In this episode

• Jim Tiller - a few things you probably didn't know?
• In the last 15 years, what has changed, and what hasn't?
• Why isn't security moving forward?
• "Complexity is the camouflage for bad guys" -Jim
• Chasing the moving line of 'security'
• "Fixing the airplane as it flies"
• How do enterprise security organizations push away from playing 'prevent' permanently?
• Fundamentals, fundamentals, fundamentals ... you're still failing
• What things are CISOs doing that they're NOT right now?
• Where will security be, as a discipline, in 10 year?

Guest

• Jim Tiller ( @Real_Security ) - Jim has been in the security industry since the very early 90’s and has continued his mission in working with individuals, groups, organizations, and companies around the world to collaborate, develop, and implement business aligned security strategies and technologies. Through his career he's worked with and in numerous organizations for the advancement of information security technologies, practices, and standards and through these activities help organizations achieve their goals. Find Jim on LinkedIn here.

In this episode

• Who is Dan Geer (just in case you live in a cave and don't know)
• Dan's definition of security - "The absence of unmitigatable surprise"
• What exactly is the pinnacle goal of security engineering?
• Responsibility, liability and when software fails as a result of security issues
• In a liability lawsuit - "What did you know, when did you know it?"
• The fraction of the population who could sign an "informed consent" is falling - so now what?
• Why ICANN is actually making all of this so much worse
• What do we do about "abandoned software"?
• Fixing security bugs in software is a tricky business...good, bad, worse
• Are things getting better [in security]?
• Dan talks about a "diversity re-compiler" and how we can make the exploit writer's job harder
• (from Jason White) -What "low hanging fruit" issues are we simply not addressing properly right now?
• (from Jason White) If the Internet were being built from scratch today, what would you keep and throw away?

Guest

• Dan Geer - Dan Geer is a computer security analyst and risk management specialist. He is recognized for raising awareness of critical computer and network security issues before the risks were widely understood, and for ground-breaking work on the economics of security.
  
  Geer is currently the chief information security officer for In-Q-Tel, a not-for-profit venture capital firm that invests in technology to support the Central Intelligence Agency.
  
  In 2003, Geer's 24-page report entitled "CyberInsecurity: The Cost of Monopoly" was released by the Computer and Communications Industry Association (CCIA). The paper argued that Microsoft's dominance of desktop computer operating systems is a threat to national security. Geer was fired (from consultancy @Stake) the day the report was made public. Geer has cited subsequent changes in the Vista operating system (notably a location-randomization feature) as evidence that Microsoft "accepted the paper." --http://en.wikipedia.org/wiki/Dan_Geer

In this episode

• What exactly is "GRR"?
• What sorts of things can GRR do?
• What is a hunt, and how does it scale across tens of thousands of machines?
• How does GRR "hide" from malware?
• How does GRR keep some of the great power it has from being abused?
• Automating and integrating GRR with external sources and tools
• Features, functions, capabilities and some magic from Greg
• The future features, requests, and direction of GRR

Guest

• Greg Castle - Greg has 10 years experience working in computer security. In his current role as Senior Security Engineer at Google, he is a developer and user of the open-source GRR live-forensics system. He also has strong interest and involvement in OS X security, having been responsible for the security of Google's OS X fleet for two years. His pre-Google job roles have included pentester, incident responder, and forensic analyst.

Links

• Grr Rapid Response - https://code.google.com/p/grr/

My apologies for some of the skips in this episode - we had some difficulty with the recording and ultimately I hope it doesn't take away from Joe's wonderful message.

Thanks for your patience.

In this episode

• From CISO to CIO - making that leap
• Does the CISO need to be technical? (answering that question, again)
• What types of things does a CIO need to know?
• Who should the CISO report to?
• Any chance the CISO reporting structure shifts around?
• A "Chief Data Officer"?
• Are there too many 'splintered' job titles in the security/risk role?
• Responsibility, accountability, and where the buck stops
• What are 3 things security does right, and what are 3 things that we do terribly?
• How big should your security budget be? (trick question)
• What KPIs should security be reporting to the CIO? (the hardest question ever)
• What resources are there for CIOs?

Guest

• Joe Riesberg ( @JoeRiesberg ) - Joe is currently the CIO of Drake University. Previos to his current role, he was the Senior Vice President, Global IT Security Services Director at Aviva plc. His LinkedIn profile can be found here: https://www.linkedin.com/pub/joe-riesberg/1/a81/931

In this episode

• Jeff explains the background of the relationship between the US government, ICANN and IANA
• What is the ITU and why is this $0 contract handoff to the ITU such a big deal?
• What impact did Edward Snowden's actions have on the issue?
• The potential issues with DNS, cross-border censorship and DNS
• The importance of Tor, Freenet and challenges of implementation
• Discussing the evolution of services like Tor through "nation-state firewalls"
• Changing the image of anonymous services
• Making Tor and similar services more user-friendly, and more prevalent

Guest:

• Jeff Moss ( @TheDarkTangent ) - Jeff, also known as The Dark Tangent, is an American hacker, computer security expert and internet security expert who founded the Black Hat and DEF CON computer Hacker conferences. His Wikipedia page can be found here.

In this episode

• Dan gives us the reality of living in what is commonly termed "the post-breach" world
• Dan and Robin talk through the explosion in the numbers of malware samples
• We discuss the different approaches to malware, crimeware, and the cross-over between them
• Dan explains what "rapid incident response" really means and why it's essential
• Dan and Robin give us some excellent examples of incident preparedness fundamentals
• Dan gives us a lesson on implementing 'powerful tools' (and forgetting about them)
• We talk through "who's doing it well?" (and we don't get a very hopeful answer)
• Is it time to learn from our own and others mistakes? (how?)

Guests:

• Robin Jackson ( @rjacksix ) - Robin is an incident response and digital forensics specialist for HP Enterprise Security Services.
• Dan Moore - Dan is an incident response and digital forensics specialist for HP Enterprise Security Services.

In this episode

• Rise of DDoS
  • Where did it come from
  • What's next
  • Why does it work
  • Spoofer project
  • 3-DOS attacks
• Quantum computing
  • What is it
  • How is it different than what we commonly use today
  • What problems does it solve
  • How practical is it
• The dark web
  • Where did it come from
  • Legitimate uses, turn into nefarious use-cases
  • Alternatives, adoption and options

Guest

• Prof. Alan Woodward ( @ProfWoodward ) - Alan is not only a subject matter expert in computing, computer security and the impact technology has on business but brings to his roles a very broad range of experience in business management, technical management and project management.
  Whilst he has particular expertise in covert communications, forensic computing and image/signal processing, Alan is primarily a particularly good communicator, be it with clients, staff or investors. He is known for his ability to communicate complex ideas in a simple, yet passionate manner. He not only publishes in the academic and trade journals but has articles in the national press and appears on TV and radio. Despite the length of his experience, his hands-on ability with emerging technologies contributes significantly to the respect he is repeatedly shown when he leads teams where technology is involved.
  Alan has been involved in some of the most significant advances in computer technology and, although he continues to work in industry, he is actively involved with academia as a visiting Professor in the Department of Computing which is part of the Faculty of Engineering and Physical Sciences at the University of Surrey.
  His achievements have resulted in him rising to become a Fellow of various institutions including British Computer Society, Institute of Physics and Royal Statistical Society.

Did you catch all that? DtR is giving away a free ticket to Source Boston - if you're interested in being the lucky recipient - be the first to @Wh1t3Rabbit with "I just won a ticket to @SOURCEConf Boston courtesy of the #DtR Podcast!"

In this episode

• what is the promise of automation, and where did we go wrong (or right?)
• the problems with 'volume' (of logging) and the loss of expressiveness
• a dive into 'exploratory based monitoring'
• how does log-based data analysis scale?
• baselines, and why 'anomaly detection' has failed us
• does machine learning solve the 'hands on keyboard' (continuous tuning) problem with SIEM?
• does today's 'threat intelligence' provide value, and is it really useful?
• decrying the tools - and blaming the victims
• what is machine learning good at, and what won't it be great at?
• log everything!

Guest

• Alex Pinto ( @alexcpsec ) - Alex has almost 15 years dedicated to Information Security solutions architecture, strategic advisory and security monitoring. He has been a speaker at major conferences such as BlackHat USA, DefCon, BSides Las Vegas and BayThreat.
  He has been researching and exploring the applications of machine learning and predictive analytics into information security data sources, such as logs and threat intelligence feeds.
  He launched MLSec Project (https://www.mlsecproject.org) in 2013 to develop and provide practical implementations of machine learning algorithms to support the information security monitoring practice. The goal is to use algoritmic automation to fight the challenges that we currently face in trying to make sense of day-to-day usage of SIEM solutions.

In this episode

• Does is make sense, in a mathematical and practical senes, to look for 'probability of exploit'?
• How does 'game theory' apply here?
• How do intelligent adversaries figure into these mathematical models?
• Is probabilistic risk analysis compatible with a game theory approach?
• Discussing how adaptive adversaries figure into our mathematical models of predictability...
• How do we use any of this to figure out path priorities in the enterprise space?
• An interesting analogy to the credit scoring systems we all use today
• An interesting discussion of 'unknowns' and 'black swans'
• Fantastic *practical* advice for getting this data-science-backed analysis to work for YOUR organization

Guests

• Lisa Leet - Lisa is a wife of 17 years, a mother of 5 years to boy/girl twins, and an employee of 7 years on the Information Security team at a Minneapolis-based financial services firm. She is also an intern at Stamford Risk Analytics (Stamford, CT), pursuing studies at Stanford University, prepping for her CISSP Exam on July 15th, taking MOOCs, and reading at least twelve books concurrently including a 1600-pager on Python. In her free time she volunteers on the Board of Directors for SIRA (Society of Information Risk Analysts) and participates in awesome podcasts like DtR.
• Russell Thomas ( @MrMeritology ) - Russell is a Security Data Scientist in financial services, and a PhD student in Computational Social Sciences.  His focus is on the intersection of information security and business and economic decision making.  He’s “MrMeritology” on Twitter, and blogs at “Exploring Possibility Space” (http://exploringpossibilityspace.blogspot.com/).
• Bob Blakley - Bob has been in the security industry for more than 35 years.  He's led the OMG CORBAsecurity, SAML, and OATH standardization efforts, and currently chairs the NSTIC Identity Ecosystem Steering Group.  He's in the drama department at a large multinational financial institution.

I can't believe it's 2014 already, and we're rolling through our 3rd calendar year! As we grow and you "regulars" mount, James and I want to thank you for listening, bookmarking, sharing and talking about the podcast. Your patronage has really made a us smile, and you're the reason we do this.

Topics covered

• Reuters: Retail community may be ready for a change in the payment card system and processes - http://uk.reuters.com/article/2014/01/13/uk-target-databreach-retailers-idUKBREA0B01A20140113
• More Snowden fallout: French/UAE Intel satellite deal may be scuttled because of US-made components - http://www.defensenews.com/article/20140105/DEFREG04/301050006
• Ransomware CryptoLocker's uglier, meaner cousin now available for $100... look out! - http://arstechnica.com/security/2014/01/researchers-warn-of-new-meaner-ransomware-with-unbreakable-crypto/
• Schneier: "The Internet of Things" is very vulnerable ...and there's no good way to patch it all - http://www.wired.com/opinion/2014/01/theres-no-good-way-to-patch-the-internet-of-things-and-thats-a-huge-problem/
• Lawsuit filed in the "FaceBook reads my private messages" case - http://money.cnn.com/2014/01/03/technology/facebook-privacy-lawsuit/

In this episode

• Chris Wysopal - who is that masked man?
• Putting some reality to the state-sponsored backdoors (Huawei) and supply-chain compromise
• The risks coming through the door with the products you buy
• The case for setting up an independent testing lab for mitigating 'backdoor' accusations
• Chris does an interesting assessment on software security practices in the enterprise
• Chris discusses holding your vendor to the same standards you hold yourself
• What does it mean that enterprises are doing a "good job" in SwSec
• Chris goes there, open-source components as part of supply chain risk
• James asks "How do smaller buyers leverage scale to hold their suppliers accountable?"
• Why do we still see SQL Injection?! Are we ever going to get rid of it?

Guest

• Chris Wysopal ( @Weldpond ) - Chris is the Founder, CTO and CISO of VeraCode, a company dedicated to software security as-a-service. Chris has a long and storied history in the security industry dating back to L0pht Heavy Industries. His bio and profile can be found on LinkedIn.

Hello! This is a special episode in that it's our year-end wrap-up. We bring together 3 of the industry's best to talk about the year that was, the things that made were on your mind, and maybe give us a hint at what is to come...

Guests

• Will Gragido ( @wgragido ) - Will is the Sr. Manager of threat Research Intelligence for RSA NetWitness and a lightweight with the cold medicine.
• John Pirc ( @jopirc ) - John is the Vice President of Research at NSS Labs, with very strong hair.
• David Marcus ( @DaveMarcus ) - David is the Director and Chief Architect of the Federal Advanced Program Group at McAfee and a kettle bell monster!

Notably absent, but invited, were Dave Lewis ("fell asleep") and Dave Kennedy ("was on an airplane") ...apparently because I thought it would be fun to invite every Dave I know....... but seriously next time guys :)

James and I would like to wish all our listeners a very merry holiday season, and a happy, healthy and prosperous 2014.

I want to thank Carolyn Kopprasch and the @BufferApp team for getting back to me, and agreeing to not only join the podcast, but also field questions from "anyone" ...what a cool group of people!

In this episode

• Carolyn gives us some of the insider's perspective on what really happened, when Buffer got hacked
• Carolyn and I discuss triage methodology, and how Buffer's small team responded
• In-depth conversation on the communications strategy and implemented plan to be totally transparent
• We discuss that point where it's time to "shut it down" and the need to have the ability and information to make the decision Buffer's team did when they shut down the service temporarily
• Carolyn talks about some of the non-typical ways that her team detects potential security issues
• Caroly dispenses some solid advice for anyone in a small shop that may be operating ultra-lean
• Finally, Carolyn and I talk about software security and what role it (or the lack thereof) played in the Buffer incident

Guest

• Carolyn Kopprasch ( @CaroKopp ) - Carolyn is currently Buffer's "Chief Happiness Officer". Her role is to make sure that Buffer's customers are, in fact, happy. Also she has a web presence right here: http://CaroKopp.com

Links!

• Buffer's communications page: http://open.bufferapp.com/buffer-has-been-hacked-here-is-whats-going-on/

I'm back! Maybe a little sleep-deprived and a tad grumpier than usual, but back to talk news!

Topics Covered

• Microsoft unveils the new Digital Crime Unit, and it is quite the statement - http://www.darkreading.com/attacks-breaches/microsoft-unveils-state-of-the-art-cyber/240163924 http://www.microsoft.com/en-us/news/presskits/dcu/
• CME Group hacked, claims platform and trades unaffected ...let's hope so - http://www.businessweek.com/news/2013-11-15/cme-group-says-its-computers-were-hacked-no-trades-affected
• Jeremy Hammond, Chicago's very own romanticized criminal - http://www.nbcnews.com/technology/hacker-tied-anonymous-gets-10-years-prison-cyberattacks-2D11603760
• The FBI says there's a "hacking spree" on government webites by Anonymous hackers. You don't say ... - http://arstechnica.com/security/2013/11/fbi-warns-hacking-spree-on-government-agencies-is-a-widespread-problem/
• There's an apparent zero-day in vBulletin, and it's serious enough that Def-Con's forums were taken down pro-actively ... - http://www.computerworld.com/s/article/9244109/Hackers_use_zero_day_vulnerability_to_breach_vBulletin_support_forum
• If you use SnapChat to send questionable selfies hoping they'll just evaporate...you're in for a bad time - http://www.sidhtech.com/news/snapchat-android-hack-iphone/10024107/

In this episode...

• We revisit some of the topics Eric & I talked about nearly 2 years ago at ISSA International, Baltimore.
• Eric discusses the paradigm shift that needs to happen in security
• We talk about shifting resources (in the defensive) from "everything" to something more reasonable
• Eric and I discuss how CISOs must re-allocate resources to survive in a post-breach reality

Guest

• Eric Cowperthwaite ( @e_cowperthwaite ) - Vice President, Advanced Security and Strategy at CORE Security, a Boston-based security vendor. CORE is the leading provider of predictive security intelligence solutions for enterprises and government organizations. We help more than 1,400 customers worldwide preempt critical security threats throughout their IT environments, and communicate the risk the threats pose to the business. Our patented, proven, award-winning enterprise solutions are backed by more than 15 years of applied expertise from CoreLabs, the company's innovative security research center.
  
  Eric was formerly the CSO of Providence Health & Services, a healthcare delivery organization with $12.5 billion in revenue, 32 hospitals and more than 65,000 employees, headquartered in Seattle, WA.