Security Weekly Podcast Network (Video)

Latest Episodes:

Answering the Board's Questions While UnitedHealth Group 'Starts Over' - BSW #365 Sep 23, 2024

Show notes

In the leadership and communications segment, CISA Releases Cyber Defense Alignment Plan for Federal Agencies, UnitedHealth Group CISO: We had to 'start over' after Change Healthcare attack, 20 Essential Strategies for Leadership Development Success, and more!

Show Notes: https://securityweekly.com/bsw-365

Cybersecurity: is the talent gap a myth? Is the industry delusional? - ESW #376 Sep 21, 2024

Show notes

This week, the cybersecurity industry's most basic assumptions under scrutiny. Following up our conversation with Wolfgang Goerlich, where he questions the value of phishing simulations, we discuss essays that call into question:

the maturity of the industry
the supposed "talent gap" with millions of open jobs despite complaints that this industry is difficult to break into
cybersecurity's 'delusion' problem

Also some whoopsies:

researchers accidentally take over a TLD
When nearly all your customers make the same insecure configuration mistakes, maybe it's not all their fault, ServiceNow finds out

Fortinet has a breach, but is it really accurate to call it that?

Some Coalfire pentesters that were arrested in Iowa 5 years ago share some unheard details about the event, and how it is still impacting their lives on a daily basis five years later.

The news this week isn't all negative though! We discuss an insightful essay on detection engineering for managers from Ryan McGeehan is a must read for secops managers.

Finally, we discuss a fun and excellent writeup on what happens when you ignore the integrity of your data at the beginning of a 20 year research project that resulted in several bestselling books and a Netflix series!

Show Notes: https://securityweekly.com/esw-376

Speed, Flexibility, and AI: The Case for Migrating from Legacy SOAR Systems - Whitney Young - ESW #376 Sep 20, 2024

Show notes

In this episode, we explore some compelling reasons for transitioning from traditional SOAR tools to next-generation SOAR platforms. Discover how workflow automation and orchestration offers unparalleled speed and flexibility, allowing organizations to stay ahead of evolving security threats. We also delve into how advancements in AI are driving this shift, making new platforms more adaptable and responsive to current market demands.

Segment Resources:

This segment is sponsored by Tines. Visit https://securityweekly.com/tines to learn more about them!

Show Notes: https://securityweekly.com/esw-376

Shroombots, pagers, Tor, Raptor Train, GRU, Blue Light, Aaran Leyland, and More... - SWN #415 Sep 20, 2024

Show notes

Shroombots, pagers, Tor, Raptor Train, GRU, Blue Light, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-415

Back to the office, Void Banshee, ServiceNow, Taiwan, Dlink, C++, Aaran Leyland... - SWN #414 Sep 20, 2024

Show notes

Back to the office serfs, Void Banshee, ServiceNow, Taiwan, Dlink, C++, Aaran Leyland, and more on this Edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-414

Do phishing tests do more harm than good? - Wolfgang Goerlich - ESW #376 Sep 20, 2024

Show notes

A month ago, my friend Wolfgang Goerlich posted a hot take on LinkedIn that is less and less of a hot take these days.

He posted, "our industry needs to kill the phish test",and I knew we needed to have a chat, ideally captured here on the podcast.

I've been on the fence when it comes to phishing simulation, partly because I used to phish people as a penetration tester. It always succeeded, and always would succeed, as long as it's part of someone's job to open emails and read them. Did that make phishing simulation a Sisyphean task? Was there any value in making some of the employees more 'phishing resistant'?

And who is in charge of these simulations? Who looks at a fake end-of-quarter bonus email and says, "yeah, that's cool, send that out."

Segment Resources:

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study
The GoDaddy Phishing Awareness Test
The Chicago Tribune - How a Phishing Awareness Test Went Very Wrong
University of California Santa Cruz - This uni thought it would be a good idea to do a phishing test with a fake Ebola scare

Show Notes: https://securityweekly.com/esw-376

The Known Exploited Vulnerability catalogue, aka the KEV - Tod Beardsley - PSW #843 Sep 19, 2024

Show notes

Gain insights into the CISA KEV straight from one of the folks at CISA, Tod Beardsley, in this episode of Below the Surface. Learn how KEV was created, where the data comes from, and how you should use it in your environment.

This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!

Show Notes: https://securityweekly.com/psw-843

Exploding Pagers - PSW #843 Sep 19, 2024

Show notes

Apple drops a lawsuit to avoid exposing secrets, what does it mean for the security industry if MS locks down the kernel?, exploding pagers, more things from the past: Adobe Flash exploits, robots get rid of your data, PKFail is still a thing, Android TV malware is back: now with conspiracy theories, DMA attacks, gamers are not nation-state attackers, the story of a .MOBI Whois server, a better bettercap, and when not to trust video baby monitors.

Show Notes: https://securityweekly.com/psw-843

A TLD Takeover, An LLM CTF, A Firmware Flaw, 6 Truths of Cyber Risk - ASW #299 Sep 18, 2024

Show notes

A takeover of the MOBI TLD for $20, configuring an LLM for a CTF, firmware flaw in an SSD, Microsoft talks kernel resilience, six truths of cyber risk quantification, and more!

Show Notes: https://securityweekly.com/asw-299

Bringing Secure Coding Concepts to Developers - Dustin Lehr - ASW #299 Sep 17, 2024

Show notes

When a conference positioned as a day of security for developers has to be canceled due to lack of interest from developers, it's important to understand why there was so little interest and why appsec should reconsider its approach to awareness. Dustin Lehr discusses how appsec can better engage and better deliver security concepts in a way that makes developers not only feel like their time is well used, but that the content appeals to them.

Segment Resources: - The Security Champion Program Success Guide -- A free guide that includes all steps necessary to build a successful security champion program, with real-world recommendations and examples: https://securitychampionsuccessguide.org/ - Let's Talk Software Security -- A free global virtual community where we host monthly open discussions on appsec topics: https://www.meetup.com/lets-talk-software-security/

Show Notes: https://securityweekly.com/asw-299

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected