In this episode...

• Netflix launched FIDO (not that one, or that one, no the other one)
  • Focused on automating incident response practices
  • FIDO is an orchestration layer that automates the incident response process by evaluating, assessing and responding to malware and other detected threats.
  • If you don't use it, at least they provide a structured framework for response and IR workflow
  • http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html
• IT Chief leaves sensitive data in car- spoiler: it gets stolen
  • Something smells like a fish market in the July heat on this story
  • Maybe it's time to check in on YOUR off-site handling procedures?
  • http://www.thestarpress.com/story/news/local/2015/05/10/chief-left-hard-drives-car/27083031/
• Crowdstrike discovers, names "Venom"
  • Massive security vulnerability within the floppy disk emulator in virtual machine hypervisors
  • Even if you disable floppy disk emulation, separate bug lets you enable it
  • This has a graphic and everything!
  • http://www.csoonline.com/article/2921589/application-security/significant-virtual-machine-vulnerability-has-been-hiding-in-floppy-disk-code-for-11-years.html
• United Airlines launches bug bounty
  • Does this have anything to do with the now infamous (alleged) airplane hacker?
  • Seems like some contradictory statements in the description
  • (see below on United's response to our inquiry)
  • http://www.united.com/web/en-US/content/contact/bugbounty.aspx

Note back from United Bug Bounty Team:

Posted with permission--

"Rafal:

            Thank you for the question.  We want researchers to be able to notify of potential issues they find while still protecting customers who are not participating in the program.  If a researcher launched a brute force attack and locked the accounts of 10,000 customers through already existing security measures this would negatively affect our customers and the program.

            If any researchers believe they may have found a brute force condition, they can feel free to submit it to us without testing.  We will check on our end and if we confirm a bug exists we will gladly reward them for their effort.  Does that make sense?

Best,

United Bug Bounty Team"

In this episode...

• A join Ponemon Institute & IBM Security study shows that, surprise surprise, developers are "neglecting security"
  • The study only looked at mobile apps and app developers
  • Less than half (of their study) test the mobile apps they build
  • About 33% never test their apps
  • http://www.eweek.com/developer/ibm-study-shows-mobile-app-developers-neglecting-security.html
• Illinois Bill SB1833 expands the definition of PII to include almost everything
  • Requires notification in the event of a breach of...
  • Online browsing history, online search history, or purchasing history
  • Is this absurd, or just protecting our privacy?
  • http://www.eweek.com/developer/ibm-study-shows-mobile-app-developers-neglecting-security.html
• The DOJ has jumped in and issued some sound fundamental breach guidance!
  • 4 sections: what to do before, during and after a breach plus what NOT to do after a breach
  • Fantastic fundamentals... great idea
  • The push to fundamentals is critical!
  • http://www.alstonprivacy.com/doj-issues-data-breach-guidance/
  • http://www.justice.gov/sites/default/files/opa/speeches/attachments/2015/04/29/criminal_division_guidance_on_best_practices_for_victim_response_and_reporting_cyber_incidents.pdf
• Mozilla is phasing out non-secure HTTP
  • HTTPS only is the way forward, so Mozilla (champions of liberty and all that) are leading the way
  • https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/
• First foreign hacker is convicted in the US
  • Canadian kid who hacked and stole trade secrets and other sensitive info from video game companies
  • He pled guity in September 2014, maximum of 5yr prison sentence
  • http://blogs.orrick.com/trade-secrets-watch/2015/04/30/first-foreign-hacker-is-convicted-in-the-united-states-of-hacking-crimes-involving-theft-of-trade-secrets-from-american-companies/

In this episode...

• Friend and security researcher Chris Roberts steps into it... 
  • A poorly-conceived tweet, followed by mass hysteria
  • Most everyone talking about this is missing the point entirely
  • Of course, the EFF jumps in to keep from "chilling research" (roll eyes)
  • http://www.usatoday.com/story/tech/2015/04/19/chris-roberts-one-world-labs-united-rsa-computer-security-tweets/26036397/
  • The EFF take: https://www.eff.org/deeplinks/2015/04/united-airlines-stops-researcher-who-tweeted-about-airplane-network-security
• Corporate threat intelligence teams opting to go anonymous?
  • New company, making intelligence sharing work, anonymously?
  • Many questions on whether anonymity is workable in the intelligence space
  • https://www.eff.org/deeplinks/2015/04/united-airlines-stops-researcher-who-tweeted-about-airplane-network-security
• Target settles with Mastercard for $19M USD
  • Mastercard trying to settle this out, as alternative payout option for victims (this time the issuers, not card holders)
  • http://www.theregister.co.uk/2015/04/16/target_settles_with_mastercard_for_us19_million/
• The looming security threat no one is talking about
  • We're talking about it!
  • Windows 2003 is going out of service... after 12 yrs?
  • Final deadlines is July 14th
  • Panic? Compensating security controls?
  • http://www.healthcaredive.com/news/himss15-the-looming-it-security-threat-that-no-one-is-talking-about/386754/
• HTTP "ping of death" coming to a Windows IIS web-server near you
  • Patch now... people are actively exploiting this flaw to knock over web servers
  • Quick turn-around from "patch released" to "patch reverse-engineered to attack IIS servers"
  • http://www.theregister.co.uk/2015/04/16/http_sys_exploit_wild_ms15_034/
• JPMC algorithmn knowns you're an insider threat, before you do
  • Fascinating, applies to the financial world
  • Uses behavioral indicators
  • http://www.bloomberg.com/news/articles/2015-04-08/jpmorgan-algorithm-knows-you-re-a-rogue-employee-before-you-do

In this episode...

• TrueCrypt security audit results are good news, right? 
  • Why are some of the most depended-upon 
  • http://arstechnica.com/security/2015/04/truecrypt-security-audit-is-good-news-so-why-all-the-glum-faces/
• At Aetna, CyberSecurity is a matter of business risk
  • Jim Routh talks about how he runs a security program
  • Security is a matter of business risk, if not you're doing it wrong
  • http://blogs.wsj.com/cio/2015/03/30/cybersecurity-at-aetna-is-a-matter-of-business-risk/
• Why aren't you vulnerability scanning more often?
  • Wrong question.
  • Simple answer -- because scanning doesn't matter if you can't fix the issues you find
  • Example of how security misses the point
  • http://www.csoonline.com/article/2901472/vulnerabilities/why-aren-t-you-vulnerability-scanning-more-often.html
• SecurityScorecard - a new startup that is exposing 3rd party risks to you -- or is it?
  • Interesting business model
  • How legitimate is this, and what are the risks?
  • http://www.businessinsider.com/securityscorecard-raises-125-million-led-by-sequoia-2015-3
• Does removing Windows administrator permission really mitigate 97% of vulnerabilities?!
  • Is this real? If so -- why isn't everyone doing it?
  • Local administrator privileges are starting to fade, but why so slowly?
  • http://blog.norsecorp.com/2015/04/02/removing-admin-privileges-mitigates-97-of-critical-microsoft-vulnerabilities/

Remember folks, as you listen reach out to us on Twitter and hit the hashtag #DtSR to continue the conversation, and speak your mind! Let's hear what your take is on the stories we discuss...maybe you have a unique angle we've not considered?

In this episode--

• Target settled class-action lawsuit over its data breach - for $10M USD
  • Who wins? Lawyers, clearly the lawyers
  • Burden of proof on the victims to show they've suffered a loss to get up to $10,000.00.
  • If you can't prove loss, you can still try to get part of settlement of what's left-over
  • http://www.usatoday.com/story/money/2015/03/19/target-breach-settlement-details/25012949/
• Federal judge dismisses suit against Paytime -- "simply no compensable injury yet"
  • Leaves door open for future suits if someone were to suffer a compensable injury
  • "Once a hacker does misuse a person's information for personal gain...there is a clear injury and one that can be fully compensated with money damages." -- Judge John E. Jones III
  • Watch this case, read the story for yourself
  • http://www.securityinfowatch.com/news/11883806/federal-judge-dismisses-lawsuits-over-paytime-inc-data-breach
• Sacred Heath Health System victim-by-proxy of a data breach
  • Happened at a 3rd party
  • So why is only Sacred Heart in the news?
  • ~40 individuals SSN and patient information
  • "deceptive technique" known as phishing
  • http://pensacolatoday.com/2015/03/sacred-heart-informs-patients-of-billing-information-disclosure/
• Premera Blue Cross "warned about security flaws before breach"
  • Lots to talk about here -- starting with is 3 weeks enough time?
  • OPM audit finds issues, is this a systemic failure or examplary of an enterprise doing its best in a difficult security climate?
  • Before you judge, measure up your own security posture against this article
  • http://www.seattletimes.com/business/local-business/feds-warned-premera-about-security-flaws-before-breach/
• Advantage Dental notifies patients of breach
  • 3 days from initial breach to discovery
  • Amazingly fast detection, but was it adversary or malware?
  • Is this a feel-good, or something else?
  • https://secure.advantagedental.com/index.asp?din=598
• NYC Auxiliary Officer charged with hacking NYPD & FBI systems
  • Insider threat poster child
  • Smart enough to do some interesting things
  • Yet, one of the dumbest criminals we've seen in a long time
  • http://www.fbi.gov/newyork/press-releases/2015/new-york-city-police-department-auxiliary-officer-charged-with-hacking-into-nypd-computer-and-fbi-database

In this episode--

• Law firm hit and crippled by ransomware, decides it's not paying the ransom.
  • They aren't quite sure what got encrypted
  • But they have backups...
  • ..and data was likely not exfiltrated
  • http://news.softpedia.com/news/Ransomware-Hits-Law-Firm-Encrypts-Workstation-and-Server-474788.shtml
• Major law firms for ISAC to fight off adversaries, share intelligence
  • Catching up to the threat they're facing
  • Law firms are major targets, given the data they have ("secrets!")
  • Downside: exclusive to a handful of major firms
  • http://thehill.com/policy/cybersecurity/234722-law-firms-to-share-info-about-cyber-threats
• Big kerfuffle about Anthem's refusal of a 3rd party audie
  • They were under no legal obligation...
  • Who out there would submit to a 3rd party audit/test?
  • Sounds like publish shaming, big headline, little story
  • http://www.healthcareinfosecurity.com/anthem-refuses-full-security-audit-a-7980
• Apple Pay being attacked, sort of
  • When technology becomes 'good enough' attackers attack processes, people
  • Lesson -- nothing is "unhackable" even if the tech is great
  • http://www.theguardian.com/technology/2015/mar/02/apple-pay-mobile-payment-system-scammers
• [Slightly-old-but-relevant] Victor Valley College suspends entire IT staff to investigate a vague breach in protocol
  • Very little actually said in disclosure
  • "We don't have any reason to believe we've been hacked by outside hackers"
  • Entire computer system was taken down for nearly 3 hours
  • Emphasizing "no private student or employee information has been compromised"
  • Stay tuned...weird
  • http://www.vvdailypress.com/article/20150130/NEWS/150139991

In this episode--

• Would you be OK with your credit card company tracking you, to decrease fraud rates? Visa wants to track your smartphone.
  • http://triblive.com/business/headlines/7774328-74/visa-card-fraud
• Your stolen healthcare data is increasingly being sold on the black market
  • http://www.ihealthbeat.org/articles/2015/2/19/security-experts-health-data-increasingly-being-sold-on-black-market
• Lenovo has shipped software that performs a man-in-the-middle (MITM) attack against all SSL connections on some of its consumer laptops. This is really, really, really bad, but Lenovo doesn't seem to get it.
  • http://arstechnica.com/security/2015/02/lenovo-pcs-ship-with-man-in-the-middle-adware-that-breaks-https-connections/
  • http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html
• The web browser is totally broken, and a haven for malware. Long live the web browser?
  • http://securityintelligence.com/broken-web-browsers-malwares-new-address/

Topics covered

• Massive breach at American Health Insurer Anthem - from the "haven't we done this once before?" department as Queen - Another One Bites the Dust plays in the background
  • https://gigaom.com/2015/02/05/oops-another-big-data-breach-this-time-at-anthem/
  • http://money.cnn.com/2015/02/05/investing/anthem-hack-stocks/index.html?sr=twmoney020615anthemwallst0600story
  • (Obligatory OMG China! hype link) http://krebsonsecurity.com/2015/02/china-to-blame-in-anthem-hack/
• Hackers target brokers, financial advisors -- SEC "does something"
  • http://thehill.com/policy/cybersecurity/231649-hackers-targeting-brokerages-and-financial-advisers
  • SEC weighs cybersecurity disclosure rules (why SEC?) - http://thehill.com/policy/cybersecurity/229431-sec-weighs-cybersecurity-disclosure-rules
• A promising new technology which detects hacks in - milliseconds? -but what's the use-case?
  • http://www.bloomberg.com/news/articles/2015-02-03/new-technology-detects-hacks-in-milliseconds
• Google launches vulnerability research grants program - because bug bounties just aren't enough
  • http://www.scmagazine.com/google-launches-vulnerability-research-grants-program/article/395694/
• Sony Pictures Entertainment (the company that was so thoroughly hacked) CEO Amy Pascal is out! But is this proof of anything, for security? Ask Michael...
  • http://www.csoonline.com/article/2880600/security-leadership/the-conversation-security-leaders-need-to-have-about-amy-pascal-s-departure.html

** There is a special gift for our listeners in this episode, from our friends at InfoSec World 2015! Listen to find out how you can go for free.

 We have a promo code!

CLD15/RABBIT – 15% off for “Down the Rabbit Hole” listeners

Topics Covered

• Google picks up really big rocks, but lives in a glass house. As Google drops zero-day on Apple and Microsoft they respond with a lame excuse as to why they aren't patching a vulnerability that puts north of 60% of all Android users at risk.
  • http://m.v3.co.uk/v3-uk/news/2389839/google-puts-60-percent-of-android-users-at-risk-with-webview-security-changes
  • http://www.extremetech.com/mobile/197346-google-throws-nearly-a-billion-android-users-under-the-bus-refuses-to-patch-os-vulnerability
  • http://www.eweek.com/security/google-project-zero-continues-its-microsoft-zero-day-assault.html
  • http://www.zdnet.com/article/googles-project-zero-reveals-three-apple-os-x-zero-day-vulnerabilities/
• Marriott reverses its decision to block guests' personal WiFi devices at their properties
  • http://threatpost.com/marriott-agrees-to-stop-blocking-guest-wifi-devices/110441
• LabMD's request to have an enforcement action against them by the Federal Trade Commission is denied. While this doesn't necessarily mean anything serious, yet, it's definitely one to watch.
  • http://healthitsecurity.com/2015/01/23/ftc-healthcare-data-breach-case-v-labmd-continues/
• Heartland Payment Systems - yes the company that was the posted child for nearly going out of business because of a horrible breach - is continuing to reinvent itself around security, this time making headlines with an offer of a data breach warranty. Strings, as you may suspect, attached.
  • http://www.cspnet.com/industry-news-analysis/technology/articles/heartland-offering-data-breach-warranty
  • http://www.businesswire.com/news/home/20150112005260/en/Heartland-Offer-Comprehensive-Merchant-Breach-Warranty

Watch this podcast page later this week for that freebie Michael told you about!

Welcome to a new year of the Down the Security Rabbithole Podcast! We are kicking off this year with a guest on this morning's program, Phil Beyer joined us to talk about the last few weeks that have been a wild, wild ride in the security indsutry!

Thanks for your support so far, and we promise a fantastic 2015 to come.

Topics Covered

• Sony. Sony. Sony. It's all anyone can talk about! They got hacked. They released a movie. They apparently aren't in dire straits. Fascinating.
  • http://www.cbc.ca/m/news/world/sony-pictures-ceo-michael-lynton-says-hackers-burned-down-the-house-1.2894997
  • http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hack
  • http://www.washingtonpost.com/world/national-security/fbi-director-offers-new-evidence-to-back-claim-north-korea-hacked-sony/2015/01/07/ce667980-969a-11e4-8005-1924ede3e54a_story.html
• Meanwhile, an iron plant in Germany was attacked (via cyber) and caused some very serious, and real, damage
  • http://blogs.wsj.com/cio/2014/12/18/cyberattack-on-german-iron-plant-causes-widespread-damage-report/
• Microsoft abruptly cut off patch Tuesday public notifications, unless you're paying extra
  • http://www.computerworld.com/article/2866996/microsoft-abruptly-dumps-public-patch-tuesday-alerts.html
• On January 11th, 2015 a 90-day window expired and Google's new Project Zero disclosed on the world a Windows 8.1 privilege elevation flaw. Microsoft had not yet patched it. War of words is on.
  • https://code.google.com/p/google-security-research/issues/detail?id=123
  • http://www.pcworld.com/article/2867533/google-reveals-windows-81-flaw-mere-days-before-patch-tuesday-fix-irking-microsoft.html

Topics covered

• The unfolding case of the Sony Pictures Entertainment breach
  • http://blog.wh1t3rabbit.net/2014/12/when-press-aids-enemy.html
  • http://www.thedailybeast.com/articles/2014/12/12/shocking-new-reveals-from-sony-hack-j-law-pitt-clooney-and-comparing-fincher-to-hitler.html
  • http://www.csoonline.com/article/2857455/business-continuity/fbi-says-theres-nothing-linking-north-korea-to-sony-hack.html
  • http://www.csoonline.com/article/2854672/business-continuity/the-breach-at-sony-pictures-is-no-longer-just-an-it-issue.html
• The phishing scam that succeeded at hitting a big chunk of Wall Street - it probably would have fooled you too. Here's what we've learned
  • http://arstechnica.com/security/2014/12/phishing-scam-that-penetrated-wall-street-just-might-work-against-you-too/
• Iranian hackers hit Las Vegas behemoth with a sophisticated attacked ... wait it was a Visual Basic base?!
  • http://arstechnica.com/security/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/
• Judge refuses to dismiss case against Target, brought on by banks who are the ones who take the brunt of the losses-
  • http://arstechnica.com/tech-policy/2014/12/judge-rules-that-banks-can-sue-target-for-2013-credit-card-hack/

Topics covered

• Sony Pictures is having a very, very bad couple of days - and it could keep getting worse.
  • http://www.theverge.com/2014/11/24/7277451/sony-pictures-paralyzed-by-massive-security-compromise
  • http://www.csoonline.com/article/2852982/data-breach/sales-contracts-and-other-data-published-by-sonys-attackers.html
• A newly discovered (but old) comment bug in Wordpress affects ~86% of sites. The story isn't what you think it is-
  • http://www.consumeraffairs.com/news/newly-discovered-comment-security-bug-affects-86-of-wordpress-blogs-112414.html
• The Australian government is blaming a data breach from February on ... "awareness"? Michael disagrees (and he's right).
  • http://www.esecurityplanet.com/network-security/australian-government-data-breach-linked-to-poor-security-training.html
• The public release of the research on Regin malware has it pegged as the most advanced thing since the computer - so what?
  • http://money.cnn.com/2014/11/23/technology/security/regin-malware-symantec/index.html?hpt=hp_t2
  • https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/
  • Symantec whitepaper: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf
• The Justice Department is using a 225 year old law to tackle a modern problem of encrypted cell phones through the manufacturer.
  • http://blogs.wsj.com/digits/2014/11/25/case-suggests-how-government-may-get-around-phone-encryption/
• The court system...works? 440 year jail threat down to a misdemeanor in no time flat
  • http://www.wired.com/2014/11/from-440-years-to-misdemeanor/
• Updates:
  • Target doesn't feel like all the banks' losses are their problem, here's why - http://arstechnica.com/tech-policy/2014/11/target-to-judge-banks-losses-in-our-card-breach-arent-our-problem/
  • In spite of the massive breach, Home Depot financial outlook is bright - http://www.forbes.com/sites/maggiemcgrath/2014/11/18/home-depot-outlook-bright-despite-data-breach/

Note: The hashtag for the show on Twitter has changed, please connect with us using #DtSR going forward. Thanks!

Topics covered

• Update: Home Depot breach (Hint: apparently it was a 3rd party entry point)
  • Story: http://www.computerworld.com/article/2844491/home-depot-attackers-broke-in-using-a-vendors-stolen-credentials.html
  • Apparently as a reaction, all execs are being switched to iDevices (blame Windows? and why only execs?) - http://www.imore.com/home-depot-switches-execs-iphones-macbooks-it-blames-windows-massive-breach
  • Also, they lost ~53 Million email addresses too - http://online.wsj.com/articles/home-depot-hackers-used-password-stolen-from-vendor-1415309282
• American Express is pushing tokenization to their payment ecosystem, this is big news but leaves a lot more questions and concerns than answers (for example- what about chip & pin (sign)? )-
  • Story: http://threatpost.com/american-express-brings-tokenization-to-payment-cards/109137
  • Check out the standard itself: http://www.emvco.com/download_agreement.aspx?id=945
• Flaw found (in a lab) in the VISA EMV protocol, but is it realistic to do this kind of "immense fraud" in outside the lab, in real life?
  • Story: http://www.cio.com/article/2842994/flaw-in-visa-cards-could-ring-up-a-very-large-fraud.html
• The FTC further exerises its (Constitutional?) powers to take down fake "Support call scammers" and is on track to some public fanfare-
  • Story: https://nakedsecurity.sophos.com/2014/10/26/ftc-takes-down-fake-support-scammers-upbeat-about-getting-consumers-money-back-poll/
• Connecticut Supreme Court paves the way for class-action suit in HIPAA breach/violation. Big question- is this good for anyone other than the lawyers? Will it just add to the rising cost of healthcare, or is this doing some good?
  • Story: http://www.ctlawtribune.com/home/id=1202676138225/Conn-Supreme-Court-HIPAA-Decision-Likely-to-Spawn-More-Litigation
• A "spying software" that can spot a phone theft in "2 minutes"? Call us skeptical, and leary-
  • Story: http://www.fastcodesign.com/3038031/spying-software-spots-phone-theft-in-2-minutes-no-password-needed
• Starwood Hotels is going keyless with iPhone & iWatch integration for room entry. A great idea, if it's free of the usual security bugs.
  • Story: http://www.theipadfan.com/starwood-hotel-rooms-now-keyless-with-iphone-and-apple-watch-app-integration/
  • Michael's take on the story: http://www.csoonline.com/article/2691383/security-leadership/what-did-you-expect-to-happen-when-you-bought-the-electronic-lock.html
  • Episode 111, where we briefly cover this topic in detail via the Onity court case: http://podcast.wh1t3rabbit.net/dtr-episode-111-newscast-for-september-22nd-2014
• Breaches
  • BrowserStack goes down, gets transparent and honest, promises to come back stronger - http://www.browserstack.com/attack-and-downtime-on-9-November
  • "Massive" USPS data breach identified, hits customers and employees (cue the lawsuits!) - http://www.cnn.com/2014/11/10/politics/postal-service-security-breach/index.html?hpt=hp_t2
  • NOAA breached by .... China! - http://www.eweek.com/security/noaa-other-u.s.-agency-security-breaches-connecting-the-dots.html
  • State Department shuts down unclassified email system, after spotting "activity of concern" - http://www.nytimes.com/2014/11/17/us/politics/state-department-targeted-by-hackers-in-4th-agency-computer-breach.html?_r=0

Topics covered

• Banks urging shoppers not to avoid breached retailers - Companies that get breached impact card holders minimally, at least as far as we can tell, right?
  • http://www.kcentv.com/story/26887771/local-bank-leaders-no-need-to-avoid-hacked-retailers-during-holidays
• Federal officials (FBI, US SS) are making a big push to be your source for cyber-security help - Interesting that this comes up at a time when everyone is fighting back against government meddling/surveillence
  • http://www.usatoday.com/story/news/politics/2014/10/20/secret-service-fbi-hack-cybersecuurity/17615029/
• The FCC flexes its muscle in a pair of fines totalling a paltry $10m for egregious security violations - Of course, the people who have had their privacy and security violated see none of this big-telco pocket-change...
  • http://www.washingtonpost.com/blogs/the-switch/wp/2014/10/24/with-a-10-million-fine-the-fcc-is-leaping-into-data-security-for-the-first-time/
• Congress doesn't crant FBI ability to prevent mobile encryption .. undoubtedly ushering us into "a very dark place" - for once, Congress did something useful by doing what it's famous for, nothing
  • http://www.theregister.co.uk/2014/10/22/fbi_apple_grapple_congress_kills_cupertino_crypto_kibosh/
• Insurance companies fighting to get data breach coverage removed from general liability policies - isn't this obvious? I think this is one of the last shoes to drop before things move forward, finally
  • http://www.businessinsurance.com/article/20141026/NEWS07/141029850

Topics covered

• The FBI paid a visit to the "researcher" who revealed (and tinkered with) the hacked Yahoo! servers - we discuss the various aspects of this case, which we've been going round and round on lately
  • http://www.wired.com/2014/10/shellshockresearcher/
• US Cyber Security Czar Michael Daniel wants us passwords gone, replaced by <drumroll please> .... "selfies"; We wish we were making this one up or the link was to an Onion article, but sometimes the jokes write themselves in a sad, sad way
  • http://www.theregister.co.uk/2014/10/15/forget_passwords_lets_use_selfies_says_obamas_cyber_tsar/
• Pres. Obama has issued an executive order that all government payment cards now must be "chip & pin"; once again underscoring that "just do something" may be worse than actually doing nothing -- we'd love to hear your thoughts?
  • http://www.whitehouse.gov/the-press-office/2014/10/17/executive-order-improving-security-consumer-financial-transactions
• Notable data breaches discussed:
  • K-Mart - http://www.theregister.co.uk/2014/10/12/kmart_cyber_attach/
  • Dairy Queen - http://www.theregister.co.uk/2014/10/10/dairy_queen_restaurants_hacked/
• POODLE, the latest OMG SSL vulnerability; is this really that big a deal that there is a public vulnerability in a protocol that should have become extinct at the turn of the century? (Hint: Sadly, yes)
  • http://www.theregister.co.uk/2014/10/10/dairy_queen_restaurants_hacked/