Word Notes

Latest Episodes:

Encore: social engineering (noun) Oct 10, 2023

Show notes

The art of convincing a person or persons to take an action that may or may not be in their best interests. Social engineering in some form or the other has been around since the beginning of time. The biblical story of Esau and Jacob might be considered one of the earliest written social engineering stories. As applied to cybersecurity, it usually involves hackers obtaining information illegitimately by deceiving or manipulating people who have legitimate access to that information. Common tactics involve phishing attacks and watering hole attacks.

Learn more about your ad choices. Visit megaphone.fm/adchoices

joint cyber defense collaborative (JCDC) (noun) Oct 03, 2023

Show notes

A cyber information-sharing U.S. Government organization designed to foster the public-private partnership.

CyberWire Glossary link: https://thecyberwire.com/glossary/joint-cyber-defense-collaborative

Audio reference link: Jen Easterly. 2021. CISA Director Addresses the National Technology Security Coalition [Video]. YouTube. URL https://www.youtube.com/watch?v=ucb1FQXqsao

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: penetration test (noun) Sep 26, 2023

Show notes

The process of evaluating the security of a system or network by simulating an attack on it. Sometimes called "ethical hacking" or white hat hacking. The phrase started to appear in U.S. military circles in the mid 1960s as time sharing computers became more necessary for daily operations. Computer security experts from Rand Corporation began describing computer compromises as “penetrations.” By the early 1970s, government leaders formed tiger teams of penetration testers to probe for weaknesses in various government systems.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cloud Security Posture Management (CSPM) (noun) Sep 19, 2023

Show notes

Tools that automate the identification and remediation of cloud misconfigurations.

CyberWire Glossary link: https://thecyberwire.com/glossary/cloud-security-posture-management

Audio reference link: Josh Whedon. 2005. Serenity [Movie]. IMDb. URL https://www.imdb.com/title/tt0379786/

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: The Bombe (noun) Sep 12, 2023

Show notes

An electro-mechanical device used to break Enigma-enciphered messages about enemy military operations during the Second World War. The first bombe–named Victory and designed by Alan Turning and Gordon Welchman– started code-breaking at Bletchley Park on 14 March 1940, a year after WWII began. By the end of the war, five years later, almost 2000, mostly women, sailors and airmen operated 211 bombe machines in the effort. The allies essentially knew what the German forces were going to do before the German commanders in the field knew. Historians speculate that the effort at Bletchley Park shortened the war by years and estimate the number of lives saved to be between 14 and 21 million.

Learn more about your ad choices. Visit megaphone.fm/adchoices

single sign-on (SSO) (noun) Sep 05, 2023

Show notes

A session and user authentication Zero Trust tactic that allows a user to access multiple applications with one set of login credentials.

CyberWire Glossary link: https://thecyberwire.com/glossary/single-sign-on

Audio reference link: English, J., 2020. What is Single Sign-On (SSO)? SSO Benefits and Risks [Video]. YouTube. URL https://www.youtube.com/watch?v=YvHmP2WyBVY

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: cross-site scripting (noun) Aug 29, 2023

Show notes

From the intrusion kill chain model, a malicious code delivery technique that allows hackers to send code of their choosing to their victim’s browser. XSS takes advantage of the fact that roughly 90% of web developers use the JavaScript scripting language to create dynamic content on their websites. Through various methods, hackers store their own malicious javascript code on unprotected websites. When the victim browses the site, the web server delivers that malicious code to the victim’s computer and the victim’s browser runs the code.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: credential stealing (verb) Aug 22, 2023

Show notes

From the intrusion kill chain model, the first part of an exploitation technique where the hacker tricks their victims into revealing their login credentials. In the second part of the technique, hackers legitimately log into the targeted system and gain access to the underlying network with the same permissions as the victim. Hackers use this method 80% of the time compared to other ways to gain access to a system like developing zero day exploits for known software packages. The most common way hackers steal credentials is with some version of a phishing attack.

Learn more about your ad choices. Visit megaphone.fm/adchoices

two-factor authentication (noun) Aug 15, 2023

Show notes

An authentication process that requires two different factors before granting access.

CyberWire Glossary link: https://thecyberwire.com/glossary/two-factor-authentication

Learn more about your ad choices. Visit megaphone.fm/adchoices

Encore: phishing (verb) Aug 08, 2023

Show notes

From the intrusion kill chain model, the delivery of a “lure” to a potential victim by pretending to be some trustworthy person or organization in order to trick the victim into revealing sensitive information. According to Knowbe4, the word “phishing” first appeared in a Usenet newsgroup called AOHell in 1996 and some of the very first phishing attacks used AOL Instant Messenger to deliver fake messages purportedly from AOL employees in the early 2000s. The word is part of l33tspeak that started in the early days of the internet (1980s) as a shorthand to let readers know the author was part of the hacker community. In this case, the letters “ph” replace the letter “f” in the word fishing, as in “I fish, with an ‘f,’ for bass in the lake.” In hacking, “I Phish, with a ‘ph,’ for login credentials from key employees at my target’s organization.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected