00:50:19 “…So if someone says: “Hey, I'm worried about obscure threat” then it's like “Well, OK, that’s probably a valid threat. But let's take a look at your overall defensive strategy and say, well, this is where you're most likely to get attacked from, like unpatched public facing stuff for social engineering or a supply chain. Why don't we just focus on those three things? First, and if you can close those, your actual risk well, will go down considerably. And then we can maybe think about obscure risk X, which some vendor at a conference told you was very important because I had a big booth”
Our today’s guest is Javvad Malik, a Security Awareness Advocate at KnowBe4. He is possibly best known for the hilarious Security Awareness videos – please check the links to YouTube channels below.
During this insightful episode Stu and Javvad discussed:
YouTube channels, Host Uknown and using laughter to increase security awareness
Importance of building trust and relationships BEFORE you need them
A role of a Security Advocate/ Security Evangelist and the need of continuous research, education and raising the bar
FUD – Fear, Uncertainty and Doubt and how to protect companies from unethical approach of monetising the industry
Power of influence
Value of collaboration projects and blog updates to address common issues and give back to community
Plus all those amazing questions from the community
00:54:55 “So if there's one thing I really want people to do more of, is to set up a blog and just use a free one using WordPress or whatever, you know, any free blogger […] set up your own blog, just call it whatever and just put your thoughts down on there. And I think it will help you immensely as an individual. But more than that, it will help others in the community as well”
Ep. 77, Breaking and Entering...your network (with TinkerSec)
Nov 24, 2020
Show notes
(2019-10-25)Red Teaming, Physical Security, Social Engineering
00:04:57 "...And the guy that was in security, he goes, look, I don't care what your degree is. You know, if you stop learning after two weeks, then you're obsolete to me. And here, go study all these things and come back to me."
One Stormy night Stu was in a car park "near where he lives", and we were joined by Tinker to talk about all things Red Teaming, it really was an amazing expereince. Tinker took us on a wild ride through the following:
Origins into infosec, from Marines, Blue Team and then Red Team
What it takes to start in Pentesting
Physical Security and Red Teaming war stories
Why he hates social engineering- but is very good at it!
We learnt about Dalas Hackers!
Proxmark and RFID
Mental Health and Burnout and how to prevent this
And the usual rant and questions from our awesome audience who joined us live.
And don't forget to subscibe and share the podcast with all your infosec friends :)
00:08:03"...So I'll be like, hey, I got this access. And she might be like, Oh, I'm gonna the take that. I'm a piggyback off that I got this access. I go, Oh, with that access I can do this. We leapfrog each other and feed off each other, both on ideas but also on skill." 00:13:47 ..And I ain't saying they're Russian. I didn't check their keyboard layout. But even if they're bouncing through Russia, it's like, oh, you know, I kicked in the door and found a Russian sitting on the couch. 00:23:30 "They went to layer one and looked at the switch location and where the physical jack was. And these two. I mean, I'm talking like beefy and angry looking blue teamers came around the corner, just looking angry." 00:45:00 "But my sons literally are my life. So everything I do, I do for them."
Ep. 75, Whales (with John McAfee), part 1
Nov 19, 2020
Show notes
(2019-10-19)Infosec, NSFW, Crypto Currencies
*00:04:39 "...if you don't leave this world better than you arrived then somehow you fucked up." *
Warning NSFW or probably life. So last year Stu managed to get John McAfee on our Twitch channel (twitch.tv/themanyhatsclub), yes the Anti Virus pioneer and poloarising internet personalitiy. It is very important to note that the views of John McAfee do not represent those of The Many Hats Club or Stu. This episode was recorded before his arrest in 2020.
We had no idea what to expect when recording this episode, especially the bath salts stunt, which was meant to be a joke, but that backfired! So be warned again, there are some very adult themes discusssed in this episode, and please don't do anything discussed in this podcast!
In this episode with John, we discussed the following:
His career and background
The Origins of McAfee Anti-Virus
His work in other start ups
How he started in crypto currencies
His time in Belize
Whales and Bath Salts warning NSFW
What it was like being on the run
And many audience questions
00:19:50 "I've been on the run for almost 40 years from something" 00:22:31 "...Well, you have you ever heard of the SIM swap social engineering? That happened to me. So now I will never give my phone number out to anybody, or at least certainly not link it to any social media account." 00:39:40 "So what's wrong with it is we're focusing on the antivirus paradigm, which is what I invented fucking 30 years ago, and it doesn't work any more"
00:28:21 “…I want them to know I'm there. I want them to think I'm there. Even if I'm not in that specific discord chat, I want them to be concerned- because people are less likely to misbehave if they think that someone is watching them. I'd rather deter them from doing this in the first place, then have to go and deal with the whole court system and get them in trouble for it. If we can just stop people from getting victimized before that happens, that’d be great.”
This episode is extraordinary. And there are a number of reasons for it… That is the first reason the subject discussed is not only important but most often unknown and misunderstood by the majority of people. The second one – it was the first time ever that the entire audience was allowed to say something. Listen to the end to find out why.
We are joined by Katelyn Bowden who passionately talks about The BADASS Army (Battling Against Demeaning & Abusive Selfie Sharing). It is a non profit organization - a collection of victims of image-based abuse who fight non-consensual pornography and all of its forms.
They do that through LEET:
Legislation – working on improvement of the current US laws as they are built around the intent to harm which is very difficult to prove;
Education – Keep the privates – private; teaching how to sex safely and protect one’s privacy;
Empowerment of victims – raising awareness of what can be done in case of non-consensual image sharing utilising The Digital Millennium Copyright Act (DMCA);
Technology – providing basic cybersecurity awareness training, developing programmes and working with platforms to prevent the revenge porn from happening.
The biggest revelation of this episode is to learn what the source of revenge porn usually is. Most of you (like me), before listening to Katelyn had probably this idea of an outraged ex sharing the nudes online.
Well…. Have a listen… It is indeed a very interesting and eye-opening conversation. Katelyn and Stu cover lots of aspects of this subject:
How it all started
Shocking statistics around non-consensual image sharing and the whole subculture of it
OSINT, OPSEC
Deep nudes/deep fakes
Victim trauma and different layers of it
Mentorship by the LE, civilian undercover work and infiltrating discord (do not try that at home)
Punishment (from the legislation point of view of course)
“Get my tits to DEFCON” scholarship 2019 – It raised an amazing $13,560!
Ep. 73, Cyber Expert Advice (with Robert Pritchard)
Nov 11, 2020
Show notes
(2019-10-17)Leadership, Government, Blueteaming
00:03:21 "My first job was a blacksmith. I spent some time blacksmithing and get kicked by horses and getting burnt on forges and stuff".
So we were lucky to be joined by the amazing Robert Pritchard aka @thecybersecexp many, many months ago. After spending five years doing security risk assessments at a major investment bank, he worked in a variety of security roles in the UK Government, before becoming deputy head of the Cyber Security Operations Centre. He is founder of The Cyber Security Expert. On our podcast we talked about the following:
Looking back at infosec early 2000's
Risk Management & Infosec for leading investment Bank
Early social engineering attacks
Working at The National Infrastructure Security Co-ordination Centre (NISCC) and in Government protecting critical infrastructure
History of UK Government Security Strategies (really interesting this).
Infosec for the London Olympics
Career advice
Amazing rant on Risk Management!
And as always many questions from our audience! Links below:
00:14:35 "They had this great tale of how they tracked down scammers and stuff. It is amazing that a banking Trojan was considered novel in the world of banking in those days, which shows you how much things have changed in a relatively short time"
00:29:44 "But spent the first two years, 11 months convinced that somebody was just gonna walk up behind me, put the hand on my shoulder, and say Mr Pritchard I think we can all agree there's been a terrible mistake, and escort me off the premises"
Ep. 69, IS IT A CROW?! (with Gabe a.k.a. infoseccrow)
Nov 07, 2020
Show notes
(2019-09-24)Blue Team, Infosec Community
00:02:40"Infosec was not whatsoever a thing that was on my radar when I was looking at what do I want to do. Computer is the I love them. I grew up with them. I attribute having a computer and playing with it and continue to do so to following this path..."
Pre that covid thing, Stu hosted a podcast with the awesome infoseccrow. Originally a sysadmin by trade, now a seasoned security leader and director with a deep technical background and broad experience in business and in technology. Gabe is also President of the UK Chapter of the ISSA. In our podcast we discussed:
Origins into infosec
Blueteaming
Security Metrics that make sense
Threat Hunting
Risk Management
Effective Penetration Testing
A superb rant, plus a lot of questions from the audience, as per usual.
Ep. 89, What The Beer Farmers Think No. 12
Sep 03, 2020
Show notes
(2020-08-24)
It took many months for them to come back (one, really) but our friends are back with another episode of WTBFT. The lineup, fluid as always, has changed again (hello Scott!) but not as much as what they, in fact, think about:
The Beer Farmers are not The Many Hats Club (but we love each other),
Domain registrars and email marketing companies, the more customers the more money, no matter the use?
BT Hubs and 'security reasons' and the reasons behind it,
Online, pandemic cons and lives reality,
Infosec Happy Hour!
Kevin M. is still a... whoever he was,
Twitter sensitive topics (there's no easy way to put it),
Ep. 87, What The Beer Farmers Think No. 11
Jul 23, 2020
Show notes
(2020-06-30)
Despite all evidence pointing to the contrary we have, in fact, made it to the 11th episode of What The Beer Farmers think - a monthly (almost) episode about, well, what the Beer Farmers think:
not patching: an old problem that never changes,
another DDOS, how do clouds handle this,
TikTok: it's bad, but is it the worst,
security absolutism: it's not 100% secure, but so what,
Ep. 68, A View From a Blue Mountain (with Rey Bango)
Jun 23, 2020
Show notes
2019-09-20: blue team, breaking into infosec
[00:26:45] The saying goes, and it's so true you know, an attacker only needs to be right one time. The blue team needs to be right a hundred percent of the time. And that's the truth.
This time on the best podcast within the Inner planets we had Rey Bango, Microsoft Security Advocate, past developer (do you ever stop being one?) and a founding member for jQuery. Started at Microsoft many years back as an IE evangelist, over the years transitioned to the security side, still at Microsoft. Some of the topics covered:
breaking into infosec from other areas of IT,
blue team has to be always right,
building up confidence for public speaking,
attending conferences - the good and the bad and now it helped Ray,
plus a lot of questions from the audience, as per usual :)
More views here:
[00:02:17] I think one of the first sites that I found was The Many Hats Club, when you were all first starting out. (...) The great thing about it is that it gave me kind of an overview of what the security community was like and some of the interactions that were going on.
[00:19:30] Most of the time when you get into security, what do you do? You go out, you download the Kali ISO and you sit there and you stare at it, and you're like oh great I got a Kali ISO, woo.
[01:12:49] It takes a village to raise a security professional. You know basically what it means is that we should all be helping each other out to solve for the common good, not making anybody feel like they can't ask a question because they should know.
Ep. 67, StuCon (with Stu, Stu and Stu)
Jun 17, 2020
Show notes
(2019-09-05): history, rants, hiring, future
[00:06:44] We're banging our head against the same wall. Why hasn't someone kind of woke up and gone 'We need to change. This is not working.'? And the few people that do just seem to get acquired by a major corportation and we go back to the status quo of not talking the same language as everyone else.
This special episode has brought three Stus: Stu Peck, Stu Hirst and Stu Coulson into one virtual room for an extra long episode about the State of the Industry. Stu Hirst does cloud security at Just Eat, previously Photobox, Capital One and Skyscanner. He is also a co-founder of Cyber Scotland Connect, which do security meetups. He previously joined us over a year ago on episode 11 of the podcast, talking about challenges facing blue tea, imposter syndrome and future attack trends. Stuart Coulson runs HiddenText, a consultancy business providing strategy advice. He previously worked for Cyber Security Challenge, Secarama and NCC.
The Stus talked about:
was before better than it is now in infosec?
burnouts,
best and worst of 2019,
HR, hiring, inclusivity, HR gatekeeping,
being part of the awesome infosec community.
Their takeaways?
Stu Hirst: Overlook the drama, focus on the good parts of the community (Hirst),
Stu Coulson: community is fighting for the same things (stopping bad guys) and allow community to help when things are hard,
Stu Peck: stay awesome and learn from other people.
If that did not convince you, this will:
[00:08:32] It's almost like drug laws. It's like, you know, you can keep carrying on doing the same thing you're doing and it doesn't work. Or you can have a selection of people who can help define a different way to do it.
[00:08:33] Companies take on reasonably junior roles by job title or position in the business. But then you'll come the main security person in that business, the amount of work that's on your plate and the amount of risk that you've got to take on compared to your salary is I mean (...) just laughable.
[01:55:16] This industry is phenomenal (...) to be part of something bigger than just, you know, picking up your paycheck and paying your rent (...) we shouldn't underestimate that. I love it. You know, this is my career for life, and I'm pretty humble and thankful to be part of it.
Our TOPPODCAST Picks 
Stay Connected
