Security Weekly Podcast Network (Video)

Latest Episodes:

Helping Secure OSS Software - Alvaro Munoz - ASW #189 Mar 22, 2022

Show notes

Past research such as JNDI Injection, Unsafe deserialization, Struts RCEs - OSS security: CodeQL, Dependabot, collaboration between researchers and developers, OWASP Top Ten Proactive Controls, CVD for OSS

Segment Resources:

- [Write more secure code with the OWASP Top 10 Proactive Controls] https://github.blog/2021-12-06-write-more-secure-code-owasp-top-10-proactive-controls/

- [An analysis on developer-security researcher interactions in the vulnerability disclosure process] https://github.blog/2021-09-09-analysis-developer-security-researcher-interactions-vulnerability-disclosure/

- [Building security researcher and developer collaboration] https://www.securitymagazine.com/articles/97066-how-to-build-security-researcher-and-software-developer-collaboration

- [Coordinated vulnerability disclosure (CVD) for open source projects] https://github.blog/2022-02-09-coordinated-vulnerability-disclosure-cvd-open-source-projects/

- [GitHub Advisory Database now open to community contributions] https://github.blog/2022-02-22-github-advisory-database-now-open-to-community-contributions/

- [Blue-teaming for Exiv2: creating a security advisory process] https://github.blog/2021-11-02-blue-teaming-create-security-advisory-process/

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw189

A Great Escape, Peace Not War, & How to Burp Good - ASW #189 Mar 22, 2022

Show notes

This week in the AppSec News: A great escape isn't always as great as it sounds, Solana cryptocurrency logic isn't always as great as intended, some people's idea of "peace" isn't that great at all, and some great security suggestions for package maintainers.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw189

PeaceNoToWar, NortonLifeLock Pending UK Inquiry, RSA Con, & Space Force Insignia - ESW #265 Mar 19, 2022

Show notes

This week in the Enterprise News: Quincy man rescues coworker from Ukraine, Cloudflare Email Security Tools, New CISA Vulns, RSA Conference Acquired, Massive Rounds, & \Incident Reporting Signed into Law, & more!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw265

Ransomware Inc, Cracking Keys With Fermat, Neon Output, & Samsung Source Code - PSW #732 Mar 19, 2022

Show notes

In the Security News: Secret Keys in Samsung Source Code, Conti (tries) to go legit, Cracking crypto keys with a 300 year old algorithm, CISA's must patch list, FTC fines CafePress over Data Breach, & more!

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw732

Building a Proactive Security Strategy - Pablo Zurro - ESW #265 Mar 19, 2022

Show notes

Learn how a proactive cybersecurity program can be a game changer for an organization's success through continuously assessing risk and evolving to stay ahead of threats. Join us as we discuss impactful ways to stay one step ahead with Pablo Zurro, Product Manager at Core Security, by HelpSystems.

Segment Resources: [

Guide] Taking Back Control: A Proactive Approach to Advance Your Security Maturity

- https://static.helpsystems.com/core-security/pdfs/guides/cs-advancing-your-security-maturity-gd.pdf

[Video] Core Impact Pen Testing Software Overview

- https://www.coresecurity.com/resources/videos/core-impact-overview

https://static.helpsystems.com/hs/pdfs/2022/datasheet/hs-security-maturity-matrix-ds.pdf

This segment is sponsored by Core Security, A Help Systems Company. Visit https://securityweekly.com/coresecurity to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw265

How Leveraging Crowdsource Is the Best Way to Bolster Your Security - Johanna Ydergard - ESW #265 Mar 18, 2022

Show notes

The segment will cover a brief overview of the attack surface market - what it is, why it's necessary to have an additional tool along with DAST, SAST. It will also cover how Detectify's unique advantage of crowdsourcing is a true differentiator in the EASM market and how the model differs from the big Bug Bounty Platforms. It will detail on how Detectify collaborates with ethical hackers to crowdsource security research from the forefront of the industry, so you can check for 2000+ common vulnerabilities.

Segment Resources:

https://detectify.com/external-attack-surface-management

https://detectify.com/crowdsource/what-is-crowdsource

This segment is sponsored by Detectify. Visit https://securityweekly.com/detectify to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw265

Making Cyber Accessible to Everyone - Lawrence Nunn, Ricky Tan - PSW #732 Mar 18, 2022

Show notes

Teleseer makes cyberspace easy to see, just like watching security footage. It lets users builds interactive network maps in seconds with data they already have. We can inventory thousands of assets or protocols and show their connections in a multi-layer map. No installing agents, no scanning. Teleseer gives you the visibility to make smart cyber decisions faster.

Segment Resources:

https://teleseer.com

https://cyberspatial.com

https://www.youtube.com/c/cyberspatial

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw732

From Hacker Jeopardy to CISO Tradecraft - G Mark Hardy - PSW #732 Mar 18, 2022

Show notes

G Mark's Law states "Half of what you know about security will be obsolete in 18 months." But sometimes you have to let go to move forward. If you're the smartest person in the room, chances are you're not the boss. Let's talk about that and other dilemmas in our security career journey!

Segment Resources:

https://www.cisotradecraft.com

https://www.gmarkhardy.com

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw732

In Name Only, "Reasonable" Cybersecurity, & Value in Veterans - BSW #254 Mar 16, 2022

Show notes

In the Leadership and Communications section: CISOs are still chiefs in name only, Defining "Reasonable" Cybersecurity: Lessons from the States, Security Leaders Find Value in Veterans to Solve Cyber Skills Shortage, and more!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw254

Security Hygiene, Doing All the Little Things Right (All the Time) - Jody Brazil - BSW #254 Mar 15, 2022

Show notes

It doesn't matter how much security technology you have, how much you spend on security: security outcomes are achieved by doing all the little things right. You can spend $10M on network security technology from any vendor, but you will fail to effectively secure your enterprise if you don't properly manage the policy enforced by those firewalls. That sounds really simple, but simple doesn't scale. If you only have a few firewalls with policies consisting of tens of rules, it may be simple. But imagine an enterprise that has 2,000 firewalls, each firewall has a policy with an average of 500 rules, each rule has an average of 15 objects, each source and destination object represent an average of 50 IP addresses. This enterprise is managing, 2,000 firewalls, 1 million rules, 125 million connections, representing over 300 billion access paths. And just 1 wrong rule could expose the network to compromise.

This segment is sponsored by FireMon. Visit https://securityweekly.com/firemon to learn more about them!

Visit https://www.securityweekly.com/bsw for all the latest episodes!

Show Notes: https://securityweekly.com/bsw254