Security Weekly Podcast Network (Video)

Latest Episodes:

The Enterprise Browser for the Modern Workforce - Robert Shield - BSW #326 Oct 30, 2023

Show notes

As the workforce increasingly relies on the cloud, the browser has become a critical aspect of enterprise security. Employees now use browsers to access data and applications from various devices and locations, making browsers the primary target for cyber attackers.

Enterprise browsers are specifically designed to address the security challenges of the modern and complex workforce. According to Gartner, "By 2030, enterprise browsers will be the core platform for delivering workforce productivity and security software on managed and unmanaged devices, ensuring a seamless hybrid work experience." Tune in to a discussion with Chrome Enterprise's Robert Shield, where he discusses the importance of an enterprise browser for modern businesses and shares insights on how to improve browser security.

Segment Resources: - Here's how you can get started with Chrome Enterprise for free: Chrome Enterprise - Chrome Enterprise Landing Page: https://chromeenterprise.google/browser/security - Complimentary Gartner report: Gartner® Emerging Tech: Security – The Future of Enterprise Browsers Report

This segment is sponsored by Google Chrome Enterprise. Visit https://securityweekly.com/chromeenterprise to learn more about them!

Show Notes: https://securityweekly.com/bsw-326

Cybersecurity Unicorns Are Back, the Okta Breach Is Bad, & Don't Invest in Startups - ESW #337 Oct 27, 2023

Show notes

This week, we discuss Island's raise, unicorn status, and what that means for both the enterprise browser market and the cybersecurity market in general. We discuss Censys and the state of the external attack surface management market, or what they're trying to call, "exposure management". We discuss the details of the Okta breach in depth, and why we're worried about the larger impact it could have on the industry and vendor trust in general. Finally, we wrap up with some fun squirrel stories.

Show Notes: https://securityweekly.com/esw-337

Pumpkin Spice, VMWARE, RoundCube, Apple, Big-IP, Oktapus, Aaran Leyland and More - SWN #337 Oct 27, 2023

Show notes

Pumpkin Spice, VMWARE, Winter Vivern, RoundCube, Apple, Big-IP, Oktapus, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-337

The Evolving Role of the Browser in the Modern Enterprise World - Noriko Bouffard, Marco Genovese - ESW #337 Oct 26, 2023

Show notes

In the age of remote and hybrid work, employees are now spending most of their time in the browser or virtual meetings, making the browser an increasingly important part of an enterprise's security strategy. According to Gartner, "By 2030, enterprise browsers will be the core platform for delivering workforce productivity and security software on managed and unmanaged devices for a seamless hybrid work experience."

Learn more about:

The browser's role in a business's security strategy
How an enterprise browser can support your workforce
Zero Trust Architecture and how businesses can enforce context-aware access controls and add customizable data loss prevention

Segment Resources:

Complimentary Gartner Emerging Tech: Security – The Future of Enterprise Browsers Report
Get started with Chrome Enterprise for free
Learn about Google's Zero Trust solution, BeyondCorp Enterprise
Customer spotlight: Check out the Google Cloud Next recording to hear how Snap is leveraging our secure enterprise browsing solution to protect their workforce
How to contact us

This segment was sponsored by Google Chrome Enterprise. Visit https://securityweekly.com/chromeenterprise to learn more!

Show Notes: https://securityweekly.com/esw-337

VSCode Vulnerabilities - Thomas Chauchefoin, Paul Gerste - PSW #804 Oct 26, 2023

Show notes

Sonar Vulnerability Researchers Thomas Chauchefoin and Paul Gerste conducted research on the security of Visual Studio Code — the most popular code editor out there — which was presented at DEF CON 31 in August. The pair uncovered a few ways for attackers to gain code execution on a victim's computer if they clicked on a specially crafted link or opened a malicious folder in Visual Studio Code, bypassing existing mitigations like Workspace Trust. Developers tend to trust their IDEs and do not expect such security issues to exist. As developers have access to source code and production systems, they make for very interesting targets for threat actors. Important to note is that the security concepts that the two are able to demonstrate apply not just to Visual Studio Code, but to most other code editors. This is also the story of how the researchers got an unexpected $30,000 bounty from Microsoft for these bugs, by mistake!

Segment Resources:

BLOG POSTS Securing Developer Tools: Argument Injection in Visual Studio Code (https://www.sonarsource.com/blog/securing-developer-tools-argument-injection-in-vscode/) Securing Developer Tools: Git Integrations (https://www.sonarsource.com/blog/securing-developer-tools-git-integrations/)

CVEs CVE-2023-36742 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36742) CVE-2022-30129 (https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-30129) CVE-2021-43891 (https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-43891)

Show Notes: https://securityweekly.com/psw-804

Shenanigans and more - PSW #804 Oct 26, 2023

Show notes

We officially welcome Bill Swearingen to our expert panel of PSW hosts, and discuss the news including hacking shenanigans, QNAP, recovering crypto currency, Android malware, and more!

Show Notes: https://securityweekly.com/psw-804

Alternative Approaches to Startup Funding - The Syndicate Group - Chad Cardenas - ESW #337 Oct 26, 2023

Show notes

In this interview, we talk to Chad Cardenas about why he created The Syndicate Group, which operates very differently from the typical VC firm with LPs and a collective fund to draw from. We'll discuss how the investor/startup relationship differs, and what the advantages of this model are.

Show Notes: https://securityweekly.com/esw-337

Okta Breach, SolarWinds RCEs, CISOs and Boards, Crypto Business Logic, Secure Design - ASW #260 Oct 24, 2023

Show notes

Appsec lessons from the Okta breach, directory traversal (and appsec) lessons from SolarWinds, how CISOs and Boards rank factors around vulns and patching, revisiting cryptocurrency attacks for lessons in business logic and threat modeling, CISA and friends update guidance on Secure Design, and more!

Show Notes: https://securityweekly.com/asw-260

Goatse, Okta, Cisco, Ducktail, 0Auth, China, Spain, More News and Aaran Leyland. - SWN #336 Oct 24, 2023

Show notes

Goatse, Okta, Cisco, Ducktail, 0Auth, China, Spain, More News and Aaran Leyland.

Show Notes: https://securityweekly.com/swn-336

OAuth, WebAuthn, and the Impact of Design Choices - Dan Moore - ASW #260 Oct 24, 2023

Show notes

We return to discussions of OAuth and all sorts of authentication. This time around we're looking at the design of authentication protocols, the kinds of trade-offs they weigh for adoption and security, and how a standard evolves over time to keep pace with new attacks and put to rest old mistakes.

Segment resources:

Show Notes: https://securityweekly.com/asw-260