Security Weekly Podcast Network (Video)

Latest Episodes:

Say Easy, Do Hard - Data Inventory and Classification, Part 1 - BSW #383 Feb 19, 2025

Show notes

Application, user, and data security are the three core components of every security program, but data is really what attackers want. In order to protect that data, we need to know where it is and what it's used for. Easier said than done. In this Say Easy, Do Hard segment, we tackle data inventory and classification.

In part 1, we discuss the challenges of data inventory and classification, including:

identifying all data sources within an organization, including databases, applications, cloud storage, physical files, etc., and documenting details like data type, location, and volume
categorizing all data based on its sensitivity level, usually using classifications like "public," "internal," "confidential," or "restricted," which determines the necessary security measures to protect it
prioritizing security measures and protecting critical information more effectively

Show Notes: https://securityweekly.com/bsw-383

AI Threat Intelligence, AI Hacking, Data Breaches, Zhong, DOGE, and more - SWN #452 Feb 18, 2025

Show notes

This week in the Security Weekly News: AI Threat Intelligence, AI Hacking, Data Breaches, Zhong, DOGE, and more!

Show Notes: https://securityweekly.com/swn-452

Top 10 Web Hacking Techniques of 2024 - James Kettle - ASW #318 Feb 18, 2025

Show notes

We're getting close to two full decades of celebrating web hacking techniques. James Kettle shares which was his favorite, why the list is important to the web hacking community, and what inspires the kind of research that makes it onto the list. We discuss why we keep seeing eternal flaws like XSS and SQL injection making these lists year after year and how clever research is still finding new attack surfaces in old technologies. But there's a lot of new web technology still to be examined, from HTTP/2 and HTTP/3 to WebAssembly.

Segment Resources:

Top 10, 2024: https://portswigger.net/research/top-10-web-hacking-techniques-of-2024
Full nomination list: https://portswigger.net/research/top-10-web-hacking-techniques-of-2024-nominations-open
Project overview: https://portswigger.net/research/top-10-web-hacking-techniques

Show Notes: https://securityweekly.com/asw-318

The dark side of security leadership, will agentic be a thing, OWASP AI resources - ESW #394 Feb 17, 2025

Show notes

In this week's enterprise security news, we've got

5 acquisitions
Tines gets funding
new tools and DFIR reports to check out
A legal precedent that could hurt AI companies
AI garbage is in your code repos
the dark side of security leadership
HIPAA fines are broken
Salt Typhoon is having a great time
Don't use ChatGPT for legal advice!!!!!

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-394

A SecOps Medley: we talk automation, AI, data management, and EDR evaluations - Allie Mellen - ESW #394 Feb 17, 2025

Show notes

We couldn't decide what to talk to Allie about, so we're going with a bit of everything. Don't worry - it's all related and ties together nicely.

First, we'll discuss AI and automation in the SOC - Allie is covering this trend closely, and we want to know if she's seeing any results yet here.
Next, we'll discover SecOps data management - the blood that delivers oxygen to the SOC muscles.
Finally, we'll discuss MITRE's recent EDR evaluations - there was some contention around some vendors claiming to ace the test and we're going to get the tea on what's really going on here!

For each of these three topics, these are the blog posts they correspond with if you want to learn more:

Show Notes: https://securityweekly.com/esw-394

Evolving the SOC: Automating Manual Work while Maintaining Quality at Scale - Tim MalcomVetter - ESW #394 Feb 16, 2025

Show notes

We've got a few compelling topics to discuss within SecOps today. First, Tim insists it's possible to automate a large amount of SecOps work, without the use of generative AI. Not only that, but he intends to back it up by tracking the quality of this automated work with an ISO standard unknown to cybersecurity.

I've often found useful lessons and wisdom outside security, so I get excited when someone borrows from another, more mature industry to help solve problems in cyber. In this case, we'll be talking about Acceptable Quality Limits (AQL), an ISO standard quality assurance framework that's never been used in cyber.

Segment Resources:

Show Notes: https://securityweekly.com/esw-394

Bad Romance, Kimsuky, Red Mike, Ivanti, Nvidia, C code, Postgre, Aaran Leyland... - SWN #451 Feb 14, 2025

Show notes

Tunnel of Love, Kimsuky, Red Mike, Ivanti, Nvidia, C code, Postgre, Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-451

Prompt Injection, CISA, Patch Tuesday - PSW #861 Feb 13, 2025

Show notes

You can install Linux in your PDF, just upload everything to AI, hackers behind the forum, TP-Link's taking security seriously, patche Tuesday for everyone including Intel, AMD, Microsoft, Fortinet, and Ivanti, hacking your space heater for fun and fire, Cybertrucks on fire (or not), if you could just go ahead and get rid of the buffer overflows, steam deck hacking and not what you think, Prompt Injection and Delayed Tool Invocation, new to me Ludus, Contec patient monitors are just insecure, Badbox carries on, the compiler saved me, and Telnet command injection!

Show Notes: https://securityweekly.com/psw-861

Speak the Same Language, as Cybersecurity is Everyone's Responsibility - BSW #382 Feb 12, 2025

Show notes

This week, we tackle a ton of leadership and communications articles: Why CISOs and Boards Must Speak the Same Language on Cybersecurity, The Hidden Costs of Not Having a Strong Cybersecurity Leader, Why Cybersecurity Is Everyone's Responsibility, Leadership is an Action, not a Position, and more!

Show Notes: https://securityweekly.com/bsw-382

PlayStation, KerioControl, SEC SimSWAP, 8base, Copilot, AI, Bird, Josh Marpet... - SWN #450 Feb 11, 2025

Show notes

PlayStation, KerioControl, SEC SimSWAP, 8base, Copilot, AI, Robert Bird, Josh Marpet, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-450