Hey everyone! We're almost done with 2014 and another new year is right around the corner. We thought this was the perfect time to sit back, relax a little and reflect on the year that was...and boy was it ever!

Jack Daniel & Allison Miller join Michael, James and I on the podcast to talk it all out, share a few chuckles and try to make sense of it all!

Thanks for listening everyone, it's been an epic year and we look forward to more awesome things in 2015!

In this episode

Attorney and CFAA expert Shawn Tuma joins us to talk about the US vs. Salinas case where Mr. Salinas was threatened with 440 years in jail, and now plead down to a misdemeanor. Prosecutorial discretion, or attorneys-gone-wild?

Link: http://www.wired.com/2014/11/from-440-years-to-misdemeanor/

Topics covered

• The unfolding case of the Sony Pictures Entertainment breach
  • http://blog.wh1t3rabbit.net/2014/12/when-press-aids-enemy.html
  • http://www.thedailybeast.com/articles/2014/12/12/shocking-new-reveals-from-sony-hack-j-law-pitt-clooney-and-comparing-fincher-to-hitler.html
  • http://www.csoonline.com/article/2857455/business-continuity/fbi-says-theres-nothing-linking-north-korea-to-sony-hack.html
  • http://www.csoonline.com/article/2854672/business-continuity/the-breach-at-sony-pictures-is-no-longer-just-an-it-issue.html
• The phishing scam that succeeded at hitting a big chunk of Wall Street - it probably would have fooled you too. Here's what we've learned
  • http://arstechnica.com/security/2014/12/phishing-scam-that-penetrated-wall-street-just-might-work-against-you-too/
• Iranian hackers hit Las Vegas behemoth with a sophisticated attacked ... wait it was a Visual Basic base?!
  • http://arstechnica.com/security/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/
• Judge refuses to dismiss case against Target, brought on by banks who are the ones who take the brunt of the losses-
  • http://arstechnica.com/tech-policy/2014/12/judge-rules-that-banks-can-sue-target-for-2013-credit-card-hack/

In this episode

• Michelle explains to us what Enterprise Architecture is, and what it isn't
• Michelle gives her take on how both security and enterprise architecture both support each other
• We discuss the roll of standards, standards, standards - and why you can't have security without it
• We talk about GRC
• We talk through roles & responsibilities definition between security, architecture, and the rest of IT
• "Application Portfolio Rationalization" --the most impossible project. Ever.
• Michelle schools us on data, high-value assets, meta-data and the really hard topics for security
• Michelle gives us a series of examples of "HOW" we can find high-value assets, and start security there
• Michelle addresses the phrase "business alignment" since it's pivotal to enterprise architecture

Guest

• Michelle-Marie Strah ( @CyberSlate ) - Director, Enterprise Architecture at NBCUniversal – recently joined the newly formed Strategy and Architecture team at NBCUniversal designed to drive enterprise architecture, solutions architecture and innovation management across all companies in the NBCUniversal global portfolio. Previously she was at Microsoft Corporation worldwide headquarters where she was responsible for leading emerging markets cloud deployments, go to market and compete strategies in Latin America for public, private and hybrid cloud offers (both Azure and partner hosted clouds). As part of her role on the Applied Incubation Team she worked closely with partners, CIOs and government officials as well as internal CTO, legal, and chief security officer teams in the region to ensure privacy and security standards for government and private sector cloud adoption in Latin America. As an enterprise architect, Michelle specializes in governance, risk, compliance, information security and enterprise information management and has decades of experience in highly regulated industries, government, defense and healthcare.

Additional Links

• IBM Security Framework: http://www.redbooks.ibm.com/abstracts/sg248100.html?Open
• OSA: http://www.opensecurityarchitecture.org
• TOGAF: The Open Group Architecture Framework: http://www.opengroup.org/togaf/

Topics covered

• Sony Pictures is having a very, very bad couple of days - and it could keep getting worse.
  • http://www.theverge.com/2014/11/24/7277451/sony-pictures-paralyzed-by-massive-security-compromise
  • http://www.csoonline.com/article/2852982/data-breach/sales-contracts-and-other-data-published-by-sonys-attackers.html
• A newly discovered (but old) comment bug in Wordpress affects ~86% of sites. The story isn't what you think it is-
  • http://www.consumeraffairs.com/news/newly-discovered-comment-security-bug-affects-86-of-wordpress-blogs-112414.html
• The Australian government is blaming a data breach from February on ... "awareness"? Michael disagrees (and he's right).
  • http://www.esecurityplanet.com/network-security/australian-government-data-breach-linked-to-poor-security-training.html
• The public release of the research on Regin malware has it pegged as the most advanced thing since the computer - so what?
  • http://money.cnn.com/2014/11/23/technology/security/regin-malware-symantec/index.html?hpt=hp_t2
  • https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/
  • Symantec whitepaper: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf
• The Justice Department is using a 225 year old law to tackle a modern problem of encrypted cell phones through the manufacturer.
  • http://blogs.wsj.com/digits/2014/11/25/case-suggests-how-government-may-get-around-phone-encryption/
• The court system...works? 440 year jail threat down to a misdemeanor in no time flat
  • http://www.wired.com/2014/11/from-440-years-to-misdemeanor/
• Updates:
  • Target doesn't feel like all the banks' losses are their problem, here's why - http://arstechnica.com/tech-policy/2014/11/target-to-judge-banks-losses-in-our-card-breach-arent-our-problem/
  • In spite of the massive breach, Home Depot financial outlook is bright - http://www.forbes.com/sites/maggiemcgrath/2014/11/18/home-depot-outlook-bright-despite-data-breach/

In this episode

• We revisit the 'human' side of hacking
• Chris tells us all about the Defcon CTF his team has hosted
• We discuss the role human nature plays in social engineering, or "Why the bad guys always win"
• Chris gives us his tips for making it harder for social engineers
• Michael and Chris talk metrics and measuring "getting better"

Guest

• Chris Hadnagy ( @HumanHacker ) - Chris Hadnagy (author of Social-Engineering: The Art of Human Hacking and Unmasking the Social Engineer: The Human Element of Security) is a speaker, teacher, pentester, and recognized expert in the field of social engineering and security.
  
  Chris Hadnagy is the President and CEO of Social-Engineer, Inc. He has spent the last 16 years in security and technology, specializing in understanding the ways in which malicious attackers are able to exploit human weaknesses to obtain access to information and resources through manipulation and deceit.
  
  Chris is a graduate of Dr. Paul Ekman’s courses in Microexpressions, having passed the certification requirements with an “Expert Level” grade. He also has significant experience in training and educating students in non-verbal communications. He hold certifications as an Offensive Security Certified Professional (OSCP) and an Offensive Security Wireless Professional (OSWP).
  
  Finally, Chris has launched a line of professional social engineering training and penetration testing services at Social-Engineer.Com. His goal is to assist companies in remaining secure by educating them on the methods used by malicious attackers. He accomplishes this by analyzing, studying, dissecting, then performing the very same attacks used during some of the most recent incidents (i.e. Sony, HB Gary, LockHeed Martin, Target, etc), Chris is able to help companies understand their vulnerabilities, mitigate issues, and maintain appropriate levels of education and security.
  
  Chris has developed one of the web’s most successful security podcasts, The Social-Engineer.Org Podcast, and the equally-popular SEORG Newsletter. Over the years, both have become a staple in most serious security practices and are used by Fortune 500 companies around the world to educate their staff.
  
  You can find Chris's articles for local, national, and international publications and journals, including Pentest Mag, EthicalHacker.net, and local and national Business Journals.

Links:

• Social Engineer Org - Your one-stop place for podcast, newsletter, and all things social engineering from Chris's team - http://www.social-engineer.org/
• SECTF Report - http://www.social-engineer.org/ctf/social-engineer-inc-releases-annual-report-def-con-22-social-engineering-capture-flag-sectf-contest/
• Social Engineer, Chris's company - http://www.social-engineer.com/

Note: The hashtag for the show on Twitter has changed, please connect with us using #DtSR going forward. Thanks!

Topics covered

• Update: Home Depot breach (Hint: apparently it was a 3rd party entry point)
  • Story: http://www.computerworld.com/article/2844491/home-depot-attackers-broke-in-using-a-vendors-stolen-credentials.html
  • Apparently as a reaction, all execs are being switched to iDevices (blame Windows? and why only execs?) - http://www.imore.com/home-depot-switches-execs-iphones-macbooks-it-blames-windows-massive-breach
  • Also, they lost ~53 Million email addresses too - http://online.wsj.com/articles/home-depot-hackers-used-password-stolen-from-vendor-1415309282
• American Express is pushing tokenization to their payment ecosystem, this is big news but leaves a lot more questions and concerns than answers (for example- what about chip & pin (sign)? )-
  • Story: http://threatpost.com/american-express-brings-tokenization-to-payment-cards/109137
  • Check out the standard itself: http://www.emvco.com/download_agreement.aspx?id=945
• Flaw found (in a lab) in the VISA EMV protocol, but is it realistic to do this kind of "immense fraud" in outside the lab, in real life?
  • Story: http://www.cio.com/article/2842994/flaw-in-visa-cards-could-ring-up-a-very-large-fraud.html
• The FTC further exerises its (Constitutional?) powers to take down fake "Support call scammers" and is on track to some public fanfare-
  • Story: https://nakedsecurity.sophos.com/2014/10/26/ftc-takes-down-fake-support-scammers-upbeat-about-getting-consumers-money-back-poll/
• Connecticut Supreme Court paves the way for class-action suit in HIPAA breach/violation. Big question- is this good for anyone other than the lawyers? Will it just add to the rising cost of healthcare, or is this doing some good?
  • Story: http://www.ctlawtribune.com/home/id=1202676138225/Conn-Supreme-Court-HIPAA-Decision-Likely-to-Spawn-More-Litigation
• A "spying software" that can spot a phone theft in "2 minutes"? Call us skeptical, and leary-
  • Story: http://www.fastcodesign.com/3038031/spying-software-spots-phone-theft-in-2-minutes-no-password-needed
• Starwood Hotels is going keyless with iPhone & iWatch integration for room entry. A great idea, if it's free of the usual security bugs.
  • Story: http://www.theipadfan.com/starwood-hotel-rooms-now-keyless-with-iphone-and-apple-watch-app-integration/
  • Michael's take on the story: http://www.csoonline.com/article/2691383/security-leadership/what-did-you-expect-to-happen-when-you-bought-the-electronic-lock.html
  • Episode 111, where we briefly cover this topic in detail via the Onity court case: http://podcast.wh1t3rabbit.net/dtr-episode-111-newscast-for-september-22nd-2014
• Breaches
  • BrowserStack goes down, gets transparent and honest, promises to come back stronger - http://www.browserstack.com/attack-and-downtime-on-9-November
  • "Massive" USPS data breach identified, hits customers and employees (cue the lawsuits!) - http://www.cnn.com/2014/11/10/politics/postal-service-security-breach/index.html?hpt=hp_t2
  • NOAA breached by .... China! - http://www.eweek.com/security/noaa-other-u.s.-agency-security-breaches-connecting-the-dots.html
  • State Department shuts down unclassified email system, after spotting "activity of concern" - http://www.nytimes.com/2014/11/17/us/politics/state-department-targeted-by-hackers-in-4th-agency-computer-breach.html?_r=0

In this episode

• Adam and Dmitri discuss what is (and what isn't) threat intelligence
• We discuss strategic, tactical and operational security intelligence
• Who is using threat intelligence, and how?
• Adam talks about the success factors, key points, and trends
• Michael asks how an organization can know whether they're READY for a threat intelligence program
• Adam explains the term "finished intelligence"
• Adam describes tactical intelligence, while Dmitri gives his take on strategic intelligence
• We discuss the merits of education and awareness - first
• How important is attribution, really?
• 3 critical things an enterprise *must be doing* before jumping into threat intelligence as a program

Guests

• Adam Meyers ( @adamcyber ) - Adam Meyers has over a decade of experience within the information security industry. He has authored numerous papers that have appeared at peer reviewed industry venues and has received awards for his dedication to the field. At CrowdStrike, Adam serves as the VP of Intelligence. Within this role it is Adam’s responsibility to oversee all of CrowdStrike’s intelligence gathering and cyber-adversarial monitoring activities. Adam’s Global Intelligence Team supports both the Product and Services divisions at CrowdStrike and Adam manages these endeavors and expectations. Prior to joining CrowdStrike, Adam was the Director of Cyber Security Intelligence with the National Products and Offerings Division of SRA International. He served as a senior subject matter expert for cyber threat and cyber security matters for a variety of SRA projects. He also provided both technical expertise at the tactical level and strategic guidance on overall security program objectives. During his tenure at SRA International, Adam also served as the Product Manager for SRA’s dynamic malware analysis platform Cyberlock.
• Dmitri Alperovitch ( @dmitricyber ) - Dmitri Alperovitch is the Co-Founder and CTO of CrowdStrike Inc., leading its Intelligence, Technology and CrowdStrike Labs teams.  A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft.  Prior to founding CrowdStrike, Dmitri was a Vice President of Threat Research at McAfee, where he led company’s global Internet threat intelligence analysis and investigations. In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions, and gave those incidents their names. In 2013, Alperovitch received the prestigious recognition of being selected as MIT Technology Review’s “Young Innovators under 35” (TR35), an award previously won by such technology luminaries as Larry Page and Sergey Brin, Mark Zuckerberg and Jonathan Ive. Alperovitch was named Foreign Policy Magazine’s Leading Global Thinker for 2013, an award shared with Secretary of State John Kerry, Elon Musk and Jeff Bezos. He was the recipient of the prestigious Federal 100 Award for his contributions to the federal information security in 2011 and recognized in 2013 as one Washingtonian’s Tech Titans for his accomplishments in the field of cybersecurity. With more than a decade of experience in the field of information security, Alperovitch is an inventor of eighteen patented technologies and has conducted extensive research on reputation systems, spam detection, web security, public-key and identity-based cryptography, malware and intrusion detection and prevention. Alperovitch holds a master's degree in Information Security and a bachelor's degree in Computer Science, both from Georgia Institute of Technology.

In this episode

• Jeff explains a little bit about who Norse is, and why they were potentially targeted with a DDoS
• We discuss what a DDoS is, how it becomes effective, and what methods/tools attackers use (in this case SNMP v2 reflection)
• We talk about threat intelligence (reputational intelligence) and how companies and intelligence platforms can leverage this data to decrease risks actively

Guest

• Jeff Harrell ( @jeffharrell ) - Jeff Harrell is the Vice President of Product Marketing at Norse, the leader in live attack intelligence. Jeff has over 15 years of experience in the IT Security industry leading product management and product marketing teams to build and market security solutions from end users to large enterprises. Jeff’s areas of expertise include cloud technology, threat intelligence, compliance, vulnerability management, configuration auditing, and encryption. Prior to Norse, Jeff worked for security and technology companies including nCircle, Qualys, McAfee, PGP, and eMusic.

Additional Links

• The attack map Jeff talked about: http://map.ipviking.com
• Blog post from Norse on the DDoS: http://blog.norsecorp.com/category/featured/2014/11/06/video-norse-live-attack-map-hammered-by-1-5-gbps-ddos-attack/

Topics covered

• Banks urging shoppers not to avoid breached retailers - Companies that get breached impact card holders minimally, at least as far as we can tell, right?
  • http://www.kcentv.com/story/26887771/local-bank-leaders-no-need-to-avoid-hacked-retailers-during-holidays
• Federal officials (FBI, US SS) are making a big push to be your source for cyber-security help - Interesting that this comes up at a time when everyone is fighting back against government meddling/surveillence
  • http://www.usatoday.com/story/news/politics/2014/10/20/secret-service-fbi-hack-cybersecuurity/17615029/
• The FCC flexes its muscle in a pair of fines totalling a paltry $10m for egregious security violations - Of course, the people who have had their privacy and security violated see none of this big-telco pocket-change...
  • http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/24/with-a-10-million-fine-the-fcc-is-leaping-into-data-security-for-the-first-time/
• Congress doesn't crant FBI ability to prevent mobile encryption .. undoubtedly ushering us into "a very dark place" - for once, Congress did something useful by doing what it's famous for, nothing
  • http://www.theregister.co.uk/2014/10/22/fbi_apple_grapple_congress_kills_cupertino_crypto_kibosh/
• Insurance companies fighting to get data breach coverage removed from general liability policies - isn't this obvious? I think this is one of the last shoes to drop before things move forward, finally
  • http://www.businessinsurance.com/article/20141026/NEWS07/141029850

In this episode

• Chris attempts to explain the consternation with 'security research' right now
• Kevin gives his perspective and why he doesn't quite understand why people don't see they're "breakin' the law"
• Shawn discusses what parts of the CFAA he would like to see reformed
• James drops the question - "What is a security researcher?" ..and rants a little
• Kevin talks about why the security industry needs to self-regulate w/example
• Chris and Kevin debate intent, and "stepping over the line"
• Chris brings up the issue of bug intake at a large company
• Spirited discussion about intent, regulation, actions and separating emotion from facts

Guests

• Chris John Riley - ( @ChrisJohnRiley ) - Chris John Riley is a senior penetration tester and part-time security researcher working in the Austrian financial sector. With over 15 years of experience in various aspects of Information Technology, Chris now focuses full time on Information Security with an eye for the often overlooked edge-case scenario. Chris is one of the founding members of the PTES (Penetration Testing Execution Standard), regular conference attendee, avid blogger/podcaster (blog.c22.cc / eurotrashsecurity.eu), as well as being a frequent contributor to the open-source Metasploit project and generally getting in trouble in some way or another. When not working to break one technology or another, Chris enjoys long walks in the woods, candle light dinners and talking far too much on the Eurotrash Security podcast.
• Shawn Tuma - ( @ShawnETuma ) - Shawn is an attorney with expertise in computer fraud, social media law, data security, intellectual property, privacy, and litigation. He's a Texan, Christian, family man, author & speaker - and an all-around awesome guy.
• Kevin Johnson - ( @SecureIdeas ) - Kevin is the Chief Executive Officer of Secure Ideas. Kevin has a long history in the IT field including system administration, network architecture and application development. He has been involved in building incident response and forensic teams, architecting security solutions for large enterprises and penetration testing everything from government agencies to Fortune 100 companies. In addition, Kevin is an instructor and author for the SANS Institute and a faculty member at IANS. He is also a contributing blogger at TheMobilityHub.

Topics covered

• The FBI paid a visit to the "researcher" who revealed (and tinkered with) the hacked Yahoo! servers - we discuss the various aspects of this case, which we've been going round and round on lately
  • http://www.wired.com/2014/10/shellshockresearcher/
• US Cyber Security Czar Michael Daniel wants us passwords gone, replaced by <drumroll please> .... "selfies"; We wish we were making this one up or the link was to an Onion article, but sometimes the jokes write themselves in a sad, sad way
  • http://www.theregister.co.uk/2014/10/15/forget_passwords_lets_use_selfies_says_obamas_cyber_tsar/
• Pres. Obama has issued an executive order that all government payment cards now must be "chip & pin"; once again underscoring that "just do something" may be worse than actually doing nothing -- we'd love to hear your thoughts?
  • http://www.whitehouse.gov/the-press-office/2014/10/17/executive-order-improving-security-consumer-financial-transactions
• Notable data breaches discussed:
  • K-Mart - http://www.theregister.co.uk/2014/10/12/kmart_cyber_attach/
  • Dairy Queen - http://www.theregister.co.uk/2014/10/10/dairy_queen_restaurants_hacked/
• POODLE, the latest OMG SSL vulnerability; is this really that big a deal that there is a public vulnerability in a protocol that should have become extinct at the turn of the century? (Hint: Sadly, yes)
  • http://www.theregister.co.uk/2014/10/10/dairy_queen_restaurants_hacked/

In this episode

• Ron gives us a brief history of Tenable and TVM for the enterprise
• Ron answers "How do you make network security obtainable and defendable?"
• We discuss TVM as a fundamental principle to many other security program items
• Ron tells us what the modern definition of "policy" is
• We discuss some hurdles and challenges of TVM programs in an enterprise
• We note that security scanning can always break stuff - so how do you get around that?
• Ron tells us why TVM is so much more than scanning
• Michael asks "Why are so many companies stuck in a Prince song (1999)?"
• We attempt to tackle - compliance, risk, and managing to a goal
• Ron answers the question - "Are we getting any better?"

Guest

• 
  Ron Gula ( @RonGula ) - CEO and CTO at Tenable Ron co-founded Tenable Network Security, Inc. in 2002 and serves as its Chief Executive Officer and Chief Technology Officer. Mr. Gula served as the President of Tenable Network Security, Inc. He served as the Chief Technology Officer of Network Security Wizards which was acquired by Enterasys Networks. Mr. Gula served as Vice President of IDS Products and worked with many top financial, government, security service providers and commercial companies to help deploy and monitor large IDS installations. Mr. Gula served as Director of Risk Mitigation for US Internetworking and was responsible for intrusion detection and vulnerability detection for one of the first application service providers. Mr. Gula worked at BBN and GTE Internetworking where he conducted security assessments as a consultant, helped to develop one of the first commercial network honeypots and helped develop security policies for large carrier-class networks. Mr. Gula began his career in information security while working at the National Security Agency conducting penetration tests of government networks and performing advanced vulnerability research. He was the original author of the Dragon IDS. Mr. Gula has a BS from Clarkson University and a MSEE from University of Southern Illinois.

Topics covered

• The petition on WhiteHouse.gov titled "Unlock public access to research on software safety through DMCA and CFAA reform" and ...well we talk about it with an attorney and some necessary skepticism
  • https://petitions.whitehouse.gov/petition/unlock-public-access-research-software-safety-through-dmca-and-cfaa-reform/DHzwhzLD
  • My take: http://blog.wh1t3rabbit.net/2014/10/to-reform-and-institutionalize-research.html
• A Marriott property in Nashville (Gaylord Opryland) will pay $600,000 in an FCC settlement for jamming/blocking guests' personal WiFi hotspots
  • http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-blocking-investigation
• A Pakistani man has been indicted in Virginia for selling "StealthGenie", an app designed specifically as spyware
  • http://www.justice.gov/opa/pr/pakistani-man-indicted-selling-stealthgenie-spyware-app
• The code for the badUSB attack was published and released at DerbyCon - we discuss implications
  • http://www.wired.com/2014/10/code-published-for-unfixable-usb-attack/
• Cedars-Sinai Medical Center loss of data is much worse than they thought, but it's actually worse than that - a teachable moment here-
  • http://www.latimes.com/business/la-fi-cedars-data-breach-20141002-story.html

Thank you to Shawn Tuma - an attorney specializing in CFAA and a good friend of our show - for stopping by and lending his expertise on this episode. If you enjoy Shawn's insights, consider following him on Twitter ( @ShawnETuma ) or just saying hello!

In this episode

• We discuss the CFAA in regards to Robert Graham's brilliantly written blog post on the topic - http://blog.erratasec.com/2014/09/do-shellshock-scans-violate-cfaa.html
• Shawn gives some key insights on the CFAA including historical context
• Michael asks some tough questions on the discretion and applicability of CFAA prosecution
• James goes on a rant about "security researchers" (it's a gem)
• I'm pretty sure Shawn goes on the record saying security researchers should be credentialed..or was that me?
• We get some advise from Shawn on where this topic goes next, and how to avoid being a target of prosection

Guest

• Shawn Tuma - ( @ShawnETuma ) - Shawn is an attorney with expertise in computer fraud, social media law, data security, intellectual property, privacy, and litigation. He's a Texan, Christian, family man, author & speaker - and an all-around awesome guy.