in traditional university settings.

Int Eighty's hacker origin story began with creative problem-solving as a child.

Red teaming involves finding vulnerabilities without causing actual damage to the business.

Physical pentesting can be approached creatively, often involving social engineering.

Building a portfolio through free projects is essential for career advancement in cybersecurity.

Avoiding burnout involves optimizing work schedules and understanding personal productivity patterns.

AI can be leveraged to enhance productivity and efficiency in cybersecurity tasks.

Dualcore combines Int Eighty's passion for hacking with his love for music, creating a unique niche.

Sound Bites

"I prefer to sit at home."

"I just like computers."

"Hack all the things."

Chapters

00:00 Introduction to Dualcore and Live Performances

03:44 The Evolution of Bug Bounty Programs

06:20 The Role of Education in Cybersecurity

09:38 Hacker Origin Stories

12:22 Red Teaming and Offensive Security

15:39 Physical Pen Testing Experiences

24:32 The Art of Red Teaming

28:25 Career Hacking: Getting Your Foot in the Door

32:18 Optimizing Work and Avoiding Burnout

36:23 Leveraging AI in Red Teaming

41:26 The Intersection of Hacking and Music

Resources

https://x.com/int0x80

https://t.co/myhSQyweOp

https://github.com/int0x80

https://inteighty.bandcamp.com/album/loyalty-2

Lauren Andrus: Cybersecurity Marketing Professional Dec 17, 2024

Show notes

Summary

In this episode of the Phillip Wylie Show, host Phillip Wylie welcomes Lauren Andrus, a marketing professional and podcast producer, to discuss her journey into the world of marketing and podcasting. They explore the evolution of podcasting, the importance of video content, and the growth of HOU.SEC.CON, a cybersecurity conference that emphasizes community engagement and accessibility. Lauren shares insights on how to get started in podcasting and content creation, highlighting the low-cost opportunities available for aspiring creators. The conversation also touches on the significance of quality content in conferences and the collaborative efforts behind HOU.SEC.CON's success.

Takeaways

Lauren Andrus shares her unexpected journey into marketing.
Podcasting is a low-cost way to disseminate information.
The importance of video content in modern podcasting.
Community engagement is key to successful conferences.
Quality content is essential for attracting attendees.
HOU.SEC.CON has seen significant growth in attendance.
Accessibility in conferences helps include more participants.
Aspiring podcasters should leverage free resources to learn.
Networking and community involvement can lead to job opportunities.
The balance between vendor sponsorship and quality content is crucial.

Sound Bites

"I think we've seen that over and over again."
"We grew our audience by 46% in that first year."
"We blew past that really quick."

Chapters

00:00 Introduction to the Podcast and Guest

06:32 The Evolution of Podcasting and Content Creation

14:32 Getting Started in Content Creation and Marketing

25:03 Accessibility and Community Engagement in Conferences

Resources

https://www.linkedin.com/in/laurenmandrus/

https://www.linkedin.com/company/houseccon/

http://houstonseccon.org/

John Hammond: New Frontiers in Cybersecurity Education Dec 10, 2024

Show notes

Summary

In this episode of the Philip Wylie Show, host Phillip Wylie interviews cybersecurity expert John Hammond. They discuss John's journey into hacking, the importance of Capture the Flag competitions, and the value of training and certifications in cybersecurity. John shares insights about his new educational platform, Just Hacking Training, and emphasizes the role of content creation in advancing one's career in the cybersecurity field. The conversation highlights the collaborative nature of cybersecurity education and encourages listeners to share their knowledge and experiences.

Takeaways

John Hammond's journey into cybersecurity began with a passion for video games and hacking.
Capture the Flag competitions provide valuable skills that are applicable in real-world scenarios.
Training resources for penetration testing are abundant and accessible online.
Just Hacking Training aims to provide free and affordable cybersecurity education.
Collaboration with other experts enhances the quality of educational content.
Certifications can help beginners get their foot in the door in cybersecurity.
The OSCP certification is highly regarded in the penetration testing community.
Content creation can significantly impact career opportunities in cybersecurity.
Sharing knowledge and experiences is crucial for community growth in cybersecurity.
Continuous learning and adaptation are essential in the ever-evolving field of cybersecurity.

Sound Bites

"CTF is more difficult than real world."
"Building up free accessible training."
"It's a buffet assortment of training."

Chapters

00:00 Introduction to John Hammond

01:36 John's Hacker Origin Story

04:07 The Value of Capture the Flag Competitions

07:08 Training for Aspiring Penetration Testers

09:11 Introducing Just Hacking Training

10:57 Collaborators in Cybersecurity Education

13:24 The Role of Certifications in Cybersecurity

16:55 Navigating Penetration Testing Certifications

19:14 The Impact of Content Creation on Career Growth

23:23 Encouragement for Aspiring Cybersecurity Professionals

Resources https://www.linkedin.com/in/johnhammond010/ https://www.youtube.com/@_JohnHammond https://x.com/_JohnHammond https://www.justhacking.com/

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected