WE'RE IN! - TopPodcast.com

The AI Episode: Experts Share Security Insights on LLMs and GenAI Oct 23, 2024

Hear from this season’s guests for their thoughts and predictions on AI and cybersecurity. We took sound bites from a range of WE’RE IN! interviewees, whose opinions on AI vary from thinking it’s overblown to being cautiously curious. Tune into this episode to better understand AI’s seismic effects on the infosec industry.

Bill Dunnion on the push for transparency in security breaches Oct 02, 2024

Bill Dunnion, chief information security officer at global telecommunications company Mitel, is well-versed in the critical nature of telecom infrastructure and the devices that support it. He’s also keenly aware of how his role as CISO is under increasing scrutiny from regulators around the world and in Canada, where Mitel is based.

In this episode of WE’RE IN!, Bill expresses skepticism about AI, preferring the term "machine learning" for most current applications, but he acknowledges its potential benefits, such as improving threat detection.

Listen to hear more about:

How Bill's diverse background in telecom, IT, and security has provided him with a well-rounded perspective to approach his CISO role
Why the integration of voice, data, and collaboration tools in enterprise communications presents new cybersecurity challenges
Why security awareness is crucial for both professional and personal life

Jennifer Villarreal on how she upped her hacking game Sep 19, 2024

Jen, a former military professional turned hacker, shares her journey into cybersecurity and her experiences with the Synack Red Team in the latest episode of WE’RE IN! She transitioned from fixing security issues to actively seeking vulnerabilities, inspired by her brother and motivated by her experiences at the storied hacker conference, DEF CON. Jen emphasizes the importance of skill development and preparation for women entering the male-dominated cybersecurity field, and discusses her preferred hacking tools and techniques.

In this episode of WE’RE IN!, Jennifer gives her take on AI in penetration testing, suggesting it should be used as a tool for initial reconnaissance but not for exploiting vulnerabilities.

Listen to hear more about:

Why all of Jennifer’s smart home devices’ warranties are voided
How anyone can be a hacker by following the Open Source Intelligence methodology to find vulnerabilities
The importance of producing high-quality work and going above and beyond to gain trust in the pentesting industry

Sara Mosley on best practices for Zero Trust Aug 21, 2024

Sara Mosley, technical director for the Bureau of Diplomatic Security's Cybersecurity and Technology Services, works with the U.S. State Department to help identify threats and potential compromises. In her role, she advocates for a Zero Trust approach that focuses on protecting critical data rather than trying to secure everything equally. She recommends balancing security measures with mission needs to prevent users from circumventing security protocols.

In this episode of WE’RE IN!, Sara underlines the importance of collaboration between IT and security teams to adequately protect data and address relevant threats in anticipation of the September deadline for federal Zero Trust compliance.

Listen to hear more about:

The role of the private sector in adopting Zero Trust frameworks and providing security tools
Preparing for emerging technologies like quantum computing and their accelerated development due to AI advancements
Why Sara believes hackers will initially benefit more from AI advancements than defenders

Michael Daniel on untangling cybersecurity’s complexity problem Jul 31, 2024

Cybersecurity has a complexity problem. A tangled web of technical, psychological, economic and geopolitical factors enable and motivate malicious actors. Michael Daniel, CEO and president of the Cyber Threat Alliance, is helping public and private organizations decode these complex motivations with information sharing, including the Ransomware Task Force.

In this episode of WE’RE IN!, Michael elaborates on his "immune system" approach for the internet, a strategy where threats are quickly identified and neutralized. But this requires robust – and highly trusted – information sharing between groups.

Listen to hear more about:

The threat assessment for the 2024 Paris Olympics, highlighting potential threats from Russia and Azerbaijan
The need for more resilient software systems that can degrade gracefully rather than catastrophically fail
Michael’s thoughts on industry diversification and the value of different viewpoints in tackling cybersecurity challenges

Anand Prakash on cloud security startups and next-gen hacking Jul 17, 2024

Anand Prakash on cloud security startups and next-gen hacking

Anand Prakash, founder of startup PingSafe, shares his insights on building a successful cybersecurity business and his experience as a top bug bounty hunter. He emphasizes the importance of fast execution, accountability and learning from mistakes when growing the company acquired by SentinelOne, where he’s now a senior director of product management.

In the latest episode of WE’RE IN!, Anand touches on India's prominence in global tech – particularly in security research and bug bounty programs – and he shares his personal journey into cybersecurity, which began with a curiosity about hacking at a young age in cyber cafes.

Listen to hear more about:

How bug bounty programs have evolved, with companies now more open to ethical hacking due to increased awareness of data breaches
The viability of government efforts to reduce entire classes of vulnerabilities like SQLi
If AI is effective in improving red teaming and bug bounty hunting

Ads Dawson on developing the OWASP Top 10 for Large Language Models Jun 26, 2024

Ads Dawson, release lead and founding member for the Open Web Application Security Project (OWASP) Top 10 for Large Language Model Applications project, has no shortage of opinions on securing generative artificial intelligence (GenAI) and LLMs. With rapid adoption across the tech industry, GenAI and LLMs are dominating the conversation in the infosec community. But Ads says the security approach is similar to other attack vectors like APIs. First, you need to understand the context of AI-related vulnerabilities and how an attacker might approach hacking a particular AI model.

In the latest episode of WE’RE IN!, Ads talks about including threat modeling from the design phase when integrating GenAI into applications, and how he uses AI in his red teaming and application security work.

Listen to hear more about:

The misuse of AI, such as creating deep fakes for financial gain or manipulating powerful systems like the stock market

The role of governments in securing the AI space and the concept of “safe” AI

How the infosec community can contribute to OWASP frameworks

Kevin Tambascio on balancing security with availability of services in healthcare Jun 05, 2024

Integrating security into the product development lifecycle is a tall order for any industry. It’s particularly challenging for healthcare, with its wide range of critical needs from HVAC systems to medical devices. Kevin Tambascio, director of cybersecurity data and application protection at Cleveland Clinic, juggles the need for constant vigilance and staying updated on fast-moving threats to hospitals.

In the latest episode of WE’RE IN!, Kevin discusses the importance of compliance and risk assessment, noting that while compliance with rules like HIPAA is crucial, it's equally important to pressure test controls against real-world threats. Ransomware targeting hospital data is the primary threat, while phishing and potential abuse of generative AI also pose significant risks.

Listen to hear more about:

The benefits of forming an AI task force to enact safe and responsible procedures while enabling clinicians and researchers to explore AI’s potential
Effectively communicating cyber threats to non-technical staff by relating them to potential impacts on patient safety and business operations
Application security in healthcare; applications often have access to sensitive patient health information and can be potential entry points for cyber threats

Tennisha Martin on bridging the cyber talent gap through diversity May 15, 2024

Cybersecurity organizations tend to have unrealistic hiring expectations, according to Tennisha Martin, founder and executive director of the training-focused nonprofit BlackGirlsHack. That can make it hard for would-be candidates to stand out and contribute to solving urgent cybersecurity challenges.

In the latest episode of WE’RE IN!, Tennisha unpacks the important work of The BlackGirlsHack Foundation, which provides training resources and cybersecurity education to underserved communities. That includes giving Black children avenues to complete cybersecurity certifications and snag their first jobs in the industry.

“Part of the reason why I started BlackGirlsHack was because I was a black girl that was trying to get into cyber security and I was like, hey, I've got a whole bunch of degrees and years of experience and certifications, and if I'm having a hard time, I know that the people who are fresh out of high school, for example, may be having a hard time as well,” she said.

Listen to hear more about:

How recently reported corporate cutbacks in DEI initiatives are impacting the work of organizations like BlackGirlsHack
How Tennisha came to be nicknamed “mother of hackers”
Why gamifying cybersecurity can be key to building the next generation of cyber talent

Mara Winn on protecting America’s critical infrastructure from cyberthreats May 01, 2024

A first-of-its-kind 2016 cyberattack on Ukraine’s power grid was a wake-up call for countries around the world to shore up protection of vulnerable energy resources. Mara Winn, Deputy Director for Preparedness, Policy, and Risk Analysis at the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER), is in charge of acting on just that. From securing electric vehicles to safeguarding electric substations, Mara and her team help to ensure the resilience of the energy sector against cyber, physical and climate-based disruptions.

Mara takes a holistic approach to risk management, considering both physical and cyber threats. In the latest episode of WE’RE IN!, she cautions against focusing too much on the "flashy object of the day" and describes why she imbues diversity in risk management for the best outcomes.

Listen to hear more about:

Why early implementation of security measures in product development is necessary for distributed energy resources like solar, wind and battery technologies
How to educate investors, entrepreneurs and designers about understanding the full risk picture in business decisions
The role of the National Association of Regulatory Utility Commissioners and the Federal Power Act in defining federal and state responsibilities in the energy system

Amy Chang on squaring cyber policy with real-world threats Apr 17, 2024

Amy Chang, a resident senior fellow for Cybersecurity and Emerging Threats at the R Street Institute, has many tough problems to consider, from election security to adversarial AI attacks to the geopolitical implications of cyberwarfare. In a world rife with hot takes, she pursues a balanced approach to answering these weighty issues—nothing is an assumed outcome.

In this episode of WE’RE IN!, Amy provides insights into the potential cybersecurity policies of both the Trump and Biden administrations after the next presidential election, and how AI has the potential for more than just super-powered hacking. In a recently published paper, she and a colleague detailed consequences like inaccurate medical diagnoses or even manipulation of financial markets.

Listen to hear more about:

The role of cybersecurity in the innovation race between China and the U.S.

The effectiveness of “name and shame” tactics more than a decade after the release of Mandiant’s landmark APT 1 report

Why bipartisan support for cybersecurity measures may not equate to trust in the election security space

Mark Kuhr on AI pentesting and the Synack Red Team Mar 27, 2024

Dr. Mark Kuhr, a former National Security Agency employee, faced a host of challenges when he co-founded Synack with CEO Jay Kaplan in 2013. As CTO for the security testing company, Mark has led Synack through dramatic growth while working to shift the mindset of some cybersecurity practitioners. For instance, the Synack platform, featuring access to security researchers around the globe, initially faced skepticism—a group of essentially strangers pentesting enterprise networks? Not the most convincing argument for CISOs. But through a trust-but-verify approach, Synack’s take on security testing has risen to prominence in the industry.

In this episode of WE’RE IN!, Mark explains how he recruited a community of global top hackers to join the burgeoning Synack Red Team – and what’s at stake as AI capabilities ramp up for attackers and defenders alike.

Listen to hear more about:

Mark’s predictions about the use of AI for offensive operations, including selecting targets and applying exploits
Synack’s FedRAMP Moderate Authorized status and how other organizations can secure approval to work with sensitive government data
How the integration of AI in cybersecurity is increasing the pressure on organizations to patch and mitigate vulnerabilities faster

Anthony Newman on cyberthreats to higher education Mar 13, 2024

In this episode of WE’RE IN!, Anthony Newman, executive director at Research and Education Networks Information Sharing and Analysis Center (REN-ISAC), highlights the need for protecting research infrastructure in higher education, dealing with credential dumps and monitoring the dark web for potential threats. He also discusses the challenges faced in higher education, such as securing a diverse range of resources, navigating risks posed by a litany of third-party vendors and recovering quickly from breaches.

Anthony also digs into the impact of AI in the cybersecurity landscape, emphasizing the need for trust and the potential benefits of automation.

Listen to hear more about:

How REN-ISAC supports its 700 member institutions within the higher education and research community
The role of trust and threat intelligence in higher education
The nature of advanced, persistent threats to research facilities, including China-linked cyberespionage

Dennis Fisher on the future of cybersecurity journalism Feb 28, 2024

Dennis Fisher, editor-in-chief at Decipher, reflects on his journalism career covering cybersecurity for more than two decades in the latest episode of the WE’RE IN! cybersecurity podcast. He began in 2000, covering email before transitioning to security. Soon his focus shifted to vulnerability reporting, including blockbuster bugs in Windows and Internet Explorer. This led to Microsoft's trustworthy computing memo and significant changes in the software industry.

Dennis also discusses the challenges of cybersecurity journalism and the importance of democratizing information.

Listen to hear more about:

The overlap between cybercrime and traditional organized crime and the impact of cryptocurrency
Dennis’s interest in crime novels and the challenges of incorporating his background into his own books
The surprising topic Dennis would cover if he wasn’t focused on security

Jason Loomis on finding the humanity in cybersecurity Feb 14, 2024

Jason Loomis, Chief Information Security Officer at Freshworks, emphasizes the human side of cybersecurity and the importance of effective leadership. New CISOs should make an effort to understand not just existing security controls, but also the team dynamics at any new organization they’re helping to protect. The human element all too often goes unnoticed, according to Jason.

In this WE’RE IN! episode, Jason discusses the need for strong communication skills and the ability to engage every employee in cybersecurity practices.

Listen to hear more about:

Why basic security controls and understanding context are crucial in cybersecurity
How to “sit down, be quiet and listen” rather than try to fix everything immediately in a new cybersecurity leadership role
What AI means for the risk of future cyberattacks

Sarah Armstrong-Smith on understanding the attacker mindset Jan 31, 2024

Season 3 Episode 3

Sarah Armstrong-Smith on understanding the attacker mindset

Sarah Armstrong-Smith, Chief Security Advisor at Microsoft and a cyber security author, discusses her role in improving cyber postures and staying ahead of threats. She explains how Microsoft uses machine learning in their threat intelligence and what's next with the onset of generative AI. She also highlights the importance of understanding the risks and consequences of AI technology, as well as the need for CISOs to embrace new technologies while ensuring accountability.

In this WE’RE IN! episode, Sarah emphasizes the significance of diversity in the cybersecurity workforce and the need for organizations to foster a culture that encourages diverse perspectives.

Listen to hear more about:

Understanding and addressing the unique cyber challenges of different sectors and countries

Balancing the threat landscape with available resources

The human aspect of security and understanding the motivations of attackers

Links:

Find Sarah on LinkedIn

Find Blake on LinkedIn

Andreas Wuchner on Cyber Resiliency in Financial Services Jan 17, 2024

The financial services industry is among the most sought-after targets for cyberattacks. When malicious actors steal data, it’s often just a means to a cash-rich (or bitcoin) end. Andreas Wuchner, advisor to many security startups and a formative contributor to Switzerland's National Financial Services Information Sharing and Analysis Center, has a thought or two on how to build cyber resiliency in critical banking institutions.

In the latest episode of WE’RE IN!, Andreas challenges some status quo ideas in the industry, like: Is there really a cybersecurity talent gap? And he gets real about how AI can help unleash more capacity and productivity for security teams if paired with rigorous cyber standards.

----------

Listen to learn more about:

* Translating cyber for the C-suite

* How to achieve cyber resiliency

* Forming a worthwhile customer advisory board

Ryan Kazanciyan on Securing the AI future Jan 03, 2024

Securing a startup valued in the billions of dollars is no small feat. According to Ryan Kazanciyan, CISO at Wiz, it’s all about process. His previous experience with companies like Mandiant and Meta rounded out his security background. Using his experience from large enterprises, Ryan takes a considered approach to securing a startup.

The cloud security company has an existing ethos of security first, so Ryan and his team are equipped to tackle old and new security challenges alike, from run-of-the-mill phishing attacks to sophisticated AI-enabled threats.

----------

Listen to learn more about:

* His time consulting on the hacker TV series Mr. Robot

* Ryan’s thoughts on balancing privacy, security and convenience

* Lessons from his heavy-hitting cyber career

Season 3 Trailer Dec 14, 2023

Ready to hear from top cybersecurity newsmakers, executives and storytellers? Eager for advice on how to launch a successful cyber career? Curious about hacking threats that seem to grow more menacing by the day? Get ready for Season 3 of WE'RE IN!

Hosted by Synack's Head of Communications and longtime cybersecurity journalist Blake Thompson Heuer (Sobczak), WE'RE IN! takes you inside the brightest minds in cybersecurity for unique insights and colorful stories from the front lines of our digital transformation. Don't miss the latest season of this breakout podcast, sponsored by Synack!

Lauren Zabierek on “Sharing the Mic” to Foster Cyber Innovation Aug 08, 2023

The next generation of cybersecurity leaders have a vision for the future of cybersecurity. Facing advanced nation-state threats, the breakneck speed of tech innovation and a deluge of zero days, Lauren Zabierek is moving the dial on workforce diversity to tackle these challenges. Lauren, senior policy advisor for Cybersecurity and Infrastructure Security Agency and co-founder of #ShareTheMicInCyber, is also helping organizations “shift left” by integrating security principles into the innovation process.

Don’t miss the latest episode of WE’RE IN! to hear Lauren’s insights into why cybersecurity job descriptions are broken and how talking to everyday people can build the pipeline of cyber talent.

----------

Listen to learn more about:

* Which cybersecurity story she’d like to see made into a Christopher Nolan movie

* Why she believes “diversity is national security”

* How she ended up with Ms. magazine bylines

Jeremiah Roe Unpacks the “Puzzle” of Pentesting Jul 13, 2023

Pentesting is in Jeremiah Roe’s DNA. He has worked for a traditional pentesting consultancy, conducted clever physical penetration tests over the years (as documented in his episode on the Darknet Diaries podcast), and he now finds himself at the cutting edge of security testing as field CISO for North America at Synack.

Jeremiah is a fan of escape rooms and brings his creativity and strategic thinking to some of the cybersecurity industry’s toughest challenges. Don’t miss the latest episode of WE’RE IN! to hear Jeremiah weigh in on topics such as:

----------

Listen to learn more about:

* Budding API security challenges and how to address them

* Techniques for transitioning from the armed services to a role in cybersecurity

* How to think like an attacker to conquer high-risk vulnerabilities

Demystifying OT Cybersecurity with Danielle Jablanski Jun 29, 2023

The operational technology (OT) computer networks that support life as we know it are increasingly coming under threat. But despite the proliferation of malware aimed at critical infrastructure, Danielle Jablanski isn’t running for the hills. As an OT cybersecurity strategist for Nozomi Networks, Danielle helps critical infrastructure organizations understand and prioritize digital risks, whether they stem from a lack of visibility into industrial environments or a sophisticated cyberattack from a foreign nation-state.

Don’t miss the latest episode of WE’RE IN! to hear Danielle’s insights into industrial control systems (ICS) risk management, including the recently disclosed COSMICENERGY ICS-focused cyberthreat.

----------

Listen to learn more about:

* What makes the ICS security field “niche but not nebulous”

* How Danielle’s background in nuclear weapons policy informs her approach to cyber incident planning

* Why so few critical infrastructure operators know where equipment with known vulnerabilities may exist on their networks

* Hacking satellites in space

API Security Decoded with Corey Ball, Senior Manager of Penetration Testing, Moss Adams and Chief Hacking Officer, APIsec University May 25, 2023

Application programming interfaces (APIs) are taking over the internet. APIs now make up 83% of internet traffic because they help applications communicate with each other via API calls. And they’re a critical threat vector for companies. Corey Ball, author of “Hacking APIs,” saw the API takeover happening and realized there was a gap in security training and tactics.

He founded APIsec University, which offers online courses to help level up the infosec community’s API security testing skills. APIs are essentially direct links to a company’s database, a valuable target for a malicious actor, and their flaws can be difficult to detect without proper documentation and thorough analysis.

Security teams are just getting started tackling API security and Corey outlines how they can get started and which executives, including the board of directors, need to be aware of their API attack surface.

----------

Listen to learn more about:

* His favorite API vulnerability

* Why generic security scanners can’t detect API security flaws

* The future of API security

Emma Stewart on the Future of the Electric Grid, Cyber Mutual Assistance and “Crying Wolf” on Energy Threats May 11, 2023

Power and energy security strategist Emma Stewart is always on the lookout for what’s next in the U.S. electric grid, whether that be an influx of renewable energy or cyberattacks by malicious hackers. Her engineering background helps her understand how things work so she can break them to build them again, but stronger. Emma has announced she’s joining Idaho National Laboratory as Chief Power Grid Scientist and Research Strategist in the lab’s National and Homeland Security Directorate, putting her on the forefront of efforts to keep Americans’ electricity networks resilient in the face of cyberthreats.

Emma previously worked as Chief Scientist for the National Rural Electric Cooperative Association, which represents the nation’s roughly 900 non-profit electric co-ops. Because rural infrastructure can lack the same level of funding or support compared to bigger electric companies, she often had to puzzle over how to fortify distributed resources from nation-state cyberthreats.

----------

Listen to this episode to hear more about:

* How cyber mutual assistance programs can help level the playing field in the fight against adversaries

* Emma’s cancer survivorship

* Takeaways from the S4 industrial cybersecurity conference in Miami Beach, where Emma was a speaker

Kelly Moan on Zero-Trust Strategies, Safeguarding NYC and the Need for Representation in Cybersecurity Apr 25, 2023

As Chief Information Security Officer for NYC, Kelly Moan is on the front lines protecting New Yorkers from the latest cyberthreats. She juggles everything from implementing zero-trust security models to helping state agencies fend off sophisticated hacking attempts.

Don’t miss the latest episode of WE’RE IN! in which Kelly opens up about her professional history and shares tips for anyone interested in supporting their own communities through pursuing a career in cybersecurity. Her office has worked to foster the next generation of cyber talent through efforts like the New York City Cyber Academy program.

“The really amazing thing about the profession in general is you don't need a degree,” Kelly says. “If you have access to the internet and you have access to a technology product like a mobile phone, a laptop– there's so much out there and open source that, if you really want to, you can start learning.”

-------

Tune in to hear more about:

* Why cloud security is such a top-of-mind concern for CISOs

* New York’s first-of-its-kind Joint Security Operations Center

* Kelly’s approach to ensuring “diversity of experience” in the infosec field

Space Rogue on L0pht Heavy Industries, 90s Infosec Lessons and “Gray Hat” Hacking Apr 20, 2023

Hacker Cris Thomas – better known by his old bulletin board system handle Space Rogue – has witnessed the infosec community grow from a hodgepodge network of hacking collectives to a multibillion dollar industry.

Space Rogue was a member of the L0pht Heavy Industries hacker group that made its name poking holes in premier products from burgeoning tech giants like Microsoft and Oracle. Now Global Lead of Policy and Special Initiatives at IBM, he is also author of a new memoir recounting his experiences from the “magical hacker scene” of the 1990s, Space Rogue: How the Hackers Known As L0pht Changed the World.

In the latest episode of WE’RE IN!, Space Rogue shares his side of the story from L0pht’s influential May 1998 testimony before Congress, in which the hackers warned of glaring security vulnerabilities that remain relevant to this day.

--------

Tune in to hear more from Space Rogue on:

* Tales from early meetings of the famous hacker quarterly 2600

* The value of college versus certifications for anyone seeking to launch an infosec career

* The fragility of the modern internet

Morgan Adamski on Cybersecurity Collaboration, Nation-State Threats and Transparency at NSA Apr 06, 2023

Morgan Adamski wants to talk to you about cyberthreats. As chief of the National Security Agency’s Cybersecurity Collaboration Center, she’s responsible for bringing highly sensitive threat information out from behind the walls of Fort Meade and onto the desks of defense industry leaders who can use it.

In the latest episode of WE’RE IN!, Morgan shares how she helped build the CCC into a vital public-private conduit for cyber intelligence, rewriting existing NSA operating models along the way.

“We knew that it was important to be able to have this type of direct engagement, because we knew the only way to really counter a nation-state actor is to get ahead of it,” Adamski said of the CCC’s “fast and furious” history.

--------

Tune in to hear Adamski’s thoughts on:

* Strategies for getting more women involved in the cybersecurity field

* The Biden administration’s new National Cybersecurity Strategy

* The importance of being part of something bigger than yourself

Nicole Perlroth on Spyware, “Mutually Assured Digital Destruction” and Educating Boardrooms Feb 23, 2023

In Nicole Perlroth’s blockbuster 2021 book, “This Is How They Tell Me the World Ends,” the former New York Times journalist conveys cybersecurity experts’ mounting anxiety about increasingly dangerous digital threats. From spyware to ransomware, the black market for cyber tools that skirt the law is lucrative and often poorly understood.

Nicole points to catastrophic cyberattacks like NotPetya, a 2017 ransomware look-alike that attempted to obliterate Ukraine’s critical infrastructure before causing billions of dollars in damages worldwide. But even with geopolitical tensions now at a fever pitch, Nicole, now a cybersecurity advisor and investor, explains why “mutually assured digital destruction” has so far helped stave off major attacks on U.S. critical infrastructure.

---------

Also covered in the podcast:

* The importance of educating board members about cybersecurity

* What constitutes a cyber weapon

* Why Nicole is optimistic about the future of ransomware

Hudney Piquant on Pentesting, Staying Ahead of Adversaries and a Cyber “Sixth Sense” Feb 02, 2023

Hudney Piquant kicked off his cybersecurity career working for a startup out of a garage in Michigan. He has since uncovered critical vulnerabilities as a Synack Red Team member, joined Synack full time as a solutions architect and been honored with a Most Inspiring Up And Comer award by CyberScoop last fall.

Tune into the latest episode of WE’RE IN! to hear Hudney share his insights into getting started with the Synack Red Team, the importance of mentorship in the cybersecurity community and his “sixth sense” that helps him to find creative workarounds for tough security challenges.

---------

More topics covered in the podcast:

* Why we haven’t seen the last of the blockbuster Log4j vulnerability

* The importance of applying an adversary’s perspective on your networks

* How to build trust among professionals skeptical of ethical hackers

Selena Larson on Cyber Intelligence, "Evil" Threat Actors and TOAD Attacks Jan 19, 2023

In the latest episode of WE’RE IN!, Selena Larson shares insights into malicious hackers and scammers she’s tracking as senior threat intelligence analyst for Proofpoint. Business email compromise, ransomware, sextortion, multi-factor authentication bypass techniques – dealing with the onslaught of modern cyberthreats “is very much like playing whack-a-mole,” she said. By unpacking attackers’ motivations and psychological profiles, defenders can train themselves and their teams to avoid falling into common traps.

-------

More reasons you should listen:

* Hear Selena discuss what makes threat intelligence actionable, versus extra noise for a SOC

* Find out about an alarming cyber espionage campaign that recently targeted journalists

* Learn why Selena despises evil TOADs – “telephone-oriented attack delivery” attacks

Craig Newmark on Cyber Philanthropy, Internet Pioneers and a “Cyber Civil Defense” Jan 05, 2023

Philanthropist Craig Newmark is most famous for founding the classifieds site Craigslist nearly 30 years ago. But he’s recently earned praise in the cybersecurity community for pledging $50 million in early 2022 to support a cyber civil defense initiative through his namesake philanthropy.

On the latest episode of WE’RE IN!, hear Craig describe what he means by cyber civil defense and listen to his candid thoughts on everything from quantum computing to the dangers of state-sponsored disinformation campaigns. He also shares insights into the philanthropic strategy driving many of his contributions to the field of cybersecurity and continuing education.

----------

Tune in to hear more about:

* Challenges in fostering collaboration across the cybersecurity community, from the White House to organizations like the Aspen Institute’s Cybersecurity Group

* How a “cybersecurity nutrition label” could empower consumers

* Craig’s participation in the Whole Earth 'Lectronic Link, one of the oldest virtual communities

Andy Greenberg on “Tracers in the Dark,” Bitcoin What-ifs and IRS Heroes Dec 15, 2022

Journalist Andy Greenberg is no stranger to the murky world of cryptocurrency. The senior writer for WIRED and longtime cybersecurity journalist was one of the last reporters to interact with pseudonymous Bitcoin founder Satoshi Nakamoto before they evidently ceased communications.

In his new book, “Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency,” Andy follows the gripping story of IRS special agent Tigran Gambaryan as he follows the money to zero in on some of the most mysterious and monstrous criminals in the cyber underground.

-------

Don’t miss the inaugural episode of WE’RE IN! Season 2 to hear more from Andy on:

* How Tigran joined forces with expert investigators and cryptographers to jettison misconceptions about the anonymity of major cryptocurrencies, exposing alleged criminal masterminds in the process

* The genesis of successful crypto tracing and analysis firms like Chainalysis

* The twisted motivations of those who founded infamous dark web emporiums like AlphaBay and Silk Road

-------

Links:

* https://andygreenberg.net/

* https://www.wired.com/

* https://www.synack.com/

* https://readme.security/

Season 2 Trailer Dec 08, 2022

Ready to hear from top cybersecurity newsmakers, executives and storytellers? Eager for advice on how to launch a successful cyber career? Curious about hacking threats that seem to grow more menacing by the day? Get ready for Season 2 of WE'RE IN!

Co-hosted by Synack security operations engineer Bella DeShantz-Cook and longtime cybersecurity journalist Blake Sobczak, WE'RE IN! takes you inside the brightest minds in cybersecurity for unique insights and colorful stories from the front lines of our digital transformation. Don't miss the latest season of this breakout podcast, sponsored by Synack!

Tanya Janca on Cyber Mentorship, “Shifting Left” and Punk Rock Nov 23, 2022

Application security maven Tanya Janca – AKA SheHacksPurple – is an accomplished author, pentester and onetime music festival organizer. But she’s perhaps best known as the founder of We Hack Purple, a community of security professionals dedicated to sharing useful cyber information including coding trainings and coursework. (Dynamic application security testing Bright Security acquired We Hack Purple earlier this year, bringing its own approach to the “shift left” dilemma of moving cybersecurity earlier in the software development cycle.)

Tanya has spent much of her career in cybersecurity and IT empowering others to strengthen their own skills. With We Hack Purple, she built a community from the ground up, and she’s organized plenty of security talks and capture-the-flag tournaments along the way. Computer science can be a nebulous, wide-ranging field – Tanya has further helped people zero in on what they should focus on learning in the wide world of cybersecurity.

-------

Tune into the episode to hear more on:
* The story behind Tanya’s bestselling book, “Alice and Bob Learn Application Security”

* The qualities that make a good pentester: “You have to be very determined and detail oriented,” as Tanya put it

* #cybermentoringmonday and the value of professional mentorship

-------

Links:

* https://wehackpurple.com/

* https://brightsec.com/

* https://www.synack.com/

* https://readme.security/

Melanie Teplinsky on the Value of Cybersecurity Policy, a Zero Trust Model for Small Businesses and her Start at the NSA Nov 17, 2022

Melanie Teplinsky fell in love with cryptography at an early age, which led her to landing her first job at the National Security Agency at 16. From there, she found her niche in cybersecurity at the intersection of technology and the law.

As a senior fellow at American University in the Law Tech, Law, and Security Program, Melanie helps craft cybersecurity policies that scale and attempt to solve big, societal problems. First, she has to understand how cybersecurity technology and models, such as zero trust, are implemented at companies and organizations of all sizes. Then, she applies those principles to existing laws and government mandates to understand the pitfalls and gaps.

Between her early start in cyber and national policy-making, Melanie has a unique perspective to share with the infosec community.

Listen to the episode to hear more about:

* How cybersecurity policy can transform small- and medium-size businesses’ approach to zero trust

* Why protecting innovation efforts at universities and small companies is paramount for the cybersecurity industry

* The positive outcomes from collaboration between the public and private sectors

Links:

* https://www.wcl.american.edu/impact/initiatives-programs/techlaw/our-team/melanie-teplinsky/

* https://www.atlanticcouncil.org/in-depth-research-reports/report/cybersecurity-for-innovative-small-and-medium-enterprises-and-academia/

* https://www.synack.com/

* https://readme.security/

Zinet Kemal on Starting Over, Infosec for Kids and the Importance of Mentorship Nov 03, 2022

Zinet Kemal is an infosec powerhouse. After emigrating from Ethiopia to Minnesota with her husband, she started her life over. She left behind her community and career as a lawyer and dived into the world of information security.

She has since become a children’s book author and works as a cloud security engineer for Best Buy, while raising her four kids and completing her master’s degree in cybersecurity from Georgia Tech University.

In the latest episode of WE’RE IN!, Zinet shares how she published two children’s books during the pandemic, “Proud in Her Hijab” and “Oh, No ... Hacked Again!: A Story About Online Safety,” and about her work with Black Girls in Cyber.

Listen to the episode to hear more about:

* How you can teach kids (and grandparents) about cybersecurity

*Zinet’s journey from immigrant to best selling author

*The power of diversity in cybersecurity

Links:

*https://zinetkemal.com/

*https://www.synack.com/

*https://readme.security/

Sean Zadig on the “Paranoids,” Ethical Hacking and Crafting a Security Culture Sep 30, 2022

Sean Zadig has plenty to be paranoid about. The internet is a frightening place, and Yahoo’s Paranoids–the name for the company’s infosec team–have their work cut out for them protecting Yahoo’s more than one billion global users.

As vice president, chief information security officer and “Chief Paranoid” for Yahoo, Sean is charged with keeping sensitive company data safe from an onslaught of cyberthreats, working collaboratively across all Yahoo’s media and technology brands.

In the latest WE’RE IN! episode, Sean speaks to the need for balance in security messaging and shares how he addresses risks like Log4j.

It takes patience and finesse to build a strong culture of security in any organization, let alone a global tech and media company with thousands of employees.

“It's important to not shame people, so you don't want to say, ‘how could you miss this?’ Or, ‘what happened? Why, why did you commit that code?’” Sean says. “Instead, we use it as a learning experience.”

Tune in to discover how Sean keeps Yahoo on the right track and hear more about:

* Yahoo’s approach to bug bounties and pentesting

* His unlikely path to security leadership– “It was never my career aspiration to become a CISO”

* Sean’s focus on examining what motivates the attackers targeting Yahoo every day

Links:

* https://www.yahooinc.com/technology/paranoids-blog/

* https://www.synack.com/

* https://readme.security/

Jack Rhysider on Podcasting, Plot Twists and Infosec Burnout Aug 19, 2022

Four years ago, Jack Rhysider quit his job as a security engineer to move full time into the storytelling business. His podcast, Darknet Diaries, now boasts tens of millions of total downloads and has explored cybersecurity topics from Stuxnet to the collapse of cryptocurrency exchange Mt. Gox.

Building Darknet Diaries into a successful show was no cakewalk. In the latest episode of WE’RE IN!, Jack shares his experience putting on a great podcast, from ideation and guest selection all the way to monetization and fielding calls from Hollywood producers.

“Don’t think about how big of an audience you have,” he said. “You need to find the right person in your head, of who would love this show, and just deliver it to them in a great way.”

---------

Even if you’re not a podcast creator, there are plenty of reasons to listen:

* Glean Jack’s insights into the creative process, including the importance of self-reflection and listening with “fresh ears”

* Hear how he navigates constant deadline pressure while avoiding burnout

* Learn the secrets behind the most suspenseful moments in any great story

Tracy Maleeff on Diversifying the Cyber Workforce, OSINT Skills and “Librarian Face” Jul 29, 2022

Tracy Maleeff led a successful career transition into the tech and cybersecurity world nearly seven years ago. Now a security researcher with the Krebs Stamos Group, the former librarian still uses her hard-won open source intelligence skills to sort through a deluge of cybersecurity information for clients and for subscribers of her free InfoSecSherpa news roundups.

In the latest WE’RE IN! episode, she speaks to the importance of having diverse perspectives at the table when it comes to cybersecurity and warns of a disconnect between tech hiring managers and HR departments.

“Companies keep hunting for unicorns when they really just need to pay attention to the squirrels at the base of the tree,” Maleeff said.

---------

Here are a few more reasons to listen:

* Discover Tracy’s tips for breaking into the cybersecurity industry from other professions: She once helped a mechanic launch a career in pentesting

* Learn how she’s used Twitter to advance her own cybersecurity career

* Hear about out her favorite episode of Keeping up with the Kardashians – and yes, there is an infosec connection!

---------

Links:

* https://infosecsherpa.medium.com/

* https://www.ks.group/

* https://www.synack.com/

* https://readme.security/

Beau Woods on Medical Device Security, Hacker Culture and Cyber Psychology Jul 21, 2022

Beau Woods knows firsthand how every moment counts when it comes to medical cybersecurity. He launched his career in a hospital, where it wasn’t always possible for doctors to punch in complex passwords or spare a second thought for cybersecurity. Beau went on to found I Am the Cavalry, a group of cyber ambassadors dedicated to improving the security of devices ranging from pacemakers to connected door locks.

In his current role as senior advisor for the Cybersecurity and Infrastructure Security Agency, Beau helps fill gaps in U.S. cyber defenses by boosting organizations that may not have the resources or knowledge needed to secure critical connected equipment like insulin pumps.

“If you can get ahead of things and help them to build better procurement processes, help them to identify more securable technologies that have better business models, that will have greater longevity, then you can stop the flow of inbound, insecurable devices and – over the next decade or two – eventually that cyber hygiene tide line can rise,” he said in this episode of WE’RE IN!

----------

Here are a few more reasons to tune in:

* Learn Beau’s tips for making cybersecurity issues more engaging, from gamification to building empathy

* Hear about his unconventional career path from psychology to security

* Build awareness on the state of healthcare cybersecurity and CISA’s role in government

----------

Links:

* https://www.cisa.gov/
* https://iamthecavalry.org/
* https://www.synack.com/
* https://readme.security/

Robert M. Lee on Hacking Industrial Systems, Pay Transparency and Oysters Jun 03, 2022

Dragos CEO and founder Robert M. Lee has been talking about cybersecurity risks to critical infrastructure long before threats to utility operators and water plants were making headlines. In this episode of WE'RE IN!, he discusses the ongoing dangers to the grid from nation-state hackers and ransomware gangs, but also the progress the U.S. is making to better secure its most vulnerable assets. And there's also a great conversation about pay transparency that anyone working in infosec will want to hear.

A few more reasons to listen:

*It's a candid and sobering interview with one of the world's leading experts on industrial cybersecurity.

*You might be surprised how Dragos approaches pay transparency, hiring and job interviews.

*Better understand how critical infrastructure operators should approach cybersecurity differently from enterprise technology.

Key quotes:

* "If you are an oil and gas pipeline or a manufacturing company, and you haven't had ransomware scenarios at a board level with an understanding of what you're doing specifically in OT, your liability and your lawsuit is going to be bad."
* "One hundred percent of our engineers are in the United States. We don't outsource anything where they're related to our product, because if we're deploying software into nuclear power plants and similar, I'd like control of the supply chain."
* "We've been talking about cyber at a presidential, international leader, board level for a long time. But they never knew they needed to differentiate between IT and OT. And now they're realizing all the resources have been spent on the non-revenue generating side of the business and they're going, "Holy crap! What's our OT cybersecurity strategy?"

Links:

* https://www.dragos.com/

* https://www.synack.com/

* https://readme.security/

Jim Manico on Secure Coding, OWASP and Being a Decent Human May 03, 2022

Jim Manico is full of opinions. The founder of Manicode Security has advice on how to use the OWASP Top 10, on secure coding and especially on the OWASP Application Security Verification Standard (ASVS). He has advice for people starting out in security and all around thoughts on what it means to be a decent person. Jim is definitely one of those! He's also an educator, author, investor and entrepreneur. There are so many reasons to listen to this episode. Here are just a few:

* Hear from one of the leading educators focused on helping developers code securely.

* Learn more about all the important projects and initiatives happening at OWASP.

* Get Jim's perspective on how organizations can best implement DevSecOps.

Key quotes:

* "Honestly, you shouldn't be basing a security program on the OWASP Top 10. The Top 10 is meant for one purpose only: awareness. This is not just my opinion. This is actually codified in the introduction of the Top 10."

* "Being a decent human being, being a community supporter, trying to help people out, giving free talks: you can call it being a decent person, but it's also a good life and business strategy."

* "Learn how to f-ing code. And you don't have to be an expert at it. You don't have to be a software engineer, but if you're an IT professional and you don't even understand the basics of coding, it's going to limit your capability because the best pentesters I know write scripts."

Related links:

* https://manicode.com/

* https://owasp.org/www-project-top-ten/

* https://owasp.org/www-project-application-security-verification-standard/
* https://www.synack.com/

Alex Holden on Russia's Cyber Arsenal, Conti Leaks and Infiltrating Ransomware Gangs Apr 21, 2022

Alex Holden has a knack for tracking Russian cyber criminals. The Ukrainian-born cybersecurity expert understands what it takes to infiltrate ransomware outfits, learn their secrets and help organizations protect themselves against their tactics. Beyond that, his firm is responsible for detecting some of the biggest breaches in recent history. In this episode, Alex talks about his approach to tracking the world's most notorious criminal hackers, the current cyber threat in Eastern Europe and his own journey from Kyiv to the American midwest.

Why should listen:

* Get the inside story of how the Conti ransomware gang and other Eastern European cybercrime syndicates operate.

* Hear about how the current Ukrainian War could shift the cyber threat landscape.

* Discover how one of the leading threat intelligence researchers uncovered some of the biggest data breaches in history.

Key quotes:

* "Russia knows how to wage cyber warfare. And they continuously keep showing us that they can ... So I think Russia is in [a] very powerful position to flex their cyber muscle to do damage."

* "We are watching a huge change in the cybersecurity threat landscape in Eastern Europe. Ukrainian cybercrime is not dead. They're still doing certain things in the western part of Ukraine. Some of them are moving into Eastern Europe ... The same is happening in Russia. Cyber criminals are afraid that the recent crackdown of the Russian government against them will continue."

* "If you are at all interested in threat intelligence or in cybersecurity, I would recommend sitting down and reading [the Conti leaks] because you're going to see how the real criminals work, how they think, how they evolve and how the everyday gang works."

Links:

* https://holdsecurity.com/

* https://www.synack.com/

Hacking for Ukraine, Supply Chain Risk and Cyber Moonshots Apr 01, 2022

There's a flood of cybersecurity news as a result of the Ukraine War as well as Washington's recent efforts to compel organizations to report cyberattacks to federal officials. In this episode, Trey Herr and Emma Schroeder of the Atlantic Council’s Cyber Statecraft Initiative break it all down. They explore the consequences of an escalating digital battlefield in Europe, whether a hack could bring NATO into the war and strategies for creating more consensus within the tangled and complicated realm of cyber policy.

Why you should listen:

* Understand what's at stake as cyber warriors do battle on both sides of the the Ukraine War.

* Lean about some potential consequences of a destructive hack in Europe and whether that could even draw NATO into the war.

* Hear what Washington is doing to obtain better insights and actionable intelligence that could improve cybersecurity defenses.

Key quotes:

* "Cybersecurity generally is not a good state of affairs. So I think we are going to see some regulatory changes that make it much harder for certain classes of companies to operate because they've grown up around this inefficient system."
* "The physical military invasion [into Ukraine] has not necessitated sophisticated cyber support from the Russians. What's been more important in the information space is misinformation [and] disinformation."
* "You've got a lot of [outside hackers] tripping over systems to try to find some kind of way in to do something. And the challenge is that's not really strategic. You don't have any of these groups plugged into the target selection and intelligence collection processes that Western agencies have."

Links:

* https://www.atlanticcouncil.org/

* https://www.atlanticcouncil.org/programs/scowcroft-center-for-strategy-and-security/cyber-statecraft-initiative/

* https://www.atlanticcouncil.org/thecybermoonshot/

* https://www.synack.com/

Gabriella Coleman on Anonymous, Hacker History and the Evolution of Infosec Mar 08, 2022

Gabriella Coleman, a Harvard University anthropology professor, describes how she immersed herself in hacker culture and eventually became embedded in the shadowy and mercurial world of Anonymous, the hacktivist collective she chronicled in her 2015 book, "Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous." This is such a fascinating episode that explores the often misunderstood history of hacking and how many in this community went from outside agitators to mainstream security researchers.

-------

Why you should listen:

* Get a better understanding of the history of Anonymous and the role it played in shaping online protests and whistleblowing.

* Hear about some of the earliest hacking communities such as the free software hackers and efforts to archive their early writings and magazines.

* Get an anthropological perspective on how hackers have evolved from the fringes of the tech world to among the most influential voices in cybersecurity.

-------

Key quotes:

* "There's now a new narrative that there was a single founder of Anonymous, the trolls and the early hacktivists. And that's just wrong in terms of historical record."

* "I'm not surprised that hackers were at the forefront of establishing the protocols for the security industry."

* "The moment you cower, the moment you're not willing to speak up, that's the minute that I think ... the hacker spirit is dead and can't be effective in initiating change."

-------

Links:
* https://www.synack.com/
* https://gabriellacoleman.org/
* https://datasociety.net/library/wearing-many-hats-the-rise-of-the-professional-security-hacker/

Micah Hoffman Breaks Down OSINT, the Dark Web and Beer Apps Feb 08, 2022

In this episode, Micah Hoffman talks about his career in Open Source Intelligence (OSINT) and the value it has for investigations, cybersecurity and understanding how information is weaponized. He also gets into strategies for safeguarding personal privacy in the face of increasing digital surveillance. This episode will have you thinking twice about what you post on social media!

Why you should listen:
* Hear from one of the leading Open Source Intelligence researchers working today.
* Learn about the value of OSINT for offensive and defensive cybersecurity.
* Get a better understanding of all the privacy risks from fitness trackers, apps, shopping online and social media.
Key quotes:

* "OSINT is a reconnaissance skill. It's all about that preparation work that needs to be done before you do anything in cyber, whether it's attacking or defending."

* "Once things are on the internet -- or once things are even collected, not necessarily on the internet -- you've lost control of it."
* "The reality is that we give up our privacy every single time we use an app, every single time we choose to purchase something."

Links:

* https://www.spotlight-infosec.com/

* https://osintcurio.us/

* https://www.synack.com/

Nicolas Chaillan takes on the Pentagon, China and TikTok Jan 19, 2022

Nicolas Chaillan, former Air Force Chief Software Officer, resigned from the DoD over frustrations with what he called a lack of innovation, collaboration and agility. He gets into those issues and talks about how the U.S. can invest more in technology to compete with China in artificial intelligence and cybersecurity.

---------

Why you should listen:

* Nicolas offers a candid and controversial view of the military's approach to the growing technological threat from China.

* He outlines his view for a Pentagon that is more agile, collaborative and competitive.

* Hear from a former DoD insider about some of the institutional barriers that can hinder innovation and software advancements.

---------

Key quotes:

* "In 10, 15, 20 years from now, America as we know it and the value we have and the freedom we enjoy will be at risk of going away if China dominates in AI like they are doing now."

* "TikTok is effectively an intelligence weapon of China on US citizens right now."

* "We don't see a lot of training and implementation of Agile at all in the DoD, which really leads to the inability to move at the pace of relevance and tremendous waste of taxpayer money."

---------

* https://www.synack.com/

* https://www.linkedin.com/in/nicolaschaillan/

* https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-chaillan/

* https://ama.preventbreach.com/register

Phillip Wylie on Bear Wrestling, Pentesting and Understanding the Adversary Dec 23, 2021

In this episode, Phillip Wylie talks about his journey from pro wrestling to pentesting and what motivated him to start teaching, mentoring and giving back to the infosec community. It's an inspirational story for veterans in the field and newbies alike. Phillip not only talks about his work helping others get started in ethical hacking, but the value of truly understanding the mind of the adversary.

-------

Why you should listen:

* Phllip's story is both educational and inspirational -- worthwhile for anyone interested or involved in cybersecurity.

* Learn something from one of the most prolific cybersecurity speakers and educators.

* Get a better understanding of ethical hacking and the value of offensive security testing.

-------

Key quotes:

* "Once you learn how to pentest, your whole world changes."

* "For people that have been in the industry for a while, listen to the new folks. I learned a lot from my students."

* "If you can help people succeed, that's even more rewarding than personal success."

-------

Links:

* www.synack.com

* https://twitter.com/PhillipWylie

* https://www.youtube.com/c/ThePwnSchoolProject

* https://www.itspmagazine.com/the-hacker-factory-podcast

Kim Zetter on Election Security, Stuxnet and Substack Dec 10, 2021

Kim Zetter is a former staff writer at WIRED and author of the seminal cybersecurity book “Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.” Her work has appeared in The New York Times, POLITICO, The Washington Post and regularly in her Substack newsletter, “Zero Day.” In this episode, Kim talks about her approach to reporting, what sparked her Stuxnet investigation and how the discovery of that malware fundamentally altered our global cybersecurity conversation.
Why you should listen:

* Hear from one of the most influential and knowledgeable journalists writing about cybersecurity today.
* Get her take on some of the biggest security stories of 2021 such as Colonial Pipeline and the Pegasus Project.
* Learn more about the key policy debates around election security and critical infrastructure protections.
Key Quotes:
* “Stuxnet really helped shine a light on industrial control systems as a target.”
* “We focus too much on the stuff that makes the headlines and completely ignore the innocuous things that you’re downloading onto your phone .... Those things are spying on you, as well.”
* “The Obama administration was the first administration to [make] cyber a priority, but they didn't really put critical infrastructure as a priority in the sense of using the government's weight to force security on critical infrastructure. We're actually only seeing that in this last year … in the wake of Colonial Pipeline.”
* “When we saw Russia trying to interfere in 2016, that woke up DHS that someone, somewhere needed to have some kind of influence over election officials.”

Links:

* www.synack.com

* https://zetter.substack.com/
* https://www.nytimes.com/2018/09/26/magazine/election-security-crisis-midterms.html

Defense Digital Service Acting Director Katie Olson on drones, DEF CON and Hacking the Pentagon Nov 19, 2021

Defense Digital Service Acting Director Katie Olson heads up a team of about 80 technologists working on some of the toughest challenges facing the U.S. Department of Defense. Since Katie started leading the team, often called the Pentagon’s “SWAT team of nerds," it has increasingly focused on the threat from drones, cybersecurity risks in space and the consequences of climate change. In this episode, Katie talks about this cutting-edge work, how DDS helped the Pentagon reduce the impact of COVID-19 and what big issues her team will tackle next.

-------

Why you should listen:

* Learn about some of the most cutting-edge work going on inside the Pentagon.

* Better understand emerging threats such as drones and risks associated with climate change.

* Hear how DDS helped the military rapidly deploy technology to reduce the spread of COVID-19.

-------
Key Quotes:

* "What I've seen shifting in my time here is making security researchers the good guys."

* “Facilitated by the pandemic, we are seeing just increased awareness and attention to cybersecurity.”

* “It would be better for us to check our defenses first before we have some kind of major breach.”

* “For those white hat hackers who want to contribute to national security, [there’s] a huge opportunity.”
-------

Related Links:

www.synack.com

https://www.dds.mil/

https://www.synack.com/blog/3-years-of-hack-the-pentagon/

https://www.usds.gov/projects/hack-the-pentagon

CryptoHarlem Founder Matt Mitchell on Hacking for Humanity Nov 12, 2021

Earlier this year, the Electronic Frontier Foundation named Matt Mitchell, founder of CryptoHarlem, one of its 2021 Pioneer Award winners for his groundbreaking work to protect Black communities from surveillance. In this episode, Matt talks about what led him to apply his hacking skills to social justice causes and how that led to his role today as a Technology Fellow for the BUILD program at the Ford Foundation. Matt also discusses what Twitch can do to safeguard creators and the steps anyone can take to better protect themselves online.

--------

Why you should listen:

* Hear from a hacker working on the frontlines of today’s most important racial justice issues.

* Better understand the state of digital surveillance in Black communities.

* Hear about what steps platforms such as Twitch can take to better protect creators.

* Learn the three things everyone online should do to better protect themselves on the internet.

* Discover where “Mr. Robot” placed an elusive CryptoHarlem Easter egg.

--------

Key Quotes:

* “It's really about taking the skill that we have and applying it toward something bigger than yourself.”

* “Under the lens of a surveyor, who’s always looking for wrongs, you’ll find what you’re looking for all the time.”

* “We sometimes confuse public safety with surveillance.”

* “I'm pretty realistic. If you look at the number of cyberattacks that came from sticky notes on personal computers, it’s zero. But don’t put a sticky note on the nuclear codes.”

--------

Related Links:

* Synack.com

* https://www.cryptoharlem.com/

* https://www.fordfoundation.org/

* https://calyxinstitute.org/

Lifelong Hacker Alyssa Miller Breaks Down Cybersecurity Barriers Oct 15, 2021

Alyssa Miller, Business Information Security Officer at S&P Global Ratings and author of the forthcoming book, “Cyber Defenders' Career Guide, is one of the most provocative, unfiltered and interesting voices in the cybersecurity community. She’s essential reading on infosec Twitter and a regular draw at conferences around the world. In this episode, she dives into all sorts of issues in the cybersecurity community, from incoherent job postings to a lack of diversity—she covers it all. Tune in to find out how you can best address these problems and also learn how to reach out of your comfort zone and forge your own path to success.

--------

Why you should listen:

* Figure out why most cybersecurity job postings “suck” and how the industry can help fix the issue.

* Learn how to address key issues that come up during a cybersecurity job hunt.

* Identify how to maximize opportunities for personal growth and realize your potential in the infosec community.

* Understand how to be a better ally to underrepresented groups in the cybersecurity community.

* Hear about the value of diversity and inclusion in cybersecurity.

--------

Key Quotes:

* “Read the narrative at the beginning of the job description. If that sounds like something you can do and something you can learn and grow in, apply. The very worst thing they can do is tell you no."

* "The difference between you experiencing success or not is in how you respond to opportunities. Do you take those moments and go after them or do you let them go by the wayside."

* “If we want to be better at cybersecurity, having diversity matters.”

* "You don't get diversity of thought by having 20 heterosexual white males sitting in a room talking about how to build cybersecurity defenses."

--------

Related Links:

* Synack.com

* https://www.synack.com/lp/cloud-security-solutions/

*https://twitter.com/AlyssaM_InfoSec?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor

* https://alyssasec.com/

Google Cloud Evangelist Stephanie Wong on “Blameless” Security Culture Sep 29, 2021

In this episode, Stephanie Wong, head of Google Cloud Developer Engagement, explores Google’s security culture, why it conducts “blameless” postmortems after security testing and how it’s working to dispel lingering misconceptions about the cloud. She also talks about her journey in Silicon Valley and how her experiences winning pageants such as Miss Asian North America 2020 helped her become one of today’s most visible technology content gurus.

Why you should listen:

* Learn how to build an effective cybersecurity culture within your organization.

* Get the inside scoop on the security precautions that Google takes with its physical data center.

* Hear about what Google is doing to overcome misperceptions about cloud security.

* Figure out how to conduct security postmortems the Google way.

* If you don't know about the "pancake principle," you'll find out why it matters, and how it can work for you.

Key Quotes:

* "It's become really clear that remote work will be a very defining characteristic of the new normal and modernizing security is going to be imperative."

* "Our teams are really horrified by network-based security because network-based security is hackable, even with two factor authentication."

* “It's all about empowering [users] so that they can be the ones to flag suspicious activity, websites, and phishing in emails."

* "Being in Silicon valley, we're often in a bubble where we assume that a lot of people already understand the value of [the cloud] and how it can actually increase your security posture overall."

* "It's all about blameless postmortems and a blameless culture. No pointing fingers. If something goes wrong, it's all about how can we improve it."

Our TOPPODCAST Picks

Follow Us

Stay Connected

WE’RE IN!

Related Podcasts

Links

Stay Connected