Security Weekly Podcast Network (Video)

Latest Episodes:

In Search of Secure Design - ASW #325 Apr 08, 2025

Show notes

We have a top ten list entry for Insecure Design, pledges to CISA's Secure by Design principles, and tons of CVEs that fall into familiar categories of flaws. But what does it mean to have a secure design and how do we get there? There are plenty of secure practices that orgs should implement are supply chains, authentication, and the SDLC. Those practices address important areas of risk, but only indirectly influence a secure design. We look at tactics from coding styles to design councils as we search for guidance that makes software more secure.

Segment resources

Show Notes: https://securityweekly.com/asw-325

Best of Cyber April Fools, Tons of Free Tools, runZero positioned to disrupt? - ESW #401 Apr 07, 2025

Show notes

This week, in the enterprise security news,

we check the vibes
we check the funding
we check runZero's latest release notes
tons of free tools!
the latest TTPs
supply chain threats
certs won't save you
GRC needs disruption
the latest Rippling/Deel drama

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-401

How attackers exploit identity gaps to get into your cloud and SaaS - Paul Nguyen - ESW #401 Apr 07, 2025

Show notes

You might know them from their excellent research work on groups like Scattered Spider, or their refreshing branding/marketing style, but Permiso is laying some impressive groundwork for understanding and defending against identity and cloud-based attacks. In this interview, we talk with co-founder and co-CEO Paul Nguyen about understanding the threats against some of cybercriminals' favorite attack surface, insider threats, and non-human identity compromise.

Segment Resources:

This blog post from our threat research team on Scattered Spider shows how threat actors move laterally in an environment across identity providers, Iaas, PaaS and SaaS environments, and how this lateral movement ultimately creates blind spots for many security teams
This great talk by Ian Ahl, from fwd:cloudsec 2024, touches on a lot of great TTPs used by attackers in IDPs and in the cloud
Another blog, When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying
and another, What Security Teams Can Learn From The Rippling/Deel Lawsuit: Intent Lies in Search Logs

Show Notes: https://securityweekly.com/esw-401

Soft skills for engineers - Evgeniy Kharam - ESW #401 Apr 06, 2025

Show notes

When we use the phrase "talent gap" in cybersecurity, we're usually talking about adding headcount. For this interview, however, we're focusing on a gap that is evident within existing teams and practitioners - the often misunderstood soft skills gap.

Side note: I really hate the term "soft skills". How about we call them "fundamental business skills", or "invaluable career advancement skills"? Hmm, doesn't quite roll off the tongue the same.

Soft skills can impact everything, as they impose the limits of how we interact with our world. That goes for co-worker interactions, career advancements, and how we're perceived by our peers and community. It doesn't matter how brilliant you might be - without soft skills, your potential could be severely limited.

Did you know that soft skills issues contributed to the Equifax breach?

We'll also discuss how fear is related to some of the same limitations and challenges as soft skills.

Segment Resources:

Show Notes: https://securityweekly.com/esw-401

AI Doomsday, Hot Robots, Google, palo Alto, Ivanti, CrushFTP, AI, Aaran Leyland... - SWN #465 Apr 04, 2025

Show notes

AI Doomsday, Hot Robots, Google, palo Alto, Ivanti, CrushFTP, AI, Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-465

Not-So-Secure Boot - Rob Allen - PSW #868 Apr 03, 2025

Show notes

Rob Allen, Chief Product Officer at Threatlocker joins us for an interview segment on using AI in security products: What works and what's not fully baked! Then in the security news, There are more holes in your boot...loader according to Microsoft, related: Secure Boot is in danger and no one is really talking about it (still), Dear Microsoft: I don't want to send you my data, I don't grant you remote access, and I don't want to create a MS account, CrushFTP has to crush some bugs, bypassing unprivileged user namespace restrictions, FBI raids, attackers using your GPU, Find My anything, protecting GlobalProtect, the exploits will continue until things improve, your call records were not protected, good vs. bad drivers, AI is hacking AI, time traveling attacks, and a bizarre call for security researchers.

This segment is sponsored by ThreatLocker. Visit https://www.securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/psw-868

Vulnerability Prioritization Can Produce Better Business Outcomes - Greg Fitzgerald, Steve Lodin - BSW #389 Apr 02, 2025

Show notes

Vulnerability prioritization, the final frontier. Many say they do it, but do they really? It takes way more than vulnerability data to truly prioritize vulnerabilities.

Greg Fitzgerald, Co-Founder and CXO at Sevco Security, and Steve Lodin , Vice President, Information Security at Sallie Mae, join Business Security Weekly to dig in. We'll discuss the importance of context, including asset inventory and configuration management, in truly prioritizing vulnerabilities. But it's not that easy. We'll discuss the challenges and approaches to help solve this ever evasive topic.

This segment is sponsored by Sevco Security. Visit https://securityweekly.com/sevco to learn more about them!

Segment Resources: https://www.sevcosecurity.com/vulnerability-prioritization/ https://www.sevcosecurity.com/continuous-threat-exposure-management/

Show Notes: https://securityweekly.com/bsw-389

Schrodinger, Lucid, Crocodilus, Wordpress, Ivanti, Oracle, Android, Josh Marpet... - SWN #464 Apr 01, 2025

Show notes

Schrodinger's Television, Lucid, Crocodilus, Wordpress, Ivanti, Oracle, Android, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-464

Avoiding Appsec's Worst Practices - ASW #324 Apr 01, 2025

Show notes

We take advantage of April Fools to look at some of appsec's myths, mistakes, and behaviors that lead to bad practices. It's easy to get trapped in a status quo of chasing CVEs or discussing which direction to shift security. But scrutinizing decimal points in CVSS scores or rearranging tools misses the opportunity for more strategic thinking. We satirize some worst practices in order to have a more serious discussion about a future where more software is based on secure designs.

Segment resources:

Show Notes: https://securityweekly.com/asw-324

The toughest decisions CISOs have to make, MCP servers, Napster's comeback - ESW #400 Mar 31, 2025

Show notes

In this week's enterprise security news,