Phillip Wylie Show

Latest Episodes:

Be Fearless Online: SquareX Introduces Disposable Emails to Combat Spam and Phishing Attacks Dec 23, 2023

Show notes

About The Guest:
Dakshitaa Babu is a Software Engineer at SquareX, where she is engaged in data engineering and analytics.

She is also the pen behind the engineering blogs written on SquareX's infrastructure and security research. After completing her Bachelor's degree at the National University of Singapore, Dakshitaa joined SquareX, marking her foray into the cybersecurity industry. While new to the field, her enthusiasm for discovering and understanding new concepts has quickly established her as a committed contributor to the evolving sector. Her interests are in Browser Security and consumer education.

Summary:
Dakshitaa Babu discusses the importance of disposable emails in the cybersecurity space. She highlights that emails are a primary mode of communication and are therefore at great risk of threats. More than a quarter of all threats that occur on a daily basis happen through email. Dakshitaa explains that the growing importance of disposable emails is due to the fact that email is the gateway into our personal and professional lives. We often have to use our email addresses to sign up for services or receive important information. However, more than 50% of the emails we receive are spam, which can be a waste of time and affect productivity. Dakshitaa also mentions that legitimate sources sometimes sell our email addresses to spammers. She shares a fun tip of adding a suffix to our email addresses to track who may have leaked our email address. Dakshitaa emphasizes the increasing threat of phishing emails, which are becoming more targeted and difficult to detect. She mentions that phishing emails often contain malicious files or links, and even unsubscribe links within emails can be malicious. Dakshitaa explains that Squarex promotes safe email practices by providing an enhanced privacy mode and opening links and files in a disposable environment. She also mentions that Squarex is working on integrating with social media accounts to make clicking on links safer. Dakshitaa concludes by highlighting the importance of using disposable emails to reduce exposure to threats and maintain privacy online.

Key Takeaways:

Disposable emails are important in reducing the risk of threats that come through email.
More than 50% of the emails we receive are spam, which can waste time and affect productivity.
Phishing emails are becoming more targeted and difficult to detect.
SquareX provides enhanced privacy mode and opens links and files in a disposable environment.
Using disposable emails can help reduce exposure to threats and maintain privacy online.

Quotes:

"Emails are like a primary mode of communication, and that also puts it at great risk of threats." -Dakshitaa Babu
"More than 50% of the emails that come in our inbox are spam." -Dakshitaa Babu
"Phishing is getting worse, and these days you can't even tell if it's legitimate or not." -Dakshitaa Babu
"Emails have become really dangerous. It's almost like the floor is lava." -Dakshitaa Babu
"Disposable emails are a great way to exercise privacy online." -Dakshitaa Babu

Socials and Resources:
Get your free Chrome plugin: ⁠⁠http://sqrx.io/pw_x⁠⁠
⁠⁠https://www.linkedin.com/company/getsquarex/⁠⁠
⁠⁠https://twitter.com/getsquarex⁠⁠
⁠⁠https://www.instagram.com/getsquarex/

Justin "Hutch" Hutchens: AI's Impact on Cybersecurity Dec 20, 2023

Show notes

Summary:
In this episode of the Phillip Wylie Show, Phillip interviews Justin "Hutch" Hutchens, an offensive security professional and author of "The Language of Deception: Weaponizing Next Generation AI." They discuss the emerging risks and opportunities of artificial intelligence (AI) in the cybersecurity space. Justin shares his experiences with using AI to automate social engineering attacks and highlights the potential dangers of AI-powered conversational agents and technical agents. He also explores the defensive applications of AI, such as using language models for threat intelligence and incident response. The conversation concludes with a discussion on how individuals can leverage AI resources to improve their skills and stay ahead of the curve.

Key Takeaways:

AI-powered conversational agents can automate social engineering attacks, posing a significant risk to individuals and organizations.
The emergence of AI-powered conversational agents and technical agents raises concerns about the potential for large-scale manipulation and exploitation.
Language models can be used to filter and make sense of unstructured threat intelligence data, improving the efficiency and effectiveness of security operations.
AI has the potential to revolutionize incident response by automating the creation of runbooks and enabling faster, more efficient incident resolution.
Individuals can take advantage of AI resources by experimenting with language models and exploring freely available courses and resources.

Quotes:

"The fact that now, instead of just getting a phishing email, I could now be having a conversation with someone on LinkedIn, or if they've managed to get access to my internal network, possibly even on something like Teams or Slack." - Justin Hutchens
"The most profound new capability that we're seeing with these language models in a defensive capability is being able to take that unstructured data and figure out what is relevant to me, what is relevant to my organization." - Justin Hutchens
"The most important thing is really just starting, getting your hands on it and playing with it." - Justin Hutchens

Socials and Resources:

https://www.linkedin.com/in/justinhutchens/

https://twitter.com/sociosploit

https://www.wiley.com/en-cn/The+Language+of+Deception%3A+Weaponizing+Next+Generation+AI-p-9781394222544

Be Fearless Online: Safely Deal with Files Online with SquareX Dec 20, 2023

Show notes

About The Guest: Shourya Pratap Singh is a Principal Engineer at SquareX. He is responsible for building SquareX’s secure and privacy-focused extension, and works on researching methods to counteract web security risks. He has conducted a workshop at Texas Cyber Summit, and his work is being presented at Blackhat Arsenal EU. Before joining @SquareXTeam , he worked with FinBox (an Indian fintech) where he led a team of brilliant developers and was responsible for building and scaling multiple product lines. He has a bachelor’s degree from IIIT Bhubaneswar and holds a patent. His area of interest includes browser extensions and web application security.

Summary:
In this episode, Shourya Pratap Singh from Squarex discusses how to deal with files securely online. He highlights the dangers of malicious files and the importance of protecting ourselves, especially during the holiday season when cyberattacks are more prevalent. Shourya demonstrates how traditional antivirus software and endpoint security systems work in a probabilistic way, making it difficult to determine if a file is truly safe. He then introduces SquareX's disposable file viewer, which allows users to open files in a cloud-based sandbox, eliminating the risk of executing malicious code on their own machines. Shourya also explains how the disposable file viewer integrates with other SquareX features, such as the privacy mode and download interceptor, to enhance security measures. He concludes by introducing SquareX's progressive web app, which enables users to open local files securely and conveniently.

Key Takeaways:

Traditional antivirus software and endpoint security systems work in a probabilistic way, making it difficult to determine if a file is truly safe.
SquareX's disposable file viewer allows users to open files in a cloud-based sandbox, eliminating the risk of executing malicious code on their own machines.
The disposable file viewer integrates with other SquareX features, such as the privacy mode and download interceptor, to enhance security measures.
SquareX's progressive web app enables users to open local files securely and conveniently.

Quotes:

"Probabilistic models are not something we can 100% rely on." - Shourya Pratap Singh
"You can open a file fearlessly in a very deterministic way without worrying much about if it's going to actually affect your computer or not." - Shourya Pratap Singh
"SquareX brings these features for any normal person to use. Something like a sandbox is not something everyone would usually have access to." - Shourya Pratap Singh

Socials and Resources: Get your free Chrome plugin: ⁠⁠http://sqrx.io/pw_x⁠⁠ ⁠⁠https://www.linkedin.com/company/getsquarex/⁠⁠ ⁠⁠https://twitter.com/getsquarex⁠⁠ ⁠⁠https://www.instagram.com/getsquarex/

Andy Robbins: The Evolution of Bloodhound Dec 19, 2023

Show notes

About The Guest:
Andy Robbins is the Principal Product Architect at SpecterOps and one of the original 13 founding members of the company. He has a background in pen testing and red teaming and is the co-creator of Bloodhound, a popular open-source tool for attack path mapping in Active Directory environments.

Summary:
Andy Robbins, the Principal Product Architect at SpecterOps, joins host Phillip Wylie to discuss the evolution of Bloodhound, a tool for attack path mapping in Active Directory environments. Andy shares the origin story of Bloodhound and how it was developed to solve the problem of finding attack paths in complex environments. He explains the graph theory behind Bloodhound and how it visualizes data to help practitioners and defenders understand and mitigate security risks. Andy also discusses the recent release of Bloodhound Community Edition (CE) and the improvements it brings, including faster data ingest, query times, and a friendlier user experience. He highlights the focus on practical attack primitives and abuse primitives in Bloodhound and the goal of making attack paths a non-issue for organizations. Andy concludes by sharing valuable advice for those looking to advance in the industry, emphasizing the importance of understanding and solving real problems and being loyal to people rather than companies.

Key Takeaways:

Bloodhound is a tool for attack path mapping in Active Directory environments, using graph theory to visualize data and identify security risks.
Bloodhound Community Edition (CE) brings improvements such as faster data ingest, query times, and a friendlier user experience.
Bloodhound focuses on practical attack primitives and abuse primitives to solve real security problems and make attack paths a non-issue for organizations.

Quotes:

"If we give people an excellent experience for free, then enough of those people will choose to become paying customers that we have a viable business." - Andy Robbins
"The industry as a whole is very young, but the capability of visualizing data problems and data security problems in this way is also relatively brand new." - Andy Robbins
"We focus on attack paths or risk that emerges out of a combination of the mechanics of a system, the configurations of that system, and the behaviors of users or identities in that system." - Andy Robbins

Socials and Resources:

https://twitter.com/_wald0

https://twitter.com/SpecterOps

https://specterops.io/

https://bloodhoundenterprise.io/

https://github.com/SpecterOps/BloodHound

Jason Downey: Semi-Pro Kickboxer Turned Pentester Dec 12, 2023

Show notes

About The Guest: Jason Downey is a pen tester at Red Siege, a boutique pen testing firm. He has been in the industry for almost three years and specializes in network pen testing, social engineering, and physical assessments. Jason has a background in network administration and security, and he is passionate about sharing his knowledge and helping others in the industry.

Summary: Jason Downey, a pen tester at Red Siege, joins the podcast to discuss his journey into the world of pen testing and the importance of networking and building relationships in the industry. He emphasizes the need for a strong foundation in networking fundamentals and active directory knowledge. Jason also shares his favorite resources for learning infrastructure pen testing and highlights the collaborative nature of the industry.

Key Takeaways:

Building a strong network is crucial in the information security industry and can open up opportunities for job prospects and knowledge sharing.
Networking fundamentals and active directory knowledge are essential for successful pen testing, as most corporate infrastructures rely on these technologies.
Specializing in a specific area of pen testing can be beneficial once you have a solid foundation and understanding of the fundamentals.
Online resources such as Google, Hacktricks XYZ, and ired team can provide valuable information and guidance for learning infrastructure pen testing.

Quotes:

"The power of your network is crucial in the information security industry. It can help you bypass the traditional education, experience, and certification requirements." - Jason Downey
"To break something, you have to know how it functions first. Understanding the fundamentals is key to successful pen testing." - Jason Downey
"Active directory knowledge is mission critical in pen testing, as most companies rely on it for their infrastructure." - Jason Downey

Socials and Resources:

https://twitter.com/hackandbackpack

Jessie Bolton: Building Your Personal Brand and Networking in Cybersecurity Dec 12, 2023

Show notes

About The Guest:
Jesse Bolton is the founder of Bolt Resources, a cyber staffing and recruiting firm that focuses on workforce development and coaching. She is also involved in the North Texas ISSA and is passionate about advocating for the cybersecurity workforce.

Summary:
Jesse Bolton, founder of Bolt Resources, joins Phillip Wylie on the Phillip Wylie Show to discuss the importance of building a personal brand and networking in the cybersecurity industry. Jesse emphasizes the need for recruiters to go beyond simply matching candidates with job descriptions and instead focus on understanding the individual and their career goals. She also highlights the prevalence of ghost job postings and the importance of transparency in the hiring process. Jesse shares tips for avoiding burnout and retaining employees, including building authentic relationships and providing opportunities for growth.

Key Takeaways:

Building a personal brand and networking are essential in the cybersecurity industry.
Soft skills, such as communication and self-awareness, are highly valued by hiring managers.
Creating a portfolio of projects and sharing them on platforms like GitHub and LinkedIn can help candidates stand out.
Employers should focus on building authentic relationships with their employees and providing opportunities for growth to retain talent.

Quotes:

"Networking is so important. It's not just about what people can do for you. Try to tap into that authenticity within and just be real." - Jesse Bolton
"Your social score, your credibility, and how you treat people are important in the hiring process." - Jesse Bolton
"Resumes are a piece of paper. Your social media presence and personal brand can have a bigger impact on your job search." - Jesse Bolton

Socials and Resources:

https://www.linkedin.com/in/cybertalentadvisor/

https://boltresources.net/

https://www.youtube.com/@CyberCareersCoffee

Be Fearless Online: Open emails without being tracked or hacked with SquareX Dec 05, 2023

Show notes

About The Guest:
Jeswin Mathai is the Chief Architect at SquareX. He leads the team responsible for designing and implementing the Infrastructure. Prior to joining SquareX, He was working as the chief architect at INE. He has published his work at DEFCON China, RootCon, Blackhat Arsenal, and Demo Labs (DEFCON). He has also been a co-trainer in-classroom training conducted at Black Hat Asia, HITB, RootCon, and OWASP NZ Day. He has a Bachelor's degree from IIIT Bhubaneswar. He was the team lead at InfoSec Society IIIT Bhubaneswar in association with CDAC and ISEA, which performed security auditing of government portals and conducted awareness workshops for government institutions. His area of interest includes Cloud Security, Container Security, and Web Application Security.

Summary:
Jeswin Mathai joins Phillip Wylie in this episode of the "Stay Fearless Online" series to discuss email safety and how SquareX can protect users from being tracked or hacked. They highlight the challenges individuals face in staying safe online, especially those who are not tech-savvy. Jeswin explains that SquareX's browser extension is designed to provide a better way to protect users by sitting on the browser and ensuring secure browsing. They demonstrate how email tracking works and how SquareX's Enhanced Privacy Mode can prevent tracking by blocking third-party images. The extension also offers a secure disposable file viewing environment for opening attachments safely. Jeswin emphasizes the importance of email security as an entry point for attackers and how SquareX aims to provide a user-friendly solution.

Key Takeaways:

SquareX's browser extension sits on the browser to provide better security for users.
Email tracking can reveal information about the user's location, device, and IP address.
SquareX's Enhanced Privacy Mode blocks third-party images to prevent tracking.
The extension offers a secure disposable file viewing environment for opening attachments safely.
Email security is crucial as attackers often target individuals through email.

Quotes:

"With SquareX, the idea is not to intrude in users' workflow, rather ensuring that we provide them a way with which they can do everything securely." - Jeswin Mathai
"The moment you open a link, it will go ahead and reveal information about from where you are opening the email, the IP address information, similarly what device you're using. Now all of this information can be used to profile the user." - Jeswin Mathai

Socials and Resources:

Get your free Chrome plugin: http://sqrx.io/pw_x

https://www.linkedin.com/company/getsquarex/

https://twitter.com/getsquarex

https://www.instagram.com/getsquarex/

Diamond Forbes: From Homelessness to Security Engineer Dec 05, 2023

Show notes

About The Guest:
Diamond Forbes is a security engineer at Google with over eight years of experience in the field. He started his career in the Army National Guard as an IT specialist and network engineer. Diamond has worked in various roles, including help desk, system admin, and senior network engineer. He has a passion for learning and has self-taught himself many skills, including coding and cybersecurity. Diamond is known for his resilience and ability to overcome failures, which has led him to success in his career.

Summary:
Diamond Forbes shares his inspiring journey from being homeless and working at McDonald's to becoming a security engineer at Google. He talks about his early interest in hacking and how he joined the Army National Guard as an IT specialist. Diamond shares his experiences in different roles, including help desk, system admin, and network engineer. He emphasizes the importance of embracing failure and using it as a learning opportunity. Diamond also discusses the value of self-teaching and the impact of networking on his career. He shares his transition into security and the skills he developed, including coding and DevSecOps. Diamond encourages listeners to stay curious, put themselves out there, and be well-rounded in their skill set.

Key Takeaways:

Embrace failure and use it as a learning opportunity.
Don't sell yourself short and showcase your skills and experience confidently.
Be curious and continuously learn new things to stay relevant in the industry.
Put yourself out there and develop strong networking skills.
Develop a well-rounded skill set and be open to learning different things.

Quotes:

"I failed a lot, actually. But that was like my biggest teacher in personal life and in my career." -Diamond Forbes
"Don't sell yourself short, especially if you're very ambitious."
"Don't let imposter syndrome deter you from anything." -Diamond Forbes
"Broaden your skill set, it's not just about your technical skills." -Diamond Forbes
"Try to be as well-rounded as possible and you can do anything at that point." -Diamond Forbes

Socials and Resources:

https://www.linkedin.com/in/diamondforbes/

Katie Paxton-Fear: The Importance of Content Creation in Cybersecurity Careers Nov 27, 2023

Show notes

About The Guest:
Katie Paxton-Fear, also known as Insider PhD, is a content creator and educator in the field of cybersecurity. With a background in software engineering, Katie creates high-quality videos on her YouTube channel that cover various topics related to web security and bug bounty hunting. She is known for her detailed and comprehensive approach to teaching and sharing knowledge in the cybersecurity field.

Summary:
In this episode of The Phillip Wylie Show, host Phillip Wylie interviews Katie Paxton-Fear, also known as Insider PhD, a content creator and educator in the field of cybersecurity. Katie shares her insights on bug bounty hunting, API security, and the importance of having hobbies outside of the computer. She emphasizes the value of content creation in building a personal brand and advancing one's career in cybersecurity. Katie also discusses her teaching approach and how she incorporates content creation into her curriculum to help students showcase their skills and knowledge.

Key Takeaways:

Bug bounty hunting is a valuable path for individuals interested in cybersecurity, but it is important to have a genuine interest in security rather than just the financial aspect.
APIs are often overlooked in terms of security, but they can be a significant vulnerability and a great place to find bugs.
When approaching bug hunting, Katie takes a top-down perspective, starting with the functionality of the application and breaking it down into its component parts to identify potential vulnerabilities.
Having hobbies outside of the computer is crucial for maintaining a healthy work-life balance and preventing burnout in the cybersecurity field.
Content creation, such as writing blogs or creating videos, is highly beneficial for personal branding and career advancement in cybersecurity.

Quotes:

"Bug hunting is really interesting. It's like having a puzzle, except you only have a few pieces, they're completely blank, and you're not sure if they came from the same set." - Katie Paxton-Fear
"It's really easy to get caught up in 'I finish work, I'm going to go look at my phone.' I think it's really important to have hobbies that just do not involve a computer at all." - Katie Paxton-Fear
"Content creation is the biggest thing you can do for your personal career. It changes the equation in hiring, where companies come to you instead of you chasing them." - Katie Paxton-Fear

Socials and Resources:

https://www.linkedin.com/in/katiepf/

https://www.youtube.com/@InsiderPhD

https://twitter.com/InsiderPhD

Maxie Reynolds: From hacker to underwater data center entrepeneur Nov 21, 2023

Show notes

About The Guest:Maxie Reynolds is a former offshore oil and gas worker turned entrepreneur. She is the founder and CEO of a company that specializes in placing data centers underwater, reducing cooling costs and carbon emissions. Maxie is also a stuntwoman and has a background in robotics and computer science.

Summary:Maxie Reynolds shares her journey from working offshore in the oil and gas industry to becoming an entrepreneur in the data center industry. She discusses the challenges she faced and the lessons she learned along the way. Maxie explains how her company solves the problem of high cooling costs and carbon emissions by placing data centers underwater. She also addresses misconceptions about the environmental impact of data centers and the importance of sustainability.

Key Takeaways:

Maxie Reynolds started her career as an offshore oil and gas worker before transitioning to cybersecurity and eventually founding her own company.
Placing data centers underwater reduces cooling costs by 40% and eliminates the need for electrically driven cooling systems.
Data centers placed underwater also reduce carbon emissions by 750 tons per megawatt hour of electricity used.
Water has a higher specific heat than air, making it a more efficient heat sink and preventing the surrounding water from heating up significantly.
Maxie emphasizes the importance of acknowledging the realities of sustainability and finding innovative solutions to address them.

Quotes:

"Whatever you want to do as a female, try, go, try, do it, and see how far you get." - Maxie Reynolds
"To have a good company, you have to be solving a problem." - Maxie Reynolds
"We are reliant on fossil fuel in every single way." - Maxie Reynolds
"There's no incentive to use our commodities efficiently." - Maxie Reynolds
"Reach out to people that you think are smart, even if they aren't in your circle, and start to find some of the right answers." - Maxie Reynolds

Socials and Resources:

⁠https://twitter.com/SubseaCloud⁠

⁠https://www.linkedin.com/in/maxiereynolds/⁠

Book: The Art of Attack: Attacker Mindset for Security Professionals: ⁠https://www.wiley.com/en-us/The+Art+of+Attack%3A+Attacker+Mindset+for+Security+Professionals-p-9781119805472⁠