Security Weekly Podcast Network (Video)

Latest Episodes:

D3FEND 1.0: A Milestone in Cyber Ontology - Peter Kaloroumakis - ESW #388 Dec 20, 2024

Show notes

Since D3FEND was founded to fill a gap created by the MITRE ATT&CK Matrix, it has come a long way. We discuss the details of the 1.0 release of D3FEND with Peter in this episode, along with some of the new tools they've built to go along with this milestone.

To use MITRE's own words to describe the gap this project fills:

"it is necessary that practitioners know not only what threats a capability claims to address, but specifically how those threats are addressed from an engineering perspective, and under what circumstances the solution would work"

Segment Resources:

https://d3fend.mitre.org

Show Notes: https://securityweekly.com/esw-388

The Number One Threat - PSW #855 Dec 19, 2024

Show notes

XSS is the number one threat?, fix your bugs faster, hacking VoIP systems, AI and how it may help fuzzing, hacker gift guides, new DMA attacks, hacking InTune, Rhode Island gets hacked, OpenWrt supply chain issues, we are being spied on, Germans take down botnet, Bill and Larry are speaking at Shmoocon!, and TP-Link bans.

Show Notes: https://securityweekly.com/psw-855

When Public Payphones Become Smart Phones - Inbar Raz - PSW #855 Dec 19, 2024

Show notes

If you've ever wondered how attackers could go after payphones that are "smart" we got you covered! Inbar has done some amazing research and is here to tell us all about it!

Segment Resources: https://www.retro.unarmedsecurity.net/post/%D7%9E%D7%A1%D7%AA%D7%91%D7%A8-%D7%A9%D7%92%D7%9D-%D7%98%D7%9C%D7%A4%D7%95%D7%9F-%D7%A6%D7%99%D7%91%D7%95%D7%A8%D7%99-%D7%94%D7%95%D7%90-%D7%98%D7%9C%D7%A4%D7%95%D7%9F-%D7%97%D7%9B%D7%9D

Show Notes: https://securityweekly.com/psw-855

Day in the Life of a CISO, as They Consider Personal Risks and New Defenses in 2025 - BSW #376 Dec 18, 2024

Show notes

In the leadership and communications segment, CISOs need to consider the personal risks associated with their role, CISOs: Don't rely solely on technical defences in 2025, The Questions Leaders Need to Be Asking Themselve, and more!

Show Notes: https://securityweekly.com/bsw-376

NAC is Back - How Network Access Control Can Protect Your Remote Devices and Data - Rob Allen - BSW #376 Dec 18, 2024

Show notes

The local network is no more. Neither is the corporate firewall. Users are not only working from the office but also remotely, meaning the network we utilize has quickly become the internet, leaving devices and data vulnerable to cyber threats. But how do we monitor this new, expanded network?

Rob Allen, Chief Product Officer at ThreatLocker, joins Business Security Weekly to discuss how the dissolution of the business perimeter makes network access controls essential to protect your devices and, by extension, your data. Network Access Control helps protect business assets whether employees are in the office or remote. ThreatLocker Network Control provides a direct connection between the client and server, as opposed to a VPN that goes through a central point.

This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them!

Show Notes: https://securityweekly.com/bsw-376

Vogons, Task Scams, HiatusRat, Cellebrite, Deloitte, Quantum, Aaran Leyland, and More - SWN #438 Dec 17, 2024

Show notes

Vogons, Task Scams, HiatusRat, Cellebrite, Deloitte, Quantum, WordPress, Aaran Leyland, and more on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-438

Ancient Curl Bug, AWS re:Invent, Malware in NPM, Census III Report, MS OTP - ASW #311 Dec 16, 2024

Show notes

Curl's oldest bug yet, RCPs (and more!) from AWS re:Invent, possible controls for NPM's malware proliferation, insights and next steps on protecting top 500 packages from the Census III report, the flawed design choice that made Microsoft's OTP (successfully) brute-forceable, and more!

00:00 - Intro & Cyber Resilience Insights 01:20 - The 25-Year-Old Curl Bug Story 04:17 - Fuzzing for Security: A Missed Opportunity? 08:46 - AWS re:Invent Security Highlights 11:54 - NPM Malware Surge 16:33 - Small Packages, Big Risks in NPM 19:55 - Open Source Security Trends 24:27 - Microsoft MFA Vulnerability Explained 28:28 - Hardware Hacking & DMA Exploits 30:55 - Auditing Ruby's Package Ecosystem 34:02 - Looking Ahead to 2025

Show Notes: https://securityweekly.com/asw-311

Applying Usability and Transparency to Security - Hannah Sutor - ASW #311 Dec 16, 2024

Show notes

Practices around identity and managing credentials have improved greatly since the days of infosec mandating 90-day password rotations. But those improvements didn't arise from a narrow security view. Hannah Sutor talks about the importance of balancing security with usability, the importance of engaging with users when determining defaults, and setting an example for transparency in security disclosures.

Segment resources

https://youtu.be/ydg95R2QKwM

00:00 Welcome to Application Security Weekly! 01:49 Meet the Experts 03:28 What Are Non-Human Identities? 06:17 Balancing Security & Usability 08:24 MFA Challenges & Admin Security 12:09 Navigating Breaking Changes 16:05 Security by Design in Action 18:42 Identity Management for Startups 20:18 Secure by Design: Real Impact 24:03 Transparency After a Critical Vulnerability 31:39 Looking Ahead to 2025 32:45 Application Security in Three Words

Show Notes: https://securityweekly.com/asw-311

AWS does IR, credit card canarytokens, shared responsibility, phishing tests do harm - ESW #387 Dec 14, 2024

Show notes

This week, in the enterprise security news,

NOTE: We didn't get to 2, 3, 5, or 7 due to some technical difficulties and time constraints, but we'll hit them next week! The show notes have been updated to reflect what we actually discussed this week: https://www.scworld.com/podcast-segment/13370-enterprise-security-weekly-387

Snowflake takes security more seriously
Microsoft takes security more seriously
US Government takes telecom security more seriously
Cleo Capital takes security more seriously
EU's DORA takes effect soon
Is phishing and security awareness training worthless?
CISOs need financial literacy
Supply chain firewall is basic but useful

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-387

Pondering Portable Passwordless Passkeys in 2025 - Rew Islam - ESW #387 Dec 13, 2024

Show notes

In this segment, we discuss two new FIDO Alliance standards focused on credential portability. Specifically, if passwordless is going to catch on, we need to minimize friction and maximize usability. In practice, this means that passkeys must be portable!

Rew Islam of Dashlane joins us to discuss the new standards and how they'll help us enter a new age of secure authentication, both for consumers and the enterprise.

Segment Resources:

Show Notes: https://securityweekly.com/esw-387

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected