Word Notes

Latest Episodes:

Shields Up (noun) Mar 29, 2022

Show notes

A condition announced by the US Cybersecurity and Infrastructure Security Agency (CISA) to draw attention to a temporary period of high alert, associated with expectation of a connected wave of cyberattacks prompted by either a widespread vulnerability or an unusually active and capable threat actor.

CyberWire Glossary link: https://thecyberwire.com/glossary/shields-up

Audio reference link: “Star Trek II Wrath of Khan - Reliant vs Enterprise; First Clash” YouTube, YouTube, 11 Apr. 2015,

Learn more about your ad choices. Visit megaphone.fm/adchoices

Software Assurance Maturity Model (SAMM) (noun) Mar 22, 2022

Show notes

A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.

Audio reference link: "OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)." by Pravir Chandra, OWASP MSP, 2009.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Universal 2nd Factor (U2F) (noun) Mar 15, 2022

Show notes

An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.

Cyberwire Glossary link: https://thecyberwire.com/glossary/u2f

Audio reference link: “Rise of the Machines: A Cybernetic History,” by Thomas Rid, Published by W. W. Norton Company, 21 November 2017.

Learn more about your ad choices. Visit megaphone.fm/adchoices

adversary group naming (noun) Mar 08, 2022

Show notes

A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.

Learn more about your ad choices. Visit megaphone.fm/adchoices

BSIMM (noun) Mar 01, 2022

Show notes

A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops.

CyberWire Glossary link: https://thecyberwire.com/glossary/bsimm

Audio reference link: “OWASP AppSecUSA 2014 - Keynote: Gary McGraw - BSIMM: A Decade of Software Security.” YouTube Video. YouTube, September 19, 2014.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP vulnerable and outdated components (noun) Feb 22, 2022

Show notes

Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version.

Audio reference Link: "The Panama Papers: A Closer Look," Late Night with Seth Meyers, YouTube, 12 April 2016

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP software and data integrity failures (noun) Feb 08, 2022

Show notes

Code and data repositories that don't protect against unauthorized changes.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP server-side request forgery (noun) Feb 01, 2022

Show notes

An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers.

Learn more about your ad choices. Visit megaphone.fm/adchoices

OWASP security logging and monitoring failures (noun) Jan 25, 2022

Show notes