Security Weekly Podcast Network (Video)

Latest Episodes:

Aviation ASCII Art, OpenSSH Double-Free, F5 Format String, OSC&R for Supply Chains - ASW #228 Feb 08, 2023

Show notes

The aviation equivalent of ASCII art, a memory safety issue in OpenSSH that might not be terrible, a format string in F5 that might be terrible, a new MITRE framework for supply chain security, programming languages and secure code

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw228

Chinese Androids, ERNIE, Bard, Fortra, Sunlogin, Dingo, Google, Jason Wood, and More - SWN #272 Feb 07, 2023

Show notes

Chat-GPT fails, Ernie, Bard, Chinese Androids, Fortra, Sunlogin, Dingo Token, Google Ads, Jason Wood and More on this edition of Security Weekly News.

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn272

Security Money - Waiting for the Recovery - BSW #293 Feb 07, 2023

Show notes

This week, it's Security Money. While the major indexes have improved, the SW25 index has not. Pressures from the macro economic conditions appear to have a greater impact on cybersecurity. We'll dig in and review.

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw293

Myths and Lies in Infosec - Adrian Sanabria - ASW #228 Feb 07, 2023

Show notes

Most of the myths and lies in InfoSec take hold because they seem correct or sound logical. Similar cognitive biases make it possible for even the most preposterous conspiracy theories to become commonly accepted in some groups. This is a talk about the importance of critical thinking and checking sources in InfoSec. Our industry is relatively new and constantly changing. Too often, we operate more off faith and hope than fact or results. Exhausted and overworked defenders often don't have the time to seek direct evidence for claims, question sources, or test theories for themselves.

Resources

- https://www.usenix.org/conference/enigma2023/presentation/sanabria

- https://www.usenix.org/sites/default/files/conference/protected-files/enigma2023_slides_sanabria.pdf

- https://yourbias.is

- Discuss: What Makes a Good Breach Response? - ESW #303: https://www.youtube.com/watch?v=5RpZiVu3xEs

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw228

New CEOs, SMB & Cyber Insurance Trends, Herman Miller Chairs, & SQL Slammer - ESW #304 Feb 03, 2023

Show notes

In the Enterprise News: There's lots of executive shuffling going on! Saviynt gets a new CEO and $205M in funding, Forescout appoints its 4th CEO in as many years, and Mudge finds a place at Rapid 7. We've got some interesting trends, like more focus on securing small businesses, and more cybersecurity startups pairing technology with cyber insurance. It seems like only yesterday, we were shocked to hear that Microsoft was running a $10B security business, but Microsoft has apparently now grown security revenue to $20 BILLION DOLLARS. Also, Tyler explains what Herman Miller chairs have to do with spotting market trends, we note the 20 year anniversary of SQL Slammer, and discuss why consumers don't want smart appliances shoved down their throats!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw304

Chat-GPT Seinfeld, QNAP, Google FI, Headcrab, Banner, GoodRx, Oracle, & GoAnywhere - SWN #271 Feb 03, 2023

Show notes

This week in the Security News Doug Chides: Chat-GPT, QNAP, Google FI, REDIS, Headcrab, Banner, GoodRx, Oracle, GoAnywhere, & more!

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn271

Understanding & Protecting Against Insider Risk - Joseph Blankenship - ESW #304 Feb 03, 2023

Show notes

Insiders - employees, contractors, and partners - are responsible for almost a quarter of data breaches. Reducing insider risk requires a dedicated approach, including user monitoring. But be careful, Forrester predicts that a C-level executive will be fired for their firm's use of employee monitoring in 2023.

Segment Resources:

https://www.forrester.com/blogs/predictions-2023-security/?ref_search=3092262_1675290315432

https://www.forrester.com/blogs/apply-critical-thinking-and-culture-to-reduce-insider-risk/

https://www.forrester.com/blogs/practice-empathy-to-reduce-insider-risk/

https://www.forrester.com/blogs/pandemic-fallout-creates-perfect-conditions-for-insider-threat/

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw304

Q&A: Cyber Insurance - Alla Valente, Heidi Shey - ESW #304 Feb 02, 2023

Show notes

Cyber insurance is a must-have, but organizations are finding that cyber insurance premiums are more costly, policies are more difficult to obtain, and policies attach more limitations and exclusions than before. We will discuss cyber insurance's role in risk management and trends.

Segment Resources:

https://www.forrester.com/report/q-and-a-cyber-insurance/RES178563?ref_search=3185990_1675109251447

https://www.forrester.com/report/tech-execs-guide-to-cyber-insurance/RES178564?ref_search=3185990_1675109251447

https://www.forrester.com/blogs/whos-responsible-for-cyber-insurance-policy-misrepresentations-it-depends/?ref_search=3185990_1675109251447

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw304

Super(conductive) Graphene, Yandex Leak, No Fly Lists, & Thinkpad Servers - PSW #771 Feb 02, 2023

Show notes

In the Security News for this week: defending against cleaning services, catastrophic mutating events and the future, myths and misconceptions, finding vulnerabilities in logs (And not log4j), SSRF leads to RCE with a PoC, SQLi with XSS bypasses WAF FTW, thinkpad as a server, RPC directory traversal for the win, just directory traversal for the win, Paul gets a Flipper Zero and how he thinks he's some sort of hero, sh1mmer your chromebook, and superconductive magic angle graphene!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw771

The Power of Purple Teaming: Using Runbooks to Standardize and Collaborate - Dan DeCloss - PSW #771 Feb 02, 2023

Show notes

In a recent survey on purple teaming, 89 percent of respondents who had used the method deemed purple teaming activities "very important" to their security operations. Purple teaming exercises conducted regularly have the power to improve collaboration across teams, ensure issues are identified and remediated more proactively, and provide a means to measure progress over time. With all these benefits, why isn't everyone doing it? Purple teaming doesn't have to be such a heavy lift. With the right mindset and tools, any team can get started regardless of resources. This talk will highlight practical tips for getting started with purple teaming exercises and show off PlexTrac Runbooks, a platform designed to plan, execute, report, and remediate collaborative purple teaming engagements so teams can maximize their efforts and improve their security posture.

Segment Resources:

Learn more and book a demo: https://plextrac.com/securityweekly

More information on Runbooks: https://plextrac.com/platform/runbooks/

This segment is sponsored by PlexTrac. Visit https://securityweekly.com/plextrac to learn more about them!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw771