Security Weekly Podcast Network (Video)

Latest Episodes:

Escaping from BlastDoor's Sandbox, Spring RCE, Old Zlib Flaw, Startup Security - ASW #191 Apr 05, 2022

Show notes

FORCEDENTRY implications for the BlastDoor sandbox, Spring RCE, Zlib flaw resurfaces, security for startups, verifying Rust models, two HTML parsers lead to one flaw

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw191

Democratizing Software Security - Eric Allard - ASW #191 Apr 04, 2022

Show notes

Making a positive impact to how we package software to make developer's lives easier in how they have to manage security.

Segment Resources:

- https://app.soos.io/demo

- https://soos.io/

- https://youtu.be/Y8jvhCHGQg8

This segment is sponsored by soos.io. Visit https://securityweekly.com/soos to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw191

Zimperium, Crypto Heists, NPM Attack, $11B For CyberSec, & a Threat to SPACs - ESW #267 Apr 02, 2022

Show notes

In the Enterprise Security News for this week: 14 cybersecurity startups have raised funding! Massive late stage market corrections underway and talks of self-repricing valuations, A private equity firm acquires Zimperium, Even more massive amounts of cryptocurrency are stolen, The NPM package library is under active, constant attack, Microsoft Azure Defender IoT has trivial critical vulnerabilities, White house earmarks $11B for cybersecurity, Death to SPACs, as well as Several new security vendors and products!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw267

Clearing the Air on Zero Trust - Steven Turner - ESW #267 Apr 02, 2022

Show notes

Cybersecurity buzzwords tend to go through a process. They're used as a differentiator. Then everyone adopts them and things get out of control. The term Zero Trust originally gained traction in InfoSec thanks to the model designed by John Kindervag during his time at Forrester. These days, you could be seeing the term Zero Trust because:

1. a vendor makes a product that fits into any one of dozens of categories that contribute to a Zero Trust architecture (IAM, MFA, ZTNA, micro segmentation, directory services, etc)

2. a vendor is using 'zero trust' as a metaphor (small z, small t)

3. a vendor is using 'zero trust' as a philosophy, or company principle (small z, small t)

4. the CMO said it needs to be somewhere on the website for SEO

5. someone told a founder to put it in the sales and/or pitch deck

Steve joins us to separate the cyber virtue signaling from the truth of what Zero Trust actually looks like, why it's difficult, and what impact federal interest in Zero Trust will have on this trend.

Segment Resources:

NIST SP 800-207

https://csrc.nist.gov/publications/detail/sp/800-207/final

UK NCSC ZT Guidance

https://github.com/ukncsc/zero-trust-architecture

USA CISA/OMB ZT Guidance

https://zerotrust.cyber.gov/

DOD ZT Reference Architecture

https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf

Microsoft ZT Guidance

https://docs.microsoft.com/en-us/security/zero-trust/

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw267

Teenage Masterminds, Hacking Civics, Journalists Sued, UPS Attacks, & Spyware - PSW #734 Apr 01, 2022

Show notes

This week in the Security News: Military intelligence, Chrome updates, an exploit for the firewall, racing the kernel, creepy spyware goes away?, weaponizing security complexity, same old tricks, the largest crypto hack, suing journalists, targeting your battery backup, the teenager behind Lapsus$, spring exploits just in time for spring, and hacking your Honda Civic, & more!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw734

Breaking into Cyber - Perspective from a High School - Tim Cathcart - ESW #267 Apr 01, 2022

Show notes

High School students represent the very beginning of the pipeline for the Cyber industry. What are the attitudes and perspectives of these young people? How can we attract the best and brightest into our industry?

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw267

State of the SOC - Mark Boltz-Robinson - PSW #734 Apr 01, 2022

Show notes

Mark is currently involved in building a security operations center for a large organization with an established infrastructure and teams already in place. In this chat, we'll explore the state of the SOC today, the challenges of building one, the reality versus expectations roles, what is SOAR'ing and not, and more. Tangential paths will likely be followed, as information security is fun to talk about in general!

Segment Resources:

http://www.securitybsides.com

https://www.bsidesdc.org

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw734

Training the Next Gen of Cybersecurity Experts to Protect K-12 Schools - Hanine Salem - PSW #734 Mar 31, 2022

Show notes

With an alarming increase in K-12 cybersecurity attacks, districts are considering new ways to protect their students and staff. With the need to increase the cybersecurity talent pipeline, the solution to the problem is much larger than just increasing protective technology measures to keep schools safe. Schools must also be proactive in training the next generation of cybersecurity experts.

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw734

Cyber Risk Quantification, Enterprise Security Metrics, & Fixing Hiring - BSW #256 Mar 30, 2022

Show notes

In the Leadership and Communications section: Cybersecurity Threat Level is High; Be Pro-Active, Cyber Risk Quantified is Cyber Risk Managed, 5 Ways Managers Sabotage the Hiring Process, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw256

Forecasting Risk - What Every CISO and CIO Needs to Know - Charlene Deaver-Vazquez - BSW #256 Mar 29, 2022

Show notes

Every CISO CIO asks the question, what's the risk? Quantitative analysis, mathematical models are designed to answer this question. Understand how they work, when to use them, and what they can tell us.

Segment Resources:

https://www.amazon.com/Ensure-Business-Success-Informed-Decisions-ebook/dp/B09Q7R1HY4

https://fismacs.com/blog/

https://portal.fismacs.com/p/p-rmod4cyber

https://fismacs.com/white-paper-mhp-ip4cyber/

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw256