Purple Squad Security

Latest Episodes:

Episode 41 – Cyber Security Awareness Month with Tracy Maleeff Oct 07, 2018

Show notes

October is Cyber Security Awareness Month, and with that who better to help share some ideas on how to give back to the community than our own InfoSecSherpa! Tracy Maleeff joins me to talk about Cyber Security Awareness Month, #ginfosec and #inforum. This will be one of the most relaxed Infosec podcasts you'll hear this year.... Some links of interest:

GetCyberSafe (Canada) - https://www.getcybersafe.gc.ca/cnt/rsrcs/csam/thms-en.aspx
StaySafeOnline (US) - https://staysafeonline.org/ncsam/themes/
Tracy's Twitter - https://twitter.com/InfoSecSherpa
Infosec Mastodon - https://infosec.exchange/auth/sign_up

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
John's Mastodon: https://infosec.exchange/@JohnsNotHere
Podcast Website: purplesquadsec.com
Patreon - https://www.patreon.com/purplesquadsec
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 40 – Tabletop D&D With Rally Security Sep 23, 2018

Show notes

It's that time again! With milestone episode 40, we have another Tabletop D&D episode for you to enjoy! This time around we are joined by a few members of the Rally Security podcast to face some scenarios and see how they fare. Let's just say this was a rather impressive episode for a number of reasons. Some links of interest:

Rally Security Homepage - http://rallysecurity.com/
Rally Security Twitch - https://www.twitch.tv/rallysecurity
Rally Security Twitter - https://twitter.com/RallySecurity
Ben's Twitter - https://twitter.com/benheise
Jake's Twitter - https://twitter.com/MalwareJake
AJediDay's Twitter - https://twitter.com/Ajediday
Tony's Twitter - https://twitter.com/da_667
Cubicles and Consequences - https://www.blackhillsinfosec.com/dungeons-dragons-meet-cubicles-compromises/
Infosec Mastodon - https://infosec.exchange/auth/sign_up

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
John's Mastodon: https://infosec.exchange/@JohnsNotHere
Podcast Website: purplesquadsec.com
Patreon - https://www.patreon.com/purplesquadsec
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 39 – John’s OSCP Journey Sep 16, 2018

Show notes

Over the past few months, John has been working on obtaining his OSCP certification. Recently he attempted and successfully passed the exam! In this episode he goes over his journey, what he learned as well as a few tips to help those attempting this rather difficult certification.

Some links of interest:

Penetration Testing - A Hands On Introduction to Hacking - https://www.amazon.com/Penetration-Testing-Hands-Introduction-Hacking/dp/1593275641
Web Application Hacker's Handbook 2nd Edition - https://www.amazon.com/Web-Application-Hackers-Handbook-Exploiting/dp/1118026470
OSCP Prep:
VulnHub - https://www.vulnhub.com/
HackTheBox - https://www.hackthebox.eu/
Infosec Mastodon - https://infosec.exchange/auth/sign_up

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
John's Mastodon: https://infosec.exchange/@JohnsNotHere
Podcast Website: purplesquadsec.com
Patreon - https://www.patreon.com/purplesquadsec
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 38 – Discussing the Cyber Kill Chain with Amanda Berlin Aug 26, 2018

Show notes

The cyber kill chain. For some, it's a nice framework to help build your defenses and help during an incident. For others, it is an over hyped and rigid list that no real attacker follows anymore. However you view the cyber kill chain, it is a strong pillar within Infosec, especially when it comes to defending your network. Amanda Berlin joins me today to talk about the cyber kill chain, what it is and how to disrupt attacks using it! Some links of interest:

Amanda's Disrupting The Kill Chain Training - https://www.youtube.com/playlist?list=PL-giMT7sGCVKIWHVZ-N4A_eJhu6BzH4WM
Amanda's Cyber Kill Chain Implementation Spreadsheet - https://docs.google.com/spreadsheets/d/1J0swcA1Phb4mh-Pj8eR9ZEAIm5GEtz0UklP9YhVUbEY/edit#gid=0
Official Cyber Kill Chain Site - https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
SANS Suspicious Domains Lists - https://isc.sans.edu/suspicious_domains.html
HaveIBeenPwned.com - https://haveibeenpwned.com
Brakeing Down Security Podcast - https://www.brakeingsecurity.com/
Amanda's Twitter - https://twitter.com/InfoSystir

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
Podcast Website: purplesquadsec.com
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 37 – Bring Your Own Land with Nathan Kirk Aug 12, 2018

Show notes

Living off the land is a term well understood by both offensive and defensive teams. For offensive teams, it's meant by using the technologies already present on the system, such as Powershell, Python, and even Perl for those who like a challenge (or are facing an older Unix system). On the defensive side, enhanced logging and locked down configurations are put in place to detect and prevent the use of these tools by malicious actors to either catch or prevent these actors from doing harm. Nathan Kirk (@sekirkity) joins me this week to talk about the concept behind "Bring Your Own Land". Some links of interest:

BYOL Article - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
SpecterOps - https://specterops.io/
Ghostpack - https://www.harmj0y.net/blog/redteaming/ghostpack/
SharpView - https://github.com/tevora-threat/SharpView
Nathan's Twitter - https://twitter.com/sekirkity

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
Podcast Website: purplesquadsec.com
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 36 – The Joy of CTFs with Derek Rook Jul 29, 2018

Show notes

Capture The Flag games, or CTFs, are a popular way for infosec pros to brush up on the offensive skills. From VulnHub to HackTheBox, there are a few different ways to quote "get your hack on"! Derek Rook (@_r00k_) joins me today to talk about CTFs and how they can assist in your Infosec journey, regardless of your role. Some links of interest:

Derek's YouTube Channel - https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA
Derek's Twitch Stream - https://www.twitch.tv/r00k_infosec
ippsec's YouTube Channel - https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA
LiveOverflow YouTube Channel - https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w
Mub1x's Twitch Stream - https://www.twitch.tv/mub1x
CCDC (US) - http://www.nationalccdc.org/
CCDC (Canada) - https://www.cyberdefencechallenge.ca/
SANS Holiday Hack Challenge - https://holidayhackchallenge.com/past-challenges/
Open2All CTF team - https://www.reddit.com/r/OpenToAllCTFteam/
CTF Time - https://ctftime.org/
Derek's Twitter - https://twitter.com/_r00k_

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
Podcast Website: purplesquadsec.com
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 35 – Container Security with Jay Beale Jul 15, 2018

Show notes

From jails to virtual machines, process isolation is the "holy grail" of security. Lately, containers have been the go-to for modern organizations in order to scale and implement things like microservices. Jay Beale of InGuardians fame joins me to talk all about container security! Some links of interest:

Securing Applications with Linux Containers (Webinar by Jay Beale)
Docker security - Using containers safely in production (Article by Adrian Mouat)
Clair (Container Scanner) - https://github.com/coreos/clair
InGuardians Website - https://www.inguardians.com/
InGuardians Blog - https://www.inguardians.com/labs/
InGuardians Twitter - https://twitter.com/inguardians
Jay's Twitter - https://twitter.com/jaybeale
Jess Frazelle's Twitter - https://twitter.com/jessfraz

Want to reach out to the show? There's a few ways to get in touch!

Purple Squad Security's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
Podcast Website: purplesquadsec.com
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 34 – Exploring Powershell with Mick Douglas Jul 01, 2018

Show notes

Living off the land is pretty standard fare for pen testers. On Linux systems, the go-to is usually Python, but on Windows it's all about Powershell. This week I'm fortunate enough to sit down with Mick Douglas to talk all things Powershell! Some links of interest:

Powercat - https://github.com/besimorhino/powercat
- Mick wants to give a special shout out to Luke Baggett for all the great work he's done on this project!
Kansa - Dave Hall was the original author - https://github.com/davehull/Kansa
Mick's Public Projects - https://github.com/besimorhino?tab=repositories
Invoke-IR - https://github.com/Invoke-IR
Bye-FePhishia - https://github.com/jcjohnson34/Bye-FePhishia
OverworkedAdmin.com - https://overworkedadmin.com/category/scripting-languages/powershell/
Microsoft TechNet Blog - "Hey Scripting Guy!" - https://blogs.technet.microsoft.com/heyscriptingguy/
InfosecInovations.com - https://www.infosecinnovations.com/
Powershell Basics - https://www.darkoperator.com/powershellbasics/
Powershell Cheatsheet - https://github.com/PrateekKumarSingh/CheatSheets/tree/master/Powershell

Want to reach out to the show? There's a few ways to get in touch!

Show's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
Podcast Website: purplesquadsec.com
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 33 – 3 Pillars for Starting a Security Program Jun 17, 2018

Show notes

In this episode John goes at it alone and discusses his own experiences with starting up a security program at different organizations by focusing in on what he views are the 3 key pillars for a new security program. Some links of interest:

CIS Critical Security Controls - https://www.cisecurity.org/controls/
Malware Archeology - Logging Cheat Sheets - https://www.malwarearchaeology.com/cheat-sheets/
Linux Security Incident Log Review Checklist - https://zeltser.com/security-incident-log-review-checklist/
SANS Log Management In-Depth - https://www.sans.org/brochure/course/log-management-in-depth/6
OWASP Logging Cheat Sheet - https://www.owasp.org/index.php/Logging_Cheat_Sheet
Defensive Security Handbook - http://shop.oreilly.com/product/0636920051671.do

Want to reach out to the show? There's a few ways to get in touch!

Show's Twitter: @PurpleSquadSec
John's Twitter: @JohnsNotHere
Podcast Website: purplesquadsec.com
Sign-Up for our Slack community: https://signup.purplesquadsec.com

Thanks for listening, and as always, I will talk with you all again next time.

Find out more at http://purplesquadsec.com

Episode 32 – Fireside Chat with Deviant Ollam Jun 03, 2018

Show notes

Continuing on with my fireside chat series, where I bring on a guest to just have a casual chat and see where the conversation takes us, my guest this time is Deviant Ollam. Well known for his work with TOOOL and the locksport community, we take a different path and talk about physical penetration testing as well as hear some great stories from the road.

Some links of interest: