Security Weekly Podcast Network (Video)

Latest Episodes:

Meet Silver SAML: Golden SAML in the Cloud - Eric Woodruff - BSW #348 Apr 29, 2024

Show notes

A hybrid workforce requires hybrid identity protection. But what are the threats facing a hybrid workforce? As identity becomes the new perimeter, we need to understand the attacks that can allow attackers access to our applications. Eric Woodruff, Product Technical Specialist at Semperis, joins Business Security Weekly to discuss those attacks, including a new attack technique, dubbed Silver SAML. Join this segment to learn how to protect your hybrid workforce.

Segment Resources: https://www.semperis.com/blog/meet-silver-saml/&utmsource=cra&utmcampaign=bsw-podcast

This segment is sponsored by Semperis. Visit https://securityweekly.com/semperis to learn more about them!

Show Notes: https://securityweekly.com/bsw-348

Threat Modeling and Understanding Inherent Threats - Adam Shostack - ESW #359 Apr 26, 2024

Show notes

This is a great interview with Adam Shostack on all things threat modeling. He's often the first name that pops into people's heads when threat modeling comes up, and has created or been involved with much of the foundational material around the subject. Adam recently released a whitepaper that focuses on and defines inherent threats.

Resources:

Here's the Inherent Threats Whitepaper
Adam's book, Threat Modeling: Designing for Security
Adam's latest book, Threats: What Every Engineer Should Learn from Star Wars
We mention the Okta Breach - here's my writeup on it
We mention the CSRB report on the Microsoft/Storm breach, here's Adam's blog post on it
And finally, Adam mentions the British Library incident report, which is here, and Adam's blog post is here

Show Notes: https://securityweekly.com/esw-359

TikTok, Flowmon, Cisco, Brokewell, RuggedCom, Deepfakes, Non-Competes, Aaran Leyland - SWN #381 Apr 26, 2024

Show notes

TikTok, Flowmon, Arcane Door, Brokewell, RuggedCom, Deepfakes, Non-Competes, Aaran Leyland, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-381

How GenAI Can Improve SecOps - Ely Kahn - ESW #359 Apr 26, 2024

Show notes

We've talked about generative AI in a general sense on our podcast for years, but we haven't done many deep dives into specific security use cases. That ends with this interview, as we discuss how generative AI can improve SecOps with Ely Kahn. Some of the use cases are obvious, while others were a complete surprise to me. Check out this episode if you're looking for some ideas!

This segment is sponsored by SentinelOne. Visit https://securityweekly.com/sentinelone to learn more about them!

Show Notes: https://securityweekly.com/esw-359

Your TV Is Scanning You - PSW #826 Apr 26, 2024

Show notes

This week the crew discusses: When TVs scan your network, bad things can happen, PuTTY is vulnerable, Crush FTP, vulnerabilities that will never be fixed, CVEs are for vulnerabilities silly, you can test for easily guessable passwords too, FlipperZero can steal all your passwords, more XZ style attacks, more reasons why you shouldn't use a smart lock, and your keystrokes are showing!

Show Notes: https://securityweekly.com/psw-826

Autonomous - I don't think that word means what you think it means - ESW #359 Apr 25, 2024

Show notes

A clear pattern with startups getting funding this week are "autonomous" products and features.

Automated detection engineering
Autonomously map and predict malicious infrastructure
..."helps your workforce resolve their own security issues autonomously"
automated remediation
automated compliance management & reporting

I'll believe it when I see it. Don't get me wrong, I think we're in desperate need of more automation when it comes to patching and security decision-making. I just don't think the majority of the market has the level of confidence necessary to trust security products to automate things without a human in the loop.

The way LimaCharlie is going about it, with their new bi-directional functionality they're talking up right now, might work, as detections can be VERY specific and fine-grained.

We've already seen a round of fully automated guardrail approaches (particularly in the Cloud) fail, however. My prediction? Either what we're seeing isn't truly automated, or it will become a part of the product that no one uses - like Metasploit Pro licenses.

Show Notes: https://securityweekly.com/esw-359

Advising The President On Cyber-Physical Resilience - Philip Venables - PSW #826 Apr 24, 2024

Show notes

On February 27, 2024, PCAST (President's Council of Advisors on Science and Technology) sent a report to the President with recommendations to bolster the resilience and adaptability of the nation's cyber-physical infrastructure resources. Phil was part of the team that worked on the report and comes on the show to talk about what was recommended and how we implement the suggestions.

Show Notes: https://securityweekly.com/psw-826

XZ & Open Source, PuTTY's Private Keys, LeakyCLI, LLMs Writing Exploits - ASW #282 Apr 23, 2024

Show notes

CISA chimes in on the XZ Utils backdoor, PuTTY's private keys and maintaining a secure design, LeakyCLI and maintaining secure secrets in CSPs, LLMs and exploit generation, and more!

Show Notes: https://securityweekly.com/asw-282

Robofly, CRUSHFTP, Github, Palo Alto, MITRE, Fancy Bear, Deepfakes, Aaran Leyland... - SWN #380 Apr 23, 2024

Show notes

Robofly, CRUSHFTP, Github, Palo Alto, MITRE, Fancy Bear, Deepfakes, Aaran Leyland, and more, on this Edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-380

Sustainable Funding of Open Source Tools - Simon Bennetts, Mark Curphey - ASW #282 Apr 23, 2024

Show notes

How can open source projects find a funding model that works for them? What are the implications with different sources of funding? Simon Bennetts talks about his stewardship of Zed Attack Proxy and its journey from OWASP to OpenSSF to an Open Source Fellowship with Crash Override. Mark Curphy adds how his experience with OWASP and the appsec community motivated him to create Crash Override and help projects like ZAP gain the support they deserve.

Segment resources:

Show Notes: https://securityweekly.com/asw-282

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected