Three Buddy Problem

Latest Episodes:

Allison Miller talks about CISO life, protecting identities at scale Dec 21, 2023

Show notes

Episode sponsors:

Binarly, the supply chain security experts (https://binarly.io)
FwHunt (https://fwhunt.run)

Allison Miller is founder and CEO of Cartomancy Labs and former CISO and VP of Trust at Reddit. She has spent the past 20 years scaling teams and technology at Bank of America, Google, Electronic Arts, PayPal/eBay, and Visa International.

In this conversation, we discuss the convergence of security with fraud prevention and anti-abuse, the challenges and complexities in IAM implementations, the post-pandemic labor market, the evolving role of CISOs and new realities around CISO exposure to personal liability, thoughts on the 'build vs buy' debate and the nuance and dilemma of paying ransomware demands.

Links:

Rob Ragan on the excitement of AI solving security problems Dec 07, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Rob Ragan, principal architect and security strategist at Bishop Fox, joins the show to share insights on scaling pen testing, the emergence of bug bounty programs, the value of attack surface management, and the role of AI in cybersecurity. We dig into the importance of proactive defense, the challenges of consolidating security tools, and the potential of AI in augmenting human intelligence. The conversation explores the potential of AI models and their impact on various aspects of technology and society and digs into the importance of improving model interaction by allowing more thoughtful and refined responses.

We also discuss how AI can be a superpower, enabling rapid prototyping and idea generation. The discussion concludes with considerations for safeguarding AI models, including transparency, explainability, and potential regulations.

Takeaways:

Scaling pen testing can be challenging, and maintaining quality becomes difficult as the team grows. Bug bounty programs have been a net positive for businesses, providing valuable insights and incentivizing innovative research.
Attack surface management plays a crucial role in identifying vulnerabilities and continuously monitoring an organization's security posture.
Social engineering attacks, such as SIM swapping and phishing, require a multi-faceted defense strategy that includes technical controls, policies, and user education.
AI has the potential to augment human intelligence and improve efficiency and effectiveness in cybersecurity. Improving model interaction by allowing more thoughtful and refined responses can enhance the user experience. Algorithms can be used to delegate tasks and improve performance, leading to better results in complex tasks.
AI is an inflection point in technology, comparable to the internet and the industrial revolution. Can be game-changing to automate time-consuming tasks, freeing up human resources for more strategic work.
Autocomplete and code generation tools like Copilot can significantly speed up coding and reduce errors. AI can be a superpower, enabling rapid prototyping, idea generation, and creative tasks.
Safeguarding AI models requires transparency, explainability, and consideration of potential biases. Regulations may be necessary to ensure responsible use of AI, but they should not stifle innovation. Global adoption of AI should be encouraged to prevent technological disparities between countries.

Links:

Rob Ragan's Theoradical.ai
Testing LLM Algorithms While AI Tests Us — Testing LLM Algorithms While AI Tests Us
LLM Testing Findings Templates — This collection of open-source templates is designed to facilitate the reporting and documentation of vulnerabilities and opportunities for usability improvement in LLM integrations and applications.
Rob Ragan on Twitter
Rob Ragan on LinkedIn
Bishop Fox Labs

Seth Spergel on venture capital bets in cybersecurity Nov 21, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Seth Spergel is managing partner at Merlin Ventures, where he is responsible for identifying cutting-edge companies for Merlin to partner with and invest in. In this episode, Seth talks about helping startups target US federal markets, the current state of deal sizes and valuations, and the red-hot sectors in cybersecurity ripe for venture investment.

Links:

Seth Spergel bio — Seth has more than 20 years of experience building, selling, and investing in software and startups. Prior to Merlin Ventures, Seth was VP for Infrastructure Technologies at In-Q-Tel, a strategic investment firm that invests in startups that meet the mission needs of government customers.
Merlin Ventures portfolio
Palo Alto buys Talon, Dig Security — Technology powerhouse Palo Alto Networks is officially on a billion-dollar shopping spree in the cloud data security space.
Episode Sponsor: Binarly — The Binarly REsearch team leads the industry in firmware vulnerability disclosure and advisories

Dan Lorenc on fixing the 'crappy' CVE ecosystem Nov 14, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Dan Lorenc is CEO and co-founder of Chainguard, a company that raised $116 million in less than two years to tackle open source supply chain security problems. In this episode, Dan joins Ryan to chat about the demands of building a "growth mode" startup, massive funding rounds and VC expectations, fixing the "crappy" CVE and CVSS ecosystems, managing expectations around SBOMs, and how politicians and lobbyists are framing cybersecurity issues in strange ways.

Links:

SBOMs - All the right ingredients, but something is still missing
Open Source Development Threatened in Europe
Chainguard Images: Reduce your attack surface
Dan Lorenc on LinkedIn
Dan Lorenc on Twitter/X
Chainguard Raises $61 Million Series B
Binarly -- Firmware Supply Chain Security Platform — Binarly is the world's first automated firmware supply chain security platform. Using cutting-edge techniques, Binarly identifies both known and unknown vulnerabilities, misconfigurations, and malicious code in firmware and hardware components.

Cisco Talos researcher Nick Biasini on chasing APTs, mercenary hackers Nov 07, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Nick Biasini has been working in information security for nearly two decades. In his current role as head of outreach for Cisco Talos Intelligence Group, he leads a team of threat researchers tasked with tracking nation-state APTs, mercenary hacker groups and ransomware cybercriminals. In this episode, Biasini talks about the cryptic world of threat actor attribution, the rise of PSOAs (private sector offensive actors) and why network edge devices are a happy hunting ground for attackers.

Links:

Allison Nixon on disturbing elements in cybercriminal ecosystem Nov 01, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Allison Nixon is Chief Researcher at Unit 221B and a trailblazer in the world of cybercrime research. In this episode, we deep-drive into the shadowy dynamics of underground criminal communities, high-profile ransomware attacks, teenage hacking groups breaking into big companies, and the challenges of attribution and law enforcement. Allison sheds light on why companies continue to be vulnerable targets and what they're often missing in their cybersecurity strategies.

Links:

Dakota Cary on China's weaponization of software vulnerabilities Sep 15, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Dakota Cary is a nonresident fellow at the Atlantic Council’s Global China Hub, conducting research on China’s efforts to develop its hacking capabilities, artificial-intelligence and cybersecurity research at Chinese universities, the People’s Liberation Army’s efforts to automate software vulnerability discovery, and new policies to improve China’s cybersecurity-talent pipeline.

In this episode, Cary expands on a new report -- 'Sleight of Hand' -- that delves into the changing legal landscape for vulnerability disclosure in China, the PRC's weaponization of software vulnerabilities, advanced threat actors in China and that infamous Bloomberg 'rice grain' spy chip story.

Links:

Abhishek Arya on Google's AI cybersecurity experiments Sep 12, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Abhishek Arya is director of engineering at Google, overseeing open source and supply chain security efforts that include OSS-Fuzz, SLSA, GUAC and OSV DB.

In this episode, Arya talks about some early success experimenting with AI and LLMs on fuzzing and vulnerability management, the industry's over-pivoting on SBOMs, regulations and liability for software vendors, and the long road ahead for securing software supply chains.

Links:

Dr Sergey Bratus on the 'citizen science' of hacking Aug 31, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

Dr Sergey Bratus is a Research Associate Professor of Computer Science at Dartmouth College and a program manager at DARPA. In this episode, he discusses his pioneering work on securing parsers and patching long-forgotten devices. He also puts the AI hype into context and showers praise on the labor-of-love "citizen science" of hacking all the things.

Links:

Sergey Bratus Bio

DARPA's Perri Adams on CTF hacking, new $20M AI Cyber Challenge Aug 20, 2023

Show notes

Episode sponsors:

Binarly (https://binarly.io)
FwHunt (https://fwhunt.run)

DARPA program manager Perri Adams joins the conversation to chat about her love for CTF hacking competitions, the hunt for leapfrog security technologies in DARPA’s Information Innovation Office (I2O), and the goal of the new AI Cyber Challenge (AIxCC) offering $20 million in prizes to teams competing to develop AI-driven systems to automatically secure critical code.

Links:

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected