In this episode...

• What about public safety, where do we draw the line on open research?
• Self-regulation? Disclosure? What are our options…
• What makes a researcher? We discuss
• “Chilling security research”
• A quick dive into bug bounty programs; do they help?
• Ethics vs. moral compass …we discuss
• Hacker movies, and what they’re doing for our profession

Guests

• Keren Elezari ( @K3r3n3 ) - brings years of experience in the international cyber security industry to the stage. Since 2000, Keren has worked with leading Israeli security firms, government organizations, Global Big 4 and Fortune 500 companies. Keren holds a CISSP security certification, a BA in History and Philosophy of Science and is currently a senior research fellow with the prestigious Security & Technology workshop at Tel Aviv University. In 2012, Keren held the position of Security Teaching Fellow with Singularity University, a private think tank, founded by Dr. Ray Kurzweil and sponsored by Google & NASA amongst others. Since 2013, Keren covers emerging security technologies and trends as a security industry analyst with GIGAOM research, a leading independent media hub. In 2014, Keren became the first Israeli woman to be invited to speak at the prestigious international annual TED conference. Keren’s TED talk has been viewed by 1.2 million people, translated to more than 20 languages and selected for TED’s list of ‘Most Powerful Ideas in 2014’ and for Inc.com’s list of ‘Top TED Talks of 2014’.
• Kellman Meghu ( @kellman ) - heads up a team of Security Architects for CheckPoint Software Technologies Inc., the worldwide leader in securing the Internet. His background includes almost 20 years of experience deploying application protection and network-based security. Since 1996 Mr. Meghu has been involved with consultation on various network security strategies to protect ISP's in Southern Ontario as well as security audits and security infrastructure deployments for various Commercial and Governmental entities across Canada and the Central United States. Kellman has delivered security talks in private corporate focused events, at school internet safety classes for students and teachers, as well as public events such as, SecureWorld Seattle, The Check Point Experience, Bsides St. Johns, Bsides San Francisco, Bsides Iowa, Bsides Detroit, Secure360, Trilateral Conference, and Sector lunch keynote for 2014. Kellman has contributed to live TV interviews in the Toronto area with CP24, CityNews, and CHCH TV, as well as radio station interviews and news articles across Canada and the US.
• Mark Nunnikhoven ( @marknca ) - focuses on helping organizations as they move from the data centre to hybrid environments to working fully in the cloud. Bringing over 15 years of practical experience to the table, he is regularly sought after to speak on cloud computing, usable security systems, and modernizing security practices.

In this episode...

• Jon Callas gives a little of his background and his current role
• We talk through why cryptography is so hard, and so broken today
• Jon overviews compatibility, audit and making cryptography useful
• Jon brings up open source, security, and why "open is more secure" is bunk
• We talk through "barn builders" vs. "barn kickers" and why security isn't improving
• We talk through how to do privacy, active vs. passive surveillance
• We talk through anonymous VPN providers, anonymization services, and how they're legally bound
• Jon talks about appropriate threat modeling and knowing what we're protecting
• We talk through patching -- how to do patching for Joe Average User
• Bonus-- Mobile is as secure (or more) than what we're used to on the desktop

Guest

• Jon Callas ( @JonCallas ) - Jon Callas is an American computer security expert, software engineer, user experience designer, and technologist who is the co-founder and CTO of the global encrypted communications service Silent Circle. He has held major positions at Digital Equipment Corporation, Apple, PGP, and Entrust, and is considered “one of the most respected and well-known names in the mobile security industry.” Callas is credited with creating several Internet Engineering Task Force (IETF) standards, including OpenPGP, DKIM, and ZRTP, which he wrote. Prior to his work at Entrust, he was Chief Technical Officer and co-founder of PGP Corporation and the former Chief Technical Officer of Entrust.
  

Fans - If you haven't booked your ticket for InfoSec World 2015 in sunny Orlando, FL check this out. Register using our code CLD15/RABBIT for 15% off.

If you want a chance to go for FREE, listen to Episode 127 for your chance!

In this episode...

• John gives us a little lesson on markets, and why they move up/down, commentary for the information security professional
• John discusses what #BTFD means
• John uses the Target example of why security professionals, marketers, and much of the media got it completely wrong
• John educates us on insurance, compliance and liability
• My head explodes...

Guest

• John Foster ( @dearestleader ) - Mr. Foster has 19 years of technology experience but left technical infosec in 2003 to pursue a career in Compliance and Ethics. He now focuses on bribery & corruption, environmental issues, and other interesting topics, but infosec keeps appearing in compliance and finance. He is an investor with experience in stock, foreign exchange, options, and futures which allows him to see past the data breach hype. He is a Certified Treasury Professional, Six Sigma Black Belt, and holds certificates in ISO 9001, 14001, 20000, 22301, 27001, & 28000 from PECB. He is a partner at Bianco Foster Group, LLC which provides training and education services in ISO standards and an investor in several early stage startups.

Links

• Short portfolio http://dearestleader.me/2015/01/portfolio-update/
• S&P no material impact http://dearestleader.me/2015/01/standard-poors-says-breaches-have-no-material-impact/
• Home Depot earnings call analysis http://dearestleader.me/2014/12/home-depot-earnings-indicate-there-is-no-fear/
• Target sales up 40% over last year http://dearestleader.me/2014/11/target-continues-to-conquer-all/
• Initial Target analysis http://dearestleader.me/2014/03/target-data-breach-not-a-disaster/

In this episode

• Adam and Dmitri discuss what is (and what isn't) threat intelligence
• We discuss strategic, tactical and operational security intelligence
• Who is using threat intelligence, and how?
• Adam talks about the success factors, key points, and trends
• Michael asks how an organization can know whether they're READY for a threat intelligence program
• Adam explains the term "finished intelligence"
• Adam describes tactical intelligence, while Dmitri gives his take on strategic intelligence
• We discuss the merits of education and awareness - first
• How important is attribution, really?
• 3 critical things an enterprise *must be doing* before jumping into threat intelligence as a program

Guests

• Adam Meyers ( @adamcyber ) - Adam Meyers has over a decade of experience within the information security industry. He has authored numerous papers that have appeared at peer reviewed industry venues and has received awards for his dedication to the field. At CrowdStrike, Adam serves as the VP of Intelligence. Within this role it is Adam’s responsibility to oversee all of CrowdStrike’s intelligence gathering and cyber-adversarial monitoring activities. Adam’s Global Intelligence Team supports both the Product and Services divisions at CrowdStrike and Adam manages these endeavors and expectations. Prior to joining CrowdStrike, Adam was the Director of Cyber Security Intelligence with the National Products and Offerings Division of SRA International. He served as a senior subject matter expert for cyber threat and cyber security matters for a variety of SRA projects. He also provided both technical expertise at the tactical level and strategic guidance on overall security program objectives. During his tenure at SRA International, Adam also served as the Product Manager for SRA’s dynamic malware analysis platform Cyberlock.
• Dmitri Alperovitch ( @dmitricyber ) - Dmitri Alperovitch is the Co-Founder and CTO of CrowdStrike Inc., leading its Intelligence, Technology and CrowdStrike Labs teams.  A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft.  Prior to founding CrowdStrike, Dmitri was a Vice President of Threat Research at McAfee, where he led company’s global Internet threat intelligence analysis and investigations. In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions, and gave those incidents their names. In 2013, Alperovitch received the prestigious recognition of being selected as MIT Technology Review’s “Young Innovators under 35” (TR35), an award previously won by such technology luminaries as Larry Page and Sergey Brin, Mark Zuckerberg and Jonathan Ive. Alperovitch was named Foreign Policy Magazine’s Leading Global Thinker for 2013, an award shared with Secretary of State John Kerry, Elon Musk and Jeff Bezos. He was the recipient of the prestigious Federal 100 Award for his contributions to the federal information security in 2011 and recognized in 2013 as one Washingtonian’s Tech Titans for his accomplishments in the field of cybersecurity. With more than a decade of experience in the field of information security, Alperovitch is an inventor of eighteen patented technologies and has conducted extensive research on reputation systems, spam detection, web security, public-key and identity-based cryptography, malware and intrusion detection and prevention. Alperovitch holds a master's degree in Information Security and a bachelor's degree in Computer Science, both from Georgia Institute of Technology.

In this episode

• Chris attempts to explain the consternation with 'security research' right now
• Kevin gives his perspective and why he doesn't quite understand why people don't see they're "breakin' the law"
• Shawn discusses what parts of the CFAA he would like to see reformed
• James drops the question - "What is a security researcher?" ..and rants a little
• Kevin talks about why the security industry needs to self-regulate w/example
• Chris and Kevin debate intent, and "stepping over the line"
• Chris brings up the issue of bug intake at a large company
• Spirited discussion about intent, regulation, actions and separating emotion from facts

Guests

• Chris John Riley - ( @ChrisJohnRiley ) - Chris John Riley is a senior penetration tester and part-time security researcher working in the Austrian financial sector. With over 15 years of experience in various aspects of Information Technology, Chris now focuses full time on Information Security with an eye for the often overlooked edge-case scenario. Chris is one of the founding members of the PTES (Penetration Testing Execution Standard), regular conference attendee, avid blogger/podcaster (blog.c22.cc / eurotrashsecurity.eu), as well as being a frequent contributor to the open-source Metasploit project and generally getting in trouble in some way or another. When not working to break one technology or another, Chris enjoys long walks in the woods, candle light dinners and talking far too much on the Eurotrash Security podcast.
• Shawn Tuma - ( @ShawnETuma ) - Shawn is an attorney with expertise in computer fraud, social media law, data security, intellectual property, privacy, and litigation. He's a Texan, Christian, family man, author & speaker - and an all-around awesome guy.
• Kevin Johnson - ( @SecureIdeas ) - Kevin is the Chief Executive Officer of Secure Ideas. Kevin has a long history in the IT field including system administration, network architecture and application development. He has been involved in building incident response and forensic teams, architecting security solutions for large enterprises and penetration testing everything from government agencies to Fortune 100 companies. In addition, Kevin is an instructor and author for the SANS Institute and a faculty member at IANS. He is also a contributing blogger at TheMobilityHub.

In this episode

• We discuss some of the new techniques auto insurance companies are using to custom-tailor rates to drivers
• Our guest discusses some of the capabilities of the widgets available
• Our guest discusses the 'call home' functions, and potential mis-use
• We use 'big data' seriously
• We talk about 'big data' and security - for real
• Our guest gives us a realistic view about the type of data that's out there about your driving, habits, and tracking

Guest

• Our guest is an industry insider, who for obvious reasons chose not to identify himself. We respect the guest's position, and kindly ask that our listeners do as well.

In this episode

• David discusses what it's like working for a law firm (in the UK)
• A quick wade through the UK Data Protection Act (mostly Principle 7)
• "When lawyers get to interpret the laws"
• Law firms as targets for data breaches
• The new regulations in the UK, fines between 2%-5% of your REVENUE? Ouch.
• Defining "adequate measures" in regulations
• A brief chat on fines, regulations, and risk management
• I trail off on a Princess Bride quote, and get ranty on "risk"
• Dealing with personal devices, public WiFi to work and security
• James asks the inevitable question on training
• Good vs. "best" practice
• Your security as a competitive advantage. really.

Guest

• David Prince ( @riskobscurity ) - A dedicated and well-respected Technical Information Security Professional with several years’ experience and demonstrated success leading information security initiatives, in a variety of organizations. Initiatives which are in direct support of business-objectives to maintain the confidentiality, integrity, and availability of organizational assets and improve business efficiency, and effectiveness.

In this episode

• Will gives us a lay of the land on the state of "state sponsored" and advanced threats
• We discuss collective advances in malware
• We discuss the persistence of 'old' malware, and code re-use
• We discuss enterprise defense and strategy
• Will gives us some wisdom from his experiencein helping clients defend themselves

Guest

• Will Gragido ( @wgragido ) - Will is currently a senior manager in the Threat Research Intelligence organization at RSA NetWitness. Will is an information security and risk management professional with over 18 year’s professional industry experience, Mr.Gragido brings a wealth of knowledge and experience to bear. Working in a variety of roles, Mr.Gragido has deep expertise and knowledge in operations, analysis, management, professional services & consultancy, pre-sales / architecture and business development within the information security industry. You cn get more information on Will on his LinkedIn page.

Folks, if you work with, design, or implement embedded systems this is one episode you don't want to miss. Fair warning, it's a little bit long at just over 50 minutes total. I hope you find the extra time worth the effort of listening, I know we sure did!

In this episode

• The quirky things that Josh's organization gets to work on and deconstruct
• The methodology of breaking foreign things
• Android and why it's "horribly interesting" beyond just the OS everyone sees
• Hacking Android at the very, very, very basic hardware interface(s)
• Copy/Paste software development and it's pitfalls
• Embedded devices as pivot points for intrusion
• The importance of embedded systems, and why no one is writing secure code (still)

Guest

• Josh Thomas ( @m0nk_dot ) - Chief Breaking Officer for Atredis, Security researcher, mobile phone geek, mesh networking evangelist and general breaker of things electronic. Typical projects of interest span the hardware / software barrier and rarely have a UI. m0nk has spent the last year or two digging deep into Android and iOS internals, with a major focus on both the network stack implementation and the driver and below hardware interfaces. He uses IDA more frequently than Eclipse (and a soldering iron more that both). His life dreams are to ride a robot unicorn on a moonlit beach and make the world a better place, but mostly the unicorn thing...

Special thanks to Steve Ragan ( @SteveD3 ) for sitting in this morning and providing his perspective as a journalist.

Topics Covered

• "Leaked" FBI memo to government agencies says "there's a hacking spree on government websites, and it's Anonymous!" (we have to chuckle, a little) - http://www.theregister.co.uk/2013/11/18/anon_us_gov_hack_warning/ , http://www.thewire.com/national/2013/11/fbi-anonymous-hackers-stole-over-100000-employees-information/71675/
• Fokirtor is a very interesting new piece of malware that targetted Linux systems, but by slipping into SSH comms - http://www.theregister.co.uk/2013/11/15/stealthy_linux_backdoor/ ( and a related piece of malware - http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices )
• The Healthcare.gov website is a case study in how not to release a web app, or complex system; and it's not even a partisan issue anymore - http://arstechnica.com/security/2013/11/healthcare-gov-targeted-by-more-than-a-dozen-hacking-attempts/
• Ahead of the G20 meeting to be held there in 2014, the city of Brisbane, Australia performs a penetration test on their physical city infrastructure, finds major flaws. A plot from "The Italian Job"? - http://www.qao.qld.gov.au/files/file/Reports%20and%20publications/Reports%20to%20Parliament%202013-14/RTP5Trafficmanagementsystems.pdf
• [Scary] Renesys says someone is hijacking the Internet ... but is it on purpose, or just mistakes? (Does it matter?) - http://www.nbcnews.com/technology/wheres-your-data-going-hacks-redirect-traffic-through-distant-lands-2D11624570
• A new piece of software quietly turns you into a bitcoin mine for the developer (and you agree to it in the EULA!) - http://www.networkworld.com/news/2013/120213-sneaky-software-turns-your-pc-276490.html?source=nww_rss

In this episode

• We get a peek into the first member of English Royalty that we've ever had on the podcast
• Baroness Neville-Jones discusses the difficulties in cybersecurity at the government level
• We discuss the challenges of policy, compliance and implementing real-life security
• The Baroness discusses her efforts to raise both the awareness and collective security of business
• The Baroness discusses a bit about critical infrastructure protection
• I ask the uncomfortable question in the wake of the Snowden disclosures - privacy vs. security...

Guest

• Rt Hon Baroness Neville-Jones - Baroness Neville-Jones is a long-time political figure in the UK Parliament, House of Lords. She recently retired from public service and now focuses on the public-private partnership for cybersecurity in the UK. She has an amazing history and rather than try to summarize it here, I simply point you to her biography page at http://www.conservatives.com/People/Peers/Neville-Jones_Pauline.aspx

In this episode...

• James and I host legitimate Polynesian royalty (a princess....) really!
• Katie gives us the skinny on Microsoft's 10 year progression to get to a bug bounty program
• We discuss the merits of bug bounties and execution in a very large enterprise
• Katie gives us as many details as she can about the recent $100,000 payout
• Much... much ... more!

Guest

• Katie Moussouris ( @k8em0 ) - Katie runs the Security Community Outreach and Strategy team for Microsoft as part of the Microsoft Security Response Center (MSRC) team to help drive crucial elements of our security community strategy effort. She is a Senior Security Strategist Lead, and let's not sell her short - she is royalty!
  She created and drove the first ever Microsoft security bounty programs (www.microsoft.com/bountyprograms). Which received 18 vulnerabilities and a new attack technique that will help Microsoft build stronger defenses that will protect the entire platform from this new class of attack.
  She serves as lead subject matter expert in the US National Body for the ISO work item 29147 "Vulnerability Disclosure", scheduled for publication in 2013, and does countless other efforts associated with the ISO standards body and various other industry groups.
   

Big thanks to the soon-to-be-regular peanut gallery ... @JoeKnape and @BeauWoods for jumping in this morning and breaking it down with James and I.

As a personal message to those of you who listen and our community - please ...remember we all live in a giant glass house, and throwing rocks is a bad, bad idea. I've said it before and I'm looking right at the media for this one (ahem...) - unless you've been in a high-stress environment and have successfully thwarted every attack, please don't go trying to personally attack those out there who work hard at it every day. It just makes you look like an idiot. Nobody wins when we name and shame and attack people personally. Remember that when it's your turn to stand in the spotlight.

Topics Covered

• Adobe got popped. Bad. ~2.9 users' information, encrypted credit card details, source code. The only thing worse than this story is the kind of media trolls it brought out... - http://www.computerworld.com/s/article/9242963/Hackers_steal_data_on_2.9_million_Adobe_customers?taxonomyId=82&pageNumber=2 and this unfortunate mess from Richi Jennings https://plus.google.com/117220625678034723010/posts/EjP4JjKFd6w
• 13 Anonymous 'members' indicted for DDoS attacks - http://www.computerworld.com/s/article/9242969/US_indicts_13_Anonymous_members_for_DDoS_attacks
• LA schools gave out "locked down" iPads. Students circumvented. Hilarity ensued. http://blogs.computerworld.com/mobile-security/22929/what-la-schools-forgot-boneheaded-ipad-hand-out
• Senior Iranian Cyber official killed (assasinated?) - http://www.matthewaid.com/post/63207233044/the-mystery-surrounding-the-killing-of-a-senior-iranian
• Proof that the fist people to get paid should be the ones who hold the keys to your doors - http://nycfreshmarket.com/ (as long as the page stands, then check out the tweet I re-posted https://twitter.com/Wh1t3Rabbit/status/387076594407575552 )

So ... does anyone actually read these? If so, let me know on Twitter? Hashtag #DtR

In this episode...

• Dave Kennedy wraps up DerbyCon 2013, and gives us the statistic you don't want to tell your management
• Dave announces the top secret guest for DerbyCon 4
• Chris & Gabe discuss risk modeling using REAL automated tools
• Gabe introduces us to his concept of using a 'big data' approach to risk modeling
• We discuss risks, network segmentation, and other things you're doing wrong

Guests

• Dave Kennedy ( @Dave_Rel1k ) - Dave Kennedy is the founder of TrustedSec, and the brain behind DerbyCon.
• Chris G ( @SecbitChris ) - Chris is one of the brains behind the SecuraBit podcast
• Gabe B ( @gdbassett ) - Gabe is an industry expert

I want to thank Mr. Josh Corman ( @JoshCorman ) for guest-commentating today's episode, and lending his expertise and industry leadership point of view.

Topics Covered

• UK's GCHQ has been using Prism (Courtesy of the NSA) to spy on you ... the revelation continues - http://www.telegraph.co.uk/news/uknews/law-and-order/10106507/GCHQ-has-been-accessing-intelligence-through-internet-firms.html
• Wisconsin trucker vs. Koch Industries, just what is a "direct loss"? - http://www.kfdi.com/news/local/Wisconsin-man-pleads-guilty-in-cyber-attack-on-Koch-Industries-223365221.html
• iPhone, fingerprint reader, #IsTouchIDHacked - http://www.forbes.com/sites/markrogowsky/2013/09/22/iphone-fingerprint-scanner-hacked-should-you-care/
• Can the FTC (and other government entities) go after companeis who fail to do reasonable security? (also, what does that mean?) - http://www.computerworld.com/s/article/9242531/FTC_lacks_data_breach_authority_says_accused_medical_lab?taxonomyId=17&pageNumber=2
• The gang that popped Bit9 is at it again, IE 0-day in the wild - http://www.computerworld.com/s/article/9242570/Security_org_raises_Internet_threat_level_after_seeing_expanded_IE_attacks

More information on The Cavalry

The talk: "The Cavalry Isn't Coming: Starting the Revolution to FSCK it all!"

The video of the more mellow, smaller BSides "warm-up before DEF CON 21" is here: http://www.irongeek.com/i.php?page=videos/bsideslasvegas2013/1-2-2-the-cavalry-isnt-coming-starting-the-revolution-to-fsck-it-all-nicholas-j-percoco-and-joshua-corman

Twitter: @iamthecavalry

URL: http://iamthecavalry.org

email info@iamthecavalry.org

google group: https://groups.google.com/d/forum/iamthecavalry

Josh Corman's Bio:

Joshua Corman is the Director of Security Intelligence for Akamai.  Mr. Corman’s cross-domain research highlights adversaries, game theory and motivational structures. His analysis cuts across sectors to the core security challenges and toward emerging technologies and shifting incentives. 

A staunch advocate for CISOs, Corman also serves as a Fellow with the Ponemon Institute, on the Faculty for IANS, co-founder of Rugged Software and was a 2009 Top Influencer of IT in NetworkWorld. Corman received his bachelor’s degree in philosophy, graduating summa cum laude, from the University of New Hampshire.