Security Weekly Podcast Network (Video)

Latest Episodes:

Five Lessons Learned From Okta's Customer Support System Breach - ESW #340 Nov 17, 2023

Show notes

We regularly cover significant breaches on this podcast, but it is rare that we have enough information about a major breach to cover in enough detail to devote an entire segment to. Today, we dive into lessons learned from the breach of Okta's customer support system that targeted some other major security vendors.

This is part of a troubling trend, where the target of an attack only serves as a jumping off point to other organizations. China's 2023 attack of Microsoft is an example of this. It was easier to attack Microsoft 365, one of the world's largest business SaaS platforms, than to go after each of the 25 individual targets these Chinese actors needed access to.

Traditionally, we've thought of lateral movement as something that happens within a network segment, or even within a single organization. Now, we're seeing lateral movement between SaaS platforms, between clouds, from third party vendors to customer, and even from open source project to open source adopters.

In this segment, we'll cover five key lessons learned from Okta's breach, from information shared by Okta and three of its customers: 1Password, Cloudflare, and BeyondTrust.

Protect Your Session Tokens
Monitor for Unusual Behavior
SaaS Vendors Are Common Targets
Zero Trust Principles Work
MFA Isn't a Binary (on or off) Control

Segment Resources

https://www.valencesecurity.com/resources/blogs/five-lessons-learned-from-oktas-support-site-breach

Show Notes: https://securityweekly.com/esw-340

Cybertruck, Solarwinds, Bitcoin, Docker, Ducktail, Experian, More News and Jason Wood - SWN #342 Nov 16, 2023

Show notes

Cybertruck, Solarwinds, Bitcoin, Docker, Ducktail, Experian, More News and Jason Wood, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-342

Exploring the Intersection of Security for Edge Computing and Endpoint - Theresa Lanowitz, Mani Keerthi Nagothu - ESW #340 Nov 16, 2023

Show notes

Once again, Theresa Lanowitz joins us to discuss Edge Computing, but with a twist this time, as Mani Keerthi Nagotu from SentinelOne joins us as well! As a field CISO, Mani knows all too well the struggles security leaders are going through, given the current market and threat landscape:

Maybe not less budget, but more pressure to produce results and justify spending
Security leaders being held personally accountable for performance
Potential layoffs, and the need to achieve the same goals with less labor and tool overhead

Segment Resources

https://cybersecurity.att.com/insights-report

This segment is sponsored by AT&T Cybersecurity. Visit https://securityweekly.com/attcybersecurity to learn more about them!

Show Notes: https://securityweekly.com/esw-340

SSH Under Attack, IoT Routers, BLE Spam, & Patching a House of Cards - PSW #807 Nov 16, 2023

Show notes

In the Security News: SSH under attack, IoT routers have vulnerabilities, the BLE Spam attacks still work against iPhones, there is a longer story behind BLE spam, and Larry is one of the stars, denial of pleasure via BLE, vulnerability disclosure and your blob is showing, the half-day watcher, tapping into cameras, 50 shades of vulnerabilities, Nuclear decay as a random number generator, cachewarp, reptar, attacking Danish critical infrastructure, you can't patch a house of cards (and your bitcoin may be at risk), All that and more on this episode of Paul's Security Weekly!

Show Notes: https://securityweekly.com/psw-807

3 Layers of App Security to Keep Hackers Out, Let Customers In - Aviad Mizrachi - PSW #807 Nov 16, 2023

Show notes

Attackers pursue the shortest path to achieve their goals in your app. With a tri-layered security architecture, you can force hackers to crawl through a triathlon in your app. What's in the three layers, to detect attacks sooner, slow attackers down, and stop them fast? Let's take a journey across the three layers and discuss how to gain control of user permissions, secure your cloud computing, and keep your customers and their users safe.

Show Notes: https://securityweekly.com/psw-807

Fuzzing Strategies, Responding to CISA's Open Source Security RFI, 35 Year Old Worm - ASW #263 Nov 14, 2023

Show notes

CNCF's releases a handbook on fuzzing, OpenSSF and OWASP respond to CISA's Open Source Software Security RFI, 14 years of Go, lessons for today from an internet worm from 35 years ago, and more!

Show Notes: https://securityweekly.com/asw-263

How 2023 Changed Application Security and What's to Come in 2024 - Karl Triebes - ASW #263 Nov 14, 2023

Show notes

In the rapidly evolving landscape of application security, 2023 brought significant changes with the rise of generative AI tools and an increase in automated threats. In this discussion, Karl Triebes takes a deep dive into the major trends of the past year, examining their impact on the industry and shedding light on what security professionals can anticipate moving forward into 2024.

This segment is sponsored by Imperva. Visit https://securityweekly.com/imperva to learn more about them!

Show Notes: https://securityweekly.com/asw-263

Say Easy, Do Hard - Cyber Risk Management, Part 2 - BSW #328 Nov 14, 2023

Show notes

Inspired by my co-host, Jason Albuquerque, we get our hands dirty and discuss the challenges of cyber risk management. Why is cyber risk management so elusive and what can we do to solve it?

In part 2, we get our hands dirty by walking through ways to quantify cyber risks in business terms. What risks are truly worth mitigating vs. accepting or transferring? And if we do mitigate them, how do we track progress and impact?

Show Notes: https://securityweekly.com/bsw-328

Say Easy, Do Hard - Cyber Risk Management, Part 1 - BSW #328 Nov 13, 2023

Show notes

Inspired by my co-host, Jason Albuquerque, we get our hands dirty and discuss the challenges of cyber risk management. Why is cyber risk management so elusive and what can we do to solve it?

In part 1, we discuss the challenges of cyber risk management and quantification. Do risk scores really work? What do CEOs and Boards really need to understand cyber risks?

Show Notes: https://securityweekly.com/bsw-328

Palo Alto buys Talon, the changing world of security exits, 6 Qs to ask your CISO - ESW #339 Nov 10, 2023

Show notes

During the news today, we went deep down the rabbithole of discussing security product efficacy. Adrian still doesn't believe in enterprise browsers beyond Google Chrome, but can't deny that Talon got a pretty favorable exit considering the state of the market. We see the first major exit for cybersecurity insuretechs, and discuss a few notable funding rounds.

We discuss Kelly Shortridge's essay on the origins and nature of the term "security" and what it means. Stephen Schmidt suggests 6 questions every board should ask their CISO, we explore Cyentia Labs' meta analysis of MITRE ATT&CK techniques, and Phil Venables shares some hilarious takes on infosec stereotypes.

Show Notes: https://securityweekly.com/esw-339

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected