Security Weekly Podcast Network (Video)

Latest Episodes:

How IaC is Changing Cloud Security for the Better - Tony Karam - ESW #297 Nov 17, 2022

Show notes

Infrastructure-as-code (IaC) allows for quick and consistent configuration and deployment of infrastructure components because it's defined through code. It also enables repeatable deployments across environments. IaC is seeing significant attention in the cloud security space, but why now? This conversation will dig into how Infrastructure-as-code is enabling faster innovation on application development with security built in.

Segment Resources:

- https://www.lacework.com/solutions/infrastructure-as-code/

- https://www.lacework.com/blog/introducing-secure-automated-iac-deployments-with-terraform/

- https://info.lacework.com/cloud-threat-report.html

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw297

Stealing Mastodon Passwords, Update Your Firmware on Linux, & Oops I Leaked Again - PSW #764 Nov 17, 2022

Show notes

In the Security News: Stealing Mastodon passwords, reporting vulnerabilities in open-source privately, labeling does not solve problems, or does it? will it every get patched? geolocating people from photos, no meta-data required, update your firmware on Linux, hacking flow computers, when a driver isn't really a driver, well, its a driver, but not the one you may be thinking of, oops I leaked it again, misconfiguration leads to compromise, harden runner, guard dog and hacking spacecraft via Ethernet!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw764

UEFI & SMM Vulnerabilities - Jesse Michael - PSW #764 Nov 17, 2022

Show notes

Navigating the UEFI waters is treacherous. While UEFI has become the standard on most PCs, servers, and laptops, replacing legacy BIOS, it is a complex set of standards and protocols. Jesse joins us to help explain how some of this works and describe how vulnerabilities, specifically with SMM, can manifest and be exploited.

Segment Resources:

[CHIPSEC GitHub] https://github.com/chipsec/chipsec

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw764

CosMiss, Pixel Lock Screen Bypass, IIoT Path Traversal, NSA on C & C++, Code Reviews - ASW #220 Nov 16, 2022

Show notes

CosMiss in Azure, $70k bounty for a Pixel Lock Screen bypass, finding path traversal with Raspberry Pi-based emulators, NSA guidance on moving to memory safe languages, implementing phishing-resistant MFA, egress filtering, and how to approach code reviews

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw220

Meet Fortra, Your Cybersecurity Ally - John Grancarich, Mike Devine - BSW #285 Nov 15, 2022

Show notes

Positive change is coming to cybersecurity. In this segment, Mike Devine (CMO) and John Grancarich (EVP of Strategy) at Fortra discuss the business of leading a cybersecurity company, the reasons behind our recent rebrand, and our plans for continuing as a people-first company that collaborates with our customers to combat the threat landscape with confidence.

This segment is sponsored by Fortra. Visit https://securityweekly.com/fortra to learn more about them!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw285

The Top 10 CI/CD Security Risks and CI/CD Goat - Daniel Krivelevich - ASW #220 Nov 15, 2022

Show notes

Cider Security's recently published research of the Top 10 CI/CD Security Risks acts to identify vulnerabilities to help defenders focus on areas to secure their CI/CD ecosystem. They created a free learning tool with a deliberately vulnerable environment to demonstrate these flaws -- "CI/CD Goat". Like similar tools, this helps appsec and devops teams gain a better understanding of major CI/CD security risks and, importantly, their appropriate countermeasures.

Segment Resources:

- https://www.cidersecurity.io/top-10-cicd-security-risks/

- https://github.com/cider-security-research/top-10-cicd-security-risks

- https://www.cidersecurity.io/blog/research/ci-cd-goat/

- https://github.com/cider-security-research/cicd-goat

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw220

Cybersecurity Leaders Quitting as New Cybersecurity Regulations Kick-in? - BSW #285 Nov 15, 2022

Show notes

In the leadership and communications section, Is Your Board Prepared for New Cybersecurity Regulations?, 32% of cybersecurity leaders considering quitting their jobs, 40 Jargon Words to Eliminate from Your Workplace Today, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw285

The Joe Sullivan Case: Anomaly or Precedent? Part 1 - ESW #296 Nov 11, 2022

Show notes

In this panel discussion, we'll discuss the polarizing case of Joe Sullivan that has rattled the CISO community. Was the Sullivan case a rare anomaly? Were his actions in this scenario typical or unconscionable for the average CISO? Is it okay for Sullivan to take the fall while the rest of Uber and involved parties plead out with little to no punishment?

We'll tackle all these questions and more with our excellent panel, comprised of:

Sounil Yu, CISO and Head of Research at JupiterOne

Brian Markham, CISO at EAB

Rich Friedburg, CISO at Live Oak Bank

Robert Graham, Owner at Errata Security

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw296

The Joe Sullivan Case: Anomaly or Precedent? Part 2 - ESW #296 Nov 10, 2022

Show notes

We'll tackle all these questions and more with our excellent panel, comprised of:

Sounil Yu, CISO and Head of Research at JupiterOne

Brian Markham, CISO at EAB

Rich Friedburg, CISO at Live Oak Bank

Robert Graham, Owner at Errata Security

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw296

Modern Access Security: Ditch Passwords, Implement 0-Trust & Secure APIs - Travis Spencer - ESW #296 Nov 10, 2022

Show notes

Don't leave the door open. Modern systems are complex and require you to consider many aspects. Here are some aspects we consider critical: - APIs are the dominant software development direction/trend. Traditional/legacy ways to grant access is not fit for purpose of protecting this new way of delivering products and services. - Customers are demanding better digital experiences. To maintain a competitive edge and drive brand loyalty businesses need to provide great online experiences. - Standards (such as OAuth and OpenID Connect) are important to ensure high-security levels. Also enables scalability and helps future-proof your infrastructure. For example in the financial sector, these standards play a key role in the drive toward open banking. - A modern architecture is a zero trust architecture. In a zero trust architecture, the new perimeter hinges on identity.

Segment Resources:

https://thenewstack.io/zero-trust-time-to-get-rid-of-your-vpn/

This segment is sponsored by Curity. Visit https://securityweekly.com/curity to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw296