In this episode...

Juniper has a backdoor problem

• 2 separate issues, auth bypass & VPN weakness
• backdoor discovered in Juniper devices
• lots of speculation on who put it there, but it was meant to be disguised as ‘debug code’
• enterprise implications - same as before (what's the bigger picture?)
• https://isc.sans.edu/forums/diary/Infocon+Yellow+Juniper+Backdoor+CVE20157755+and+CVE20157756/20521/

Iranians broke into New York dam in 2013 and “had a look around”

• no direct damage done
• US has largest number of ICS connected to Internet
• critical infrastructure is vulnerable, being probed
• this is not a ‘government problem’ - every company has some ICS on their network
• http://www.theregister.co.uk/2015/12/21/iranian_hackers_target_new_york_dam/

Facebook announced it’s dumping Adobe Flash

• is this a bigger deal than it sounds like
• HTML5 has its own vulnerabilities and issues though… right?
• *only* for videos, games still in Flash
• Facebook will work with Adobe (really?) to improve security of Flash
• http://www.scmagazine.com/facebook-ditches-flash-videos-to-boost-security/article/461040/

191 Million US voter records found ‘unprotected’ by a researcher

• guy from Texas found the data on an unprotected database
• “Vickery told Databreaches.net he was able to poke around the public-internet-facing database because it is poorly configured: no authentication or password is required to query all 300-plus gigabytes stored within.” ← What the hell?
• legailty and ethics … again … but that aside is this REALLY an issue?
• same person who discovered Hello Kitty leak.. interesting.
• http://www.csoonline.com/article/3017171/security/database-leak-exposes-3-3-million-hello-kitty-fans.html
• http://www.theregister.co.uk/2015/12/28/security_researcher_spots_191_millionrecord_us_voter_database_online/

PayPal rolls out the welcome mat for hackers

• even if you have an OTP key fob, attackers can get into your account
• apparently they use static identifier info, cannot be changed
• this should probably trouble you
• http://boingboing.net/2016/01/03/paypal-rolls-out-the-welcome-m.html

PCI Council extends encryption deadline

• good thing, bad thing, or something else?
• http://www.bankinfosecurity.com/interviews/pci-council-extends-encryption-deadline-i-3019

In this episode...

1. Vizio is getting sued, over data their TVs collect?
   • James provided security tips on the local news station and one of those tips was around the privacy details of your gadgets
   • Companies need to be considering what they are doing with their data
   • At what point does data go from an asset to a liability?
   • Do companies understand the difference?
   • http://www.consumerreports.org/lcd-led-oled-tvs/vizio-sued-for-smart-tv-data-sharing
2. Wyndham settles (caves to) the FTC
   • Agrees to legally be bound to do things they should already be doing .. ?
   • 20 years of audits
   • Interesting ending to the long saga, assuming the courts approve
   • https://www.ftc.gov/news-events/press-releases/2015/12/wyndham-settles-ftc-charges-it-unfairly-placed-consumers-payment
3. The US Federal Bureau of Investigation (FBI) admits to using 0day vulnerabilities
   • Why is anyone surprised?
   • Goes to a question of trust, and that's it.
   • Are these being found anyway through programs like bug bounties?
   • http://searchsecurity.techtarget.com/news/4500260464/FBI-admits-to-using-zero-day-exploits-not-disclosing-them
4. Google introduces DLP into Google Apps
   • So far it's just for their Unlimited customers
   • Are we reaching a tipping point where security becomes a feature and not a stand-alone discipline?
   • Definitely a game-changer
   • Basic patterns and detection built-in FREE
   • http://techcrunch.com/2015/12/09/new-google-apps-feature-helps-businesses-keep-sensitive-information-out-of-emails/
5. Black boxes on ships can be hacked
   • Could be worse, someone could be claiming to make the boat float sideways?
   • Is this a big deal, probably; is it a bigger deal than other things wrong?
   • Who is exploiting this, and how do the good guys fix the problem?
   • http://arstechnica.com/information-technology/2015/12/hacked-at-sea-researchers-find-ships-data-recorders-vulnerable-to-attack/

In this episode...

• Is this seriously the FBI suggestion to companies hit with ransomware?
  • http://thehackernews.com/2015/10/fbi-ransomware-malware.html
  • Sets an awful precedent ... or does it?
  • What other options are there?
  • Would you take this advice?
• Microsoft is opening a data center in the UK ...why?
  • http://thehill.com/policy/cybersecurity/259656-microsoft-opens-uk-only-data-center-following-eu-ruling
  • Have the US spying revelations finally hit home?
  • What about EU Safe Harbor?
  • What do you think, if you're a multi-national Internet company?
• Is healthcare really that far behind enterprise security?
  • http://www.cnbc.com/2015/11/11/us-health-care-way-behind-on-data-security-says-forrester.html
  • Forrester calling out the healthcare sector for being far behind on security
  • Is there more pressure, less attention, or more legacy? (or all?)
  • How do you fix this situation?
• Disheartening (but predictable) state of human weakness
  • http://www.scmagazineuk.com/many-uk-workers-willing-to-sell-their-companys-ip-study/article/452428/
  • Are your employees willing to sell your company's intellectual property?
  • What can you do about it?
• YikYak not so anonymous, can reveal user data to cops
  • http://bigstory.ap.org/article/8535dd899f554fb3b5dd1c9498d610b5/yik-yak-social-media-service-can-reveal-user-data-police
  • Is there any anonymous social media, really?

In this episode...

• Turn any old car into a "smart car" for $200 with this new miracle device
  
  • "BACKED BY FROGVENTURES, VOYOMOTIVE IS TACKLING THE BURGEONING CONNECTED-CAR SPACE"
  • Could be a fantastic idea
  • Could be an awful idea
  • Has anyone considered the security ramifications?
  • What about privacy?
  • http://www.fastcodesign.com/3052012/this-device-will-turn-your-clunker-into-a-smart-car-for-200?utm_source#4
• OMB preps cyber sprint follow-up
  • Michael's take on "gap focus": http://www.csoonline.com/article/2992553/security-leadership/stop-focusing-on-gaps-to-gain-influence-as-a-security-leader.html
  • Hoping for 75% authentication for 2FA - not exactly great
  • Lots of challenges here, but is this the right thing to do?
• TalkTalk breached, 3 teenagers arrested, CEO goes tone deaf
  • CEO says they "were not legally required to encrypt client information"
  • Teenagers arrested in breach
  • The poster child for having a breach preparedness plan, before the cameras start rolling and media starts calling
  • https://hacked.com/british-police-arrest-15-year-old-telecom-hack-ransom-demanded-bitcoin/
  • http://www.theregister.co.uk/2015/02/27/talktalk_admits_massive_data_breach/
• Lots of talk on security - but is anyone talking to each other?
  • http://www.eenews.net/stories/1060026736
  • http://cjonline.com/news/2015-10-25/bbb-small-business-cybersecurity-hackers-are-not-just-trick-or-treaters

In this episode...

• Standard & Poor's Adding Cybersecurity to Ratings
  • The headline
    • In a report issued this week, the rating agency says it could issue a downgrade before a cyberattack if a bank looked ill-prepared, or following a breach that causes significant damage to a bank's reputation or which leads to substantial monetary losses or legal damages.
  • Behind the curve? Stop.
    
    • Michael wrote about it this week - stop calling it gaps…
  • 16 questions… good start?
    • How long has it typically taken to detect a cyberattack?
    • What containment procedures are in place if the bank is breached?
    • How many times was the business the target of a high-level attack during the past year, and how far did it reach in the system?
    • What's the internal phishing success rate?
    • What kind of expertise about cyberattacks exists on the board of directors?
    • How much does the bank spend on cybersecurity, what resources does it devote, and what is the total tech budget this year versus last?
  • Including security in the ratings - and we’re crying?
  • Claim this leads to more insurance… how about that…
  • http://www.bankinfosecurity.com/sps-cybersecurity-warning-late-to-game-a-8556
• Crisis Services Top Insurers’ Cyber Claims Payouts; Average Claim at $674K
  • This is interesting; and it’s a good data point, too -- in contrast to the “costs” we hear about in briefings all the time.
  • Saw other stories that suggested the insurance is going to get jacked… of course they are.
  • More insurance, more insight, more claims, more data…. this is all good
  • http://www.insurancejournal.com/news/national/2015/10/05/383785.htm
• New California law requires warrants for online data
  • Same warrant requirements as files in your filing cabinet
  • Doesn’t change Federal law capabilities to not have warrant.
  • Worth remembering: feds can compel your biometric, but not your password
  • Do you encrypt? policies? practices?
  • http://www.cnet.com/uk/news/new-california-law-requires-police-to-get-warrants-for-online-data/
• Obama administration opts not to force firms to decrypt data (for now)
  • for now….
  • opportunity for involvement
  • great chance to connect with your legal and other groups; what is the best way for your organization to handle it
    
  • https://www.washingtonpost.com/world/national-security/obama-administration-opts-not-to-force-firms-to-decrypt-data--for-now/2015/10/08/1d6a6012-6dca-11e5-aa5b-f78a98956699_story.html
• Apple removes several apps from store, they could be spying on you
  • Key issue: root certificates installed
  • http://arstechnica.com/security/2015/10/apple-removes-several-apps-that-could-spy-on-encrypted-traffic/

In this episode...

• Patreon got hacked, but it's OK
  • This is a lesson in how to do security in a reasonable manner
  • Great response, good security
  • https://www.patreon.com/posts/important-notice-3457485
• The double-edged blade of the DMCA could have helped VW cheat emissions
  • Reverse-engineering illegal
  • Definitions of 'researcher' and further 'independent researcher' are interestingly defined - lots of room for discussion
  • http://www.itworld.com/article/2986856/enterprise-software/how-the-dmca-may-have-let-carmakers-cheat-clean-air-standards.html
• CFOs are getting involved in security whether they want to or not
  • Good to-do checklist for CFOs
  • http://ww2.cfo.com/accounting-tax/2015/09/deals-demand-prior-cfo-involvement-data-security/
• Lawsuits preventing disclosure of vulnerabilities in the news
  • We're "chilling security research" again
  • Good points made, on top of bad points and half-truths
  • Stems from the Fireeye vs ERNW fight
  • http://ww2.cfo.com/accounting-tax/2015/09/deals-demand-prior-cfo-involvement-data-security/
• Verizon reports on the state of network transformation
  • security still an issue, and top priority
  • human talent is still a problem
  • lots of leadership opportunities here
  • http://www.enterprisenetworkingplanet.com/netsysm/verizon-reports-on-the-state-of-digital-network-transformation.html

On this episode of the NewsCast

• Intel forms new Automotive Security Research Board (ASRB) to focus on security of their automotive platform
  • http://newsroom.intel.com/community/intel_newsroom/blog/2015/09/13/intel-commits-to-mitigating-automotive-cybersecurity-risks
  • Good security as a competitive advantage?
  • Interesting development in the effort to secure cars as a technology platform
• Appeals court forces the issue of 'fair use' in DMCA case
  • http://www.engadget.com/2015/09/14/appeals-court-copyright-holders-must-consider-fair-use-before/
  • Interesting development in the case against Universal Music Group's malicious prosecution and nonsense take-down orders
• Bitpay sues their insurance company after giving away $1.8M
  • http://www.coindesk.com/bitpay-sues-insurer-after-losing-1-8-million-in-phishing-attack/
  • Interesting argument in court - indirect loss
  • Company exec got phished for credentials
  • Execs fall for "transfer large quantity of money" scam
  • Follow this case!
• China making demands of US tech companies
  
  • http://www.engadget.com/2015/09/17/china-us-tech-companies-security-policies/
  • This has happened before...US companies found ways around this once
  • Essentially it appears as though China is asking for 'backdoors' and secret access to source code, etc in order to do business in China
  • Talk about anti-competitive!
• The Kardashian train wreck exposes fans' information due to web flaw
  • http://techcrunch.com/2015/09/16/kardashian-website-security-issue-exposes-names-emails-of-over-half-a-million-subscribers-payment-info-safe/#.gofm76:EZbS
  • Some 'developer' wanted to see how the site worked, poked around and found an interesting flaw and posed it to owners
  • ~500,000 subscribers info exposed

In this episode

• Court strikes down Wyndham's challenge to FTC power
  • We have covered this before
  • Wyndham argued due proces and lack of case law - asked for dismissal
  • Court said no dismissal, FTC has standing
  • FTC is arguing that Wyndham made promises it did not keep
  • Should be interesting to watch this go to court (or likely not)
  • http://www.csoonline.com/article/2975915/data-breach/wyndham-vs-ftc-corporate-security-pros-need-to-lawyer-up-about-data-breach-protection-experts-say.html
• Ashley Madison hauled into court by class-action suit
  • Lots of thorny issues here, must separate out moral from legal
  • Shines light on the continued bias for breach prevention
  • Interesting Streisand effect here
  • http://www.csoonline.com/article/2975755/data-breach/ashley-madison-hauled-to-court-in-class-action-suits-over-data-breach.html
• Verizon launches Hum OBD port vehicle monitor and communication tool
  • In light of the stunt-hacking against Chrysler/Jeep is Verizon tone deaf?
  • ..or are they simply that confident in their security?
  • There is no mention, by the way, of security of the device on the web site
  • http://www.macnn.com/articles/15/08/26/service.not.reliant.on.verizons.network.uses.any.ios.or.android.phone.130118/
• The move to EMV cards (chip & sign) in America is changing how fraud happens
  • EMV cards cost a fortune to implement
  • Solving a problem the finance industry did not have
  • http://www.bankinfosecurity.com/interviews/emv-shift-preparing-for-fraud-migration-i-2850#

In this episode...

• Just when you thought America's neutered "chip & sign" was a safe
  
  • http://krebsonsecurity.com/2015/08/chip-card-atm-shimmer-found-in-mexico/
  • Admittedly we put these stories in here just to get Michael all fired up
• Ashley Madison's data and source code and CEO's email spool now released and public
  • http://www.theregister.co.uk/2015/08/20/ashley_madison_email_dump/
  • http://www.csoonline.com/article/2973575/business-continuity/ashley-madison-self-assessments-highlight-security-fears-and-failures.html
  • So much to talk about that's just wrong with this story...
• Uber is hiring people for security
  • http://www.ibtimes.com/uber-boost-security-staff-after-data-privacy-concerns-2055903
  • Does more headcount equal better security?
  • Where will these people come from given the shortage of talent? <snark>
• That gadget you attached to your OBD2 port on your car to "save on car insurance" may be used to kill you
  • Seriously
  • The dangers of all these wireless & connected devices is scary
  • Risk assessment anyone?
  • http://www.wired.com/2015/08/hackers-cut-corvettes-brakes-via-common-car-gadget/
  • Someone get Flo on the phone...
• Windows 2003 which is now expired still has 609,000 public servers on the Internet
  • Translates into roughly 175M websites (Netcraft)
  • Why are thse out there?
  • Is there really a risk or is this hype?
  • http://www.zdnet.com/article/windows-server-2003-servers-insecure-unpatched/
• ATC systems go down as they were ...<drumroll> being updated!
  • Common problem of ancient systems going down due to upgrade
  • ATC has ZERO patch window
  • ..also close to ZERO ability to test patches/updates in "lab" environment
  • Complex, ancient systems fail when they're upgraded, sometimes catastrophically
  • http://thehill.com/policy/cybersecurity/251310-software-limits-exposed-in-air-traffic-outage

In this episode...

• The Belgian government's internal phishing test has "gone off the rails" a bit
  • Used a legitimate entity to test against
  • Panic and hilarity ensued, but mostly panic
  • http://www.networkworld.com/article/2951514/security/belgian-government-phishing-test-goes-offtrack.html
• British ICO makes a 180,000 pound fine
  • Disconnect between policy and reality
  • Was anything lost?
  • 2 big failures lead to a fine
  • https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/08/ico-fines-nationwide-money-lender-the-money-shop-180-000/
• McAfee and Black Hat attendee surveys wildly different
  • Answers you get depend on who and how you ask
  • Interesting answert though...
  • Lesson: The more experience you have, the less confidence?
  • http://www.slate.com/blogs/future_tense/2015/07/21/two_surveys_of_cybersecurity_professionals_show_starkly_different_attitudes.html

In this episode...

• "Hackers remotely kill a Jeep!"
  • Lots to talk about
  • Basics of segmentation weren't followed, aren't followed
  • Discussion on software 'fitness' and liability
  • http://www.cato.org/blog/hackers-remotely-kill-jeep
• Firefox blocks Flash and FaceBook calls for its death
  • Should it concern you that FireFox can change your config without your permission or an update?
  • How helpful is this? Does the message/pop-up actually DO anything to stop users from clicking YES?
  • http://money.cnn.com/2015/07/14/technology/flash-firefox-facebook/index.html
• Ashley Madison (the cheating website) breached!
  • Check their privacy policy - is it consistent with actions?
  • Did this event delay or possibly end the company's aspirations of going public?
  • The morality of AM's business model shouldn't be an issue here - but it keeps coming up
  • http://www.csmonitor.com/World/Passcode/2015/0722/Ashley-Madison-breach-a-painful-reminder-of-online-data-s-permanence
• British Gas bows to criticism over blocking password managers
  • http://www.scmagazineuk.com/british-gas-bows-to-criticism-over-blocking-password-managers/article/426463/
• US Court says "pocket dialed" called are NOT private
  • http://www.itworld.com/article/2951715/security/us-court-says-pocketdialed-calls-are-not-private.html

In this episode...

• Appears as though Windows 10 WiFi Sense could have some issues with WiFi -- more on this as it develops
  • Why is the default opt-in, and why in the world do I have to change my SSID to opt out?!
  • Is it really a good idea to use an SSID to describe security constraints on your network? (Hint: NO)
  • http://www.computing.co.uk/ctg/news/2415787/windows-10-wi-fi-sense-security-warning-over-automatically-shared-passwords
• "Washington Post will encrypt the news"
  • Ridiculous click-bait headline
  • Is this a good idea? Should everything be HTTPS?
  • What about ads, are we defeating ourselves?
  • https://hacked.com/washington-post-encrypt-news/
• OPM hackers stole 21.5 million people worth of records
  • That's all government employees, past, present, and under-cover (possibly)
  • 1.1 million biometrics (fingerprints) -- quick! go reset your fingerprints... oh wait
  • Bad --> worse --> catastrophic --> now what?
  • http://www.computerworld.com/article/2946031/cybercrime-hacking/opm-hackers-stole-data-on-215m-people-including-11m-fingerprints.html
• Katherine Archuletta, Director of OPM, resigns
  • Shock. Awe. Not.
  • Did everyone else see this one coming?
  • Does this change anything? Does her departure make anything better or is she the sacrificial lamb, the way Washington operates?
  • http://www.nytimes.com/2015/07/11/us/katherine-archuleta-director-of-office-of-personnel-management-resigns.html

In this episode

With me gone, James and Michael run feral!

• It's June, so here are the top 3 security priorities for CISOs for 2015 (yes in June)
  • http://www.information-age.com/technology/security/123459699/top-3-security-priorities-cios-2015
  • Boils down to: patch faster, improve credentials, code better
  • Is this the right list? 
  • It mentioned side-stepping cloud and mobility. What if migrating to the cloud offers the opportunity to not worry about patching or code, and improve your credentials? 
  • Someone pointed out to me that this matches the OPM hack; perhaps this is just content driven from that? Does that make it more or less valid?
  • Let us know… #DTSR
• Cybersecurity tops advisors's compliance worries: poll
  • http://www.thinkadvisor.com/2015/06/24/cybersecurity-tops-advisors-compliance-worries-pol
  • More people concerned. 
  • This directly undercuts the notion that people don’t care. They do care. They care about their money. The advisors entrusted with their money care. People care. 
  • The question for us: what are we doing? How are we helping?
• Why it's worth divorcing information security from IT
  • http://www.forbes.com/sites/frontline/2015/06/22/why-its-worth-divorcing-information-security-from-it/
  • No. No it’s not. We don’t need more silos, we need less. 
  • This feels a bit like “we’re not getting what we want… so the answer is reorg.”
• Keeping your kids safe (online) this summer -- with our very own TV star, James!
  • http://www.news4jax.com/news/summer-online-safety-for-kids/33747246
  • James, tell us about the experience - and how you don’t have nearly the control you think you’ll have
  • What did you do to prep?
  • What was your one big take away?
  • Now that you did the interview, any new thoughts?
  • Folks… what do you do? #DTSR - congratulate James on a great interview, then share your ideas (and yes, this is an enterprise play -- you can AND SHOULD share this with your employees)

In this episode...

• Facebook has released PGP-encryption-enabled email communications
  • The anti-privacy platform will now encrypt emails to you if you give them your PGP public key
  • Does no one see the insane irony here?
  • http://www.theregister.co.uk/2015/06/01/facebook_pgp_support/
• White House issues mandate for HTTPS (by default) for all federal websites
  • "By the end of 2016"
  • Is this a good thing? A bad thing? Or does it even matter?
  • http://www.huffingtonpost.com/2015/06/08/https-federal-websites_n_7539164.html
• Attackers are using medical devices to pivot into health care networks
  • The Internet of Medical Things is insecure
  • There are challenges here, but the risks of moving faster aren't negligible
  • Lots to be thought about here
  • http://www.csoonline.com/article/2931474/data-breach/attackers-targeting-medical-devices-to-bypass-hospital-security.html
• Kaspersky gets popped, cue the typical verbiage
  • "Three previously unknown techniques"
  • "..highly sophisticated attack used up to three zero-day exploits.."
  • http://www.bbc.com/news/technology-33083050
• PwC healthcare spending study is disturbing
  • Predicts a 6.5% dip
  • Security is one factor in increasing cost
  • http://hitconsultant.net/2015/06/10/pwc-healthcare-spending-growth-rate-to-dip/
  • http://www.csoonline.com/article/2934929/security-leadership/why-the-dip-in-healthcare-spending-is-actually-a-risky-opportunity-for-security-leaders.html

Apologies to anyone who is having issues downloading this episode!

In this episode...

• The ACLU encourages the government to get into bug bounties
  • Read the original letter: https://www.aclu.org/sites/default/files/field_document/aclu_-_iptf_recommendations_submitted.pdf
  • Points 1 & 2 are at sane
  • Point 3 makes a hard left into into crazy-town
  • http://thehill.com/policy/technology/243265-aclu-says-government-should-offer-rewards-for-finding-security-flaws-on-its
• The massive taxpayer data fraud (not really a breach) is believed to be the work of Russia, says the IRS
  • Does it really matter?
  • Was this a breach or an abuse of functionality?
  • Would your company have caught this?
  • http://www.cnn.com/2015/05/27/politics/irs-cyber-breach-russia/index.html
• CareFirst says their recent breach affects only about 1.1M people
  • Healthcare is clearly in the "bad guys" target zone
  • Quick to point out what the attackers did not get access to
  • Of course it was a sophisticated cyberattack
  • http://abcnews.go.com/Technology/wireStory/carefirst-data-breach-affects-11m-people-31187250
• CNA Financial business unit refusing to pay out claim to Cottage Health System
  • Claims hospital "failed to continuously implement procedures and risk controls identified"
  • CNA unit alleges many failures -- but is this fair?
  • http://www.businessinsurance.com/article/20150515/NEWS06/150519893