Root Causes: A PKI and Security Podcast

Latest Episodes:

Root Causes 217: What's the Deal with the Recent Okta Security Breach? Apr 14, 2022

Show notes

In March the LAPSIS$ hacking group convincingly announced a breach of Okta systems, potentially exposing Okta customers to additional compromise. Despite Okta's initial statements to the contrary, it ultimately turned out that up to 366 Okta customers may be affected. Our hosts walk through the events of the attack, how it unfolded over time, and how this breach was revealed.

Root Causes 216: What Is crt.sh? Apr 10, 2022

Show notes

One of the foundational tools for monitoring and understanding public SSL certificates is crt.sh, created and maintained by Sectigo's own Rob Stradling. In this episode our hosts explain what crt.sh does and why it is so popular among SSL industry watchers.

Root Causes 215: Passwordless Authentication and Legacy Systems Apr 08, 2022

Show notes

Organizations seeking to use passwordless authentication frequently must deal with legacy systems that cannot support this scheme. In this episode we explain why that occurs and detail the steps organizations can take to mitigate the effect of legacy systems.

Root Causes 214: New DUO MFA Flaw Explained Apr 05, 2022

Show notes

A recent FBI warning cautions organizations about exploits based on misconfigured DUO MFA, which exploits weaknesses in Active Directory to provision credentials on DUO for malicious parties. This is an unusual story in several ways, including the fact that the exploit is based on a configuration error and that it's specific to a single, popular SaaS offering. Our hosts explain this exploit and why it is noteworthy.

Root Causes 213: 600-domain Phishing Attack Mar 28, 2022

Show notes

In this episode we describe a recent phishing campaign noteworthy for its scale, encompassing a total of 600 unique domains. We discuss the implications of a campaign of this scale and high level of organization.

Root Causes 212: S/MIME Limited to Three Years Mar 28, 2022

Show notes

On April 1 new root program requirements from Apple for S/MIME certificates go into effect, including a limitation of the allowable term to three years. This is contrary to Apple's stated intentions last year. In this episode the explain this change in policy and what certificate users can expect for the future.

Root Causes 211: Does CLM Make Wildcard and MDC Irrelevant? Mar 12, 2022

Show notes

Wildcard and multi-domain certificates have traditionally made administration easier for IT departments. In this episode we weigh the degree to which Certificate Lifecycle Management (CLM) renders these benefits obsolete and if these certificate types continue to be worth the increased risk they carry.

Root Causes 210: Living off the Land Mar 07, 2022

Show notes

Microsoft has deprecated support for the popular sysadmin tool WMIC. Join our hosts as they explain the security reasons behind this development and broader lessons we can learn.

Root Causes 209: One-Day Deployment of Certificate Lifecycle Management (CLM) Platforms Feb 28, 2022

Show notes

For any Certificate Lifecycle Management platform to succeed, effective deployment is essential. Our hosts are joined by Sectigo SVP of Global Sales Jennifer Binet who describes the optimal onboarding process, step by step. Jennifer discusses adding use cases over time, streamlining the contracting process, and getting to full automation for all certificates.

Root Causes 208: Automotive Information Systems Bricked by HD Radio Error Feb 24, 2022

Show notes

A major automobile manufacturer recently had a problem where its infotainment systems were permanently "bricked" by a flaw in local HD radio broadcasts. Our hosts describe what happened and explore the lessons we can learn from this incident.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Root Causes: A PKI and Security Podcast

Related Podcasts

Links

Stay Connected