Security Weekly Podcast Network (Video)

Latest Episodes:

Understanding the Cybersecurity Ecosystem, Part 2 - Ross Haleliuk - BSW #345 Apr 09, 2024

Show notes

In this discussion, we focus on vendor/tool challenges in infosec, from a security leader's perspective. To quote our guest, Ross, "running a security program is often confused with shopping". You can't buy an effective security program any more than you can buy respect, or a black belt in kung fu (there might be holes in these examples, but you hopefully get the point). In fact, buying too much can often create more problems than it solves, especially if you're struggling to fill your staffing needs.

In part 2 of this 2-part episode, we'll discuss:

- The pros and cons of buying from different types of companies - Who to look to for product recommendations - Is making a plan to "ditch before you hitch" a good or bad idea? - What to do when you inherit a mess

Show Notes: https://securityweekly.com/bsw-345

Understanding the Cybersecurity Ecosystem, Part 1 - Ross Haleliuk - BSW #345 Apr 08, 2024

Show notes

In part 1 of this 2-part episode, we'll discuss:

The current state of vendor offerings in cybersecurity
The difficulties of measuring value and efficacy in a product
How to avoid building a security program that centers around managing products
Shelfware
Minimizing product overhead

Show Notes: https://securityweekly.com/bsw-345

SEXi, Powerhost, Acuity, Layerslider, JSOutProx, Byakugan, Josh Marpet, and More - SWN #375 Apr 05, 2024

Show notes

SEXi, AI Dreams, Powerhost, Acuity, Layerslider, JSOutProx, Byakugan, Josh Marpet, and More, on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-375

Have you heard about AI? Lots of AI news. Also, RSA conference, and RooBadges! - ESW #356 Apr 05, 2024

Show notes

As we near RSA conference season, tons of security startups are coming out of stealth! The RSA Innovation Sandbox has also announced the top 10 finalists, also highlighting early stage startups that will be at the show.

In this week's news segment,

We discuss the highlights of the Cyber Safety Review Board's detailed and scathing report on Microsoft's 2023 breach
We spend a bit of time on the xz backdoor, but not too much, as it has been covered comprehensively elsewhere
We discover half a dozen of the latest startups to receive funding or come out of stealth: Coro, Skyflow, Zafran, Permiso, Bedrock Security, Abstract Security, and Sandfly
Apple is reportedly going to have some big AI announcements this summer, and we discuss how overdue voice assistants are for an LLM makeover.
Finally, we discuss the amazing innovation that is the Volkswagen RooBadge!

By the way, the thumbnail is a reference to the xz backdoor link we include in the show notes: https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor

Show Notes: https://securityweekly.com/esw-356

Getting Vulnerability Management Back on the Rails - Patrick Garrity - ESW #356 Apr 04, 2024

Show notes

NVD checked out, then they came back? Maybe?

Should the xz backdoor be treated as a vulnerability?

Is scan-driven vulnerability management obsolete when it comes to alerting on emerging threats?

What were some of the takeaways from the first-ever VulnCon?

EPSS is featured in over 100 security products, but is it properly supported by those that benefit from it?

How long do defenders have from the moment a vulnerability is disclosed to patch or mitigate it before working exploits are ready and in the wild?

There's SO much going on in the vulnerability management space, but we'll try to get to the bottom of some of in in this episode. In this interview, we talk to Patrick Garrity about the messy state of vulnerability management and how to get it back on the rails.

Segment Resources:

Show Notes: https://securityweekly.com/esw-356

It's A Minifilter! - PSW #823 Apr 04, 2024

Show notes

pfSense switches to Linux (April Fools?), Flipper panic in Oz, Tales from the Krypt, Funding to secure the Internet, Abusing SSH on Windows, Blinding EDR, more hotel hacking, Quantum Bleed, and more!

Show Notes: https://securityweekly.com/psw-823

XZ - Backdoors and The Fragile Supply Chain - PSW #823 Apr 04, 2024

Show notes

As most of you have probably heard there was a scary supply chain attack against the open source compression software called "xz". The security weekly hosts will break down all the details and provide valuable insights.

Show Notes: https://securityweekly.com/psw-823

Top 10's First Update, Metasploit's Second Update, PHP Prepares Statements, RSA & MS - ASW #279 Apr 03, 2024

Show notes

The OWASP Top 10 gets its first update after a year, Metasploit gets its first rewrite (but it's still in Perl), PHP adds support for prepared statements, RSA Conference puts passwords on notice while patching remains hard, and more!

Show Notes: https://securityweekly.com/asw-279

Lena, XZ, WallEscape, AT&T, OWASP, Google, Microsoft, AI, Josh Marpet, and More - SWN #374 Apr 02, 2024

Show notes

Lena, XZ, WallEscape, AT&T, OWASP, Google, Microsoft, AI, Josh Marpet, and more, on this Edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-374

Infosec Myths, Mistakes, and Misconceptions - Adrian Sanabria - ASW #279 Apr 02, 2024

Show notes

Sometimes infosec problems can be summarized succinctly, like "patching is hard". Sometimes a succinct summary sounds convincing, but is based on old data, irrelevant data, or made up data. Adrian Sanabria walks through some of the archeological work he's done to dig up the source of some myths. We talk about some of our favorite (as in most disliked) myths to point out how oversimplified slogans and oversimplified threat models lead to bad advice -- and why bad advice can make users less secure.

Segment resources:

https://www.oreilly.com/library/view/cybersecurity-myths-and/9780137929214/

Show Notes: https://securityweekly.com/asw-279

Our TOPPODCAST Picks

Follow Us

Stay Connected

Security Weekly Podcast Network (Video)

Related Podcasts

Links

Stay Connected