Topics covered

• In the wake of the Target & Nieman Marcus breaches - is chip+pin really a priority right now, and does it solve the real problem? - http://blogs.csoonline.com/security-leadership/2977/does-chip-and-pin-actually-solve-problem-find-out-asking-these-questions
• Speaking of Target ... it turns out that 3rd parties really are a problem and still a blind spot in many organizations' risk matrices, who knew - http://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/
• Apparently NBC News doesn't believe it's stretching the news at all, when it virtually makes up a story then gets called out by Robert Graham, hilarity ensues - http://news.cnet.com/8301-1009_3-57618533-83/sochi-hack-report-fraudulent-security-researcher-charges/
• Something bad, very, very bad just happened over at Barclays in the UK ... although jury seems to still be out on what exactly is going on; you can bet we're going to keep an eye on this - http://www.theregister.co.uk/2014/02/10/barclays_investigates_gold_mine_client_data_breach/
• In a "You can't make this stuff up, folks" moment, the FBI is asking for malware and they're willing to pay for it; and they'll send you all the info in a .docx file?! - http://www.nextgov.com/cybersecurity/cybersecurity-report/2014/02/fbi-market-malware/78218/
• Is your next new vehicle going to be part of the mesh-network which keeps cars from crashing into each other? It will if the government has it's ways - complete with wildly-made-up-sounding statistics and ridiculous news story and all (somewhere, Flo from Progressive is mad they stole her schtick)- http://www.usatoday.com/story/money/cars/2014/02/03/nhtsa-vehicle-to-vehicle-communication/5184773/

In this episode

• David discusses what it's like working for a law firm (in the UK)
• A quick wade through the UK Data Protection Act (mostly Principle 7)
• "When lawyers get to interpret the laws"
• Law firms as targets for data breaches
• The new regulations in the UK, fines between 2%-5% of your REVENUE? Ouch.
• Defining "adequate measures" in regulations
• A brief chat on fines, regulations, and risk management
• I trail off on a Princess Bride quote, and get ranty on "risk"
• Dealing with personal devices, public WiFi to work and security
• James asks the inevitable question on training
• Good vs. "best" practice
• Your security as a competitive advantage. really.

Guest

• David Prince ( @riskobscurity ) - A dedicated and well-respected Technical Information Security Professional with several years’ experience and demonstrated success leading information security initiatives, in a variety of organizations. Initiatives which are in direct support of business-objectives to maintain the confidentiality, integrity, and availability of organizational assets and improve business efficiency, and effectiveness.

Special thanks to Michael Santarcangelo ( @catalyst ) for stopping by the show and guest-hosting with James and I! We had fun, and I think you'll all enjoy Michael's perspective and humor.

Topics Covered

• Nieman Marcus breach - all new, same as before, or is it? - http://www.wired.com/threatlevel/2014/01/neiman-marcus-hack/
• Coca-Cola loses laptops ... sort of ... but no worries, no evidence of wrongdoing - http://www.ajc.com/news/business/coca-cola-tells-thousands-of-employees-of-security/nc2NB/
• Breach over at Microsoft, law enforcement documents "likely stolen", but what does that really mean? - http://www.pcworld.com/article/2091480/microsoft-says-law-enforcement-documents-likely-stolen-by-hackers.html
• The (San Jose) police want to use your home surveillence system cameras, I'm not kidding - http://news.cnet.com/8301-17852_3-57617809-71/police-want-to-use-your-home-security-cameras-for-surveillance/

In this episode

• Did the Target/Neiman/? breach finally create a catalyst for change?
• The card system, payment processing infrastructure clearly wasn't designed with defensibility in mind ... who should be changing that?
• Are today's fraud rates finally getting high enough such that card processors, issuers, banks need to depart from the status quo?
• Are the days of "zero fraud liability" to the end consumer coming to an end?
• What about chip & pin? Is the risk less?
• What kinds of pains will the industry go through to make security on payment systems better?
• How is the commercial payments industry different from the consumer?
• Do end users of credit accounts ultimately care about breaches?

Guests

• Laura Claytor ( @the.hgic ) - Laura is a security specialist and veteran within a large US-based banking organization, and is based in the southwest United States
• Alfred Portengen - ( @alfredportengen ) - Alfred has a deep bredth of experience in architecture and security specialty within a multi-national banking organization, he is based in the Netherlands

I can't believe it's 2014 already, and we're rolling through our 3rd calendar year! As we grow and you "regulars" mount, James and I want to thank you for listening, bookmarking, sharing and talking about the podcast. Your patronage has really made a us smile, and you're the reason we do this.

Topics covered

• Reuters: Retail community may be ready for a change in the payment card system and processes - http://uk.reuters.com/article/2014/01/13/uk-target-databreach-retailers-idUKBREA0B01A20140113
• More Snowden fallout: French/UAE Intel satellite deal may be scuttled because of US-made components - http://www.defensenews.com/article/20140105/DEFREG04/301050006
• Ransomware CryptoLocker's uglier, meaner cousin now available for $100... look out! - http://arstechnica.com/security/2014/01/researchers-warn-of-new-meaner-ransomware-with-unbreakable-crypto/
• Schneier: "The Internet of Things" is very vulnerable ...and there's no good way to patch it all - http://www.wired.com/opinion/2014/01/theres-no-good-way-to-patch-the-internet-of-things-and-thats-a-huge-problem/
• Lawsuit filed in the "FaceBook reads my private messages" case - http://money.cnn.com/2014/01/03/technology/facebook-privacy-lawsuit/

In this episode

• Chris Wysopal - who is that masked man?
• Putting some reality to the state-sponsored backdoors (Huawei) and supply-chain compromise
• The risks coming through the door with the products you buy
• The case for setting up an independent testing lab for mitigating 'backdoor' accusations
• Chris does an interesting assessment on software security practices in the enterprise
• Chris discusses holding your vendor to the same standards you hold yourself
• What does it mean that enterprises are doing a "good job" in SwSec
• Chris goes there, open-source components as part of supply chain risk
• James asks "How do smaller buyers leverage scale to hold their suppliers accountable?"
• Why do we still see SQL Injection?! Are we ever going to get rid of it?

Guest

• Chris Wysopal ( @Weldpond ) - Chris is the Founder, CTO and CISO of VeraCode, a company dedicated to software security as-a-service. Chris has a long and storied history in the security industry dating back to L0pht Heavy Industries. His bio and profile can be found on LinkedIn.

In this episode

• Will gives us a lay of the land on the state of "state sponsored" and advanced threats
• We discuss collective advances in malware
• We discuss the persistence of 'old' malware, and code re-use
• We discuss enterprise defense and strategy
• Will gives us some wisdom from his experiencein helping clients defend themselves

Guest

• Will Gragido ( @wgragido ) - Will is currently a senior manager in the Threat Research Intelligence organization at RSA NetWitness. Will is an information security and risk management professional with over 18 year’s professional industry experience, Mr.Gragido brings a wealth of knowledge and experience to bear. Working in a variety of roles, Mr.Gragido has deep expertise and knowledge in operations, analysis, management, professional services & consultancy, pre-sales / architecture and business development within the information security industry. You cn get more information on Will on his LinkedIn page.

Hello! This is a special episode in that it's our year-end wrap-up. We bring together 3 of the industry's best to talk about the year that was, the things that made were on your mind, and maybe give us a hint at what is to come...

Guests

• Will Gragido ( @wgragido ) - Will is the Sr. Manager of threat Research Intelligence for RSA NetWitness and a lightweight with the cold medicine.
• John Pirc ( @jopirc ) - John is the Vice President of Research at NSS Labs, with very strong hair.
• David Marcus ( @DaveMarcus ) - David is the Director and Chief Architect of the Federal Advanced Program Group at McAfee and a kettle bell monster!

Notably absent, but invited, were Dave Lewis ("fell asleep") and Dave Kennedy ("was on an airplane") ...apparently because I thought it would be fun to invite every Dave I know....... but seriously next time guys :)

James and I would like to wish all our listeners a very merry holiday season, and a happy, healthy and prosperous 2014.

Folks, if you work with, design, or implement embedded systems this is one episode you don't want to miss. Fair warning, it's a little bit long at just over 50 minutes total. I hope you find the extra time worth the effort of listening, I know we sure did!

In this episode

• The quirky things that Josh's organization gets to work on and deconstruct
• The methodology of breaking foreign things
• Android and why it's "horribly interesting" beyond just the OS everyone sees
• Hacking Android at the very, very, very basic hardware interface(s)
• Copy/Paste software development and it's pitfalls
• Embedded devices as pivot points for intrusion
• The importance of embedded systems, and why no one is writing secure code (still)

Guest

• Josh Thomas ( @m0nk_dot ) - Chief Breaking Officer for Atredis, Security researcher, mobile phone geek, mesh networking evangelist and general breaker of things electronic. Typical projects of interest span the hardware / software barrier and rarely have a UI. m0nk has spent the last year or two digging deep into Android and iOS internals, with a major focus on both the network stack implementation and the driver and below hardware interfaces. He uses IDA more frequently than Eclipse (and a soldering iron more that both). His life dreams are to ride a robot unicorn on a moonlit beach and make the world a better place, but mostly the unicorn thing...

Special thanks to Steve Ragan ( @SteveD3 ) for sitting in this morning and providing his perspective as a journalist.

Topics Covered

• "Leaked" FBI memo to government agencies says "there's a hacking spree on government websites, and it's Anonymous!" (we have to chuckle, a little) - http://www.theregister.co.uk/2013/11/18/anon_us_gov_hack_warning/ , http://www.thewire.com/national/2013/11/fbi-anonymous-hackers-stole-over-100000-employees-information/71675/
• Fokirtor is a very interesting new piece of malware that targetted Linux systems, but by slipping into SSH comms - http://www.theregister.co.uk/2013/11/15/stealthy_linux_backdoor/ ( and a related piece of malware - http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices )
• The Healthcare.gov website is a case study in how not to release a web app, or complex system; and it's not even a partisan issue anymore - http://arstechnica.com/security/2013/11/healthcare-gov-targeted-by-more-than-a-dozen-hacking-attempts/
• Ahead of the G20 meeting to be held there in 2014, the city of Brisbane, Australia performs a penetration test on their physical city infrastructure, finds major flaws. A plot from "The Italian Job"? - http://www.qao.qld.gov.au/files/file/Reports%20and%20publications/Reports%20to%20Parliament%202013-14/RTP5Trafficmanagementsystems.pdf
• [Scary] Renesys says someone is hijacking the Internet ... but is it on purpose, or just mistakes? (Does it matter?) - http://www.nbcnews.com/technology/wheres-your-data-going-hacks-redirect-traffic-through-distant-lands-2D11624570
• A new piece of software quietly turns you into a bitcoin mine for the developer (and you agree to it in the EULA!) - http://www.networkworld.com/news/2013/120213-sneaky-software-turns-your-pc-276490.html?source=nww_rss

I want to thank Carolyn Kopprasch and the @BufferApp team for getting back to me, and agreeing to not only join the podcast, but also field questions from "anyone" ...what a cool group of people!

In this episode

• Carolyn gives us some of the insider's perspective on what really happened, when Buffer got hacked
• Carolyn and I discuss triage methodology, and how Buffer's small team responded
• In-depth conversation on the communications strategy and implemented plan to be totally transparent
• We discuss that point where it's time to "shut it down" and the need to have the ability and information to make the decision Buffer's team did when they shut down the service temporarily
• Carolyn talks about some of the non-typical ways that her team detects potential security issues
• Caroly dispenses some solid advice for anyone in a small shop that may be operating ultra-lean
• Finally, Carolyn and I talk about software security and what role it (or the lack thereof) played in the Buffer incident

Guest

• Carolyn Kopprasch ( @CaroKopp ) - Carolyn is currently Buffer's "Chief Happiness Officer". Her role is to make sure that Buffer's customers are, in fact, happy. Also she has a web presence right here: http://CaroKopp.com

Links!

• Buffer's communications page: http://open.bufferapp.com/buffer-has-been-hacked-here-is-whats-going-on/

I'm back! Maybe a little sleep-deprived and a tad grumpier than usual, but back to talk news!

Topics Covered

• Microsoft unveils the new Digital Crime Unit, and it is quite the statement - http://www.darkreading.com/attacks-breaches/microsoft-unveils-state-of-the-art-cyber/240163924 http://www.microsoft.com/en-us/news/presskits/dcu/
• CME Group hacked, claims platform and trades unaffected ...let's hope so - http://www.businessweek.com/news/2013-11-15/cme-group-says-its-computers-were-hacked-no-trades-affected
• Jeremy Hammond, Chicago's very own romanticized criminal - http://www.nbcnews.com/technology/hacker-tied-anonymous-gets-10-years-prison-cyberattacks-2D11603760
• The FBI says there's a "hacking spree" on government webites by Anonymous hackers. You don't say ... - http://arstechnica.com/security/2013/11/fbi-warns-hacking-spree-on-government-agencies-is-a-widespread-problem/
• There's an apparent zero-day in vBulletin, and it's serious enough that Def-Con's forums were taken down pro-actively ... - http://www.computerworld.com/s/article/9244109/Hackers_use_zero_day_vulnerability_to_breach_vBulletin_support_forum
• If you use SnapChat to send questionable selfies hoping they'll just evaporate...you're in for a bad time - http://www.sidhtech.com/news/snapchat-android-hack-iphone/10024107/

In this episode...

• We revisit some of the topics Eric & I talked about nearly 2 years ago at ISSA International, Baltimore.
• Eric discusses the paradigm shift that needs to happen in security
• We talk about shifting resources (in the defensive) from "everything" to something more reasonable
• Eric and I discuss how CISOs must re-allocate resources to survive in a post-breach reality

Guest

• Eric Cowperthwaite ( @e_cowperthwaite ) - Vice President, Advanced Security and Strategy at CORE Security, a Boston-based security vendor. CORE is the leading provider of predictive security intelligence solutions for enterprises and government organizations. We help more than 1,400 customers worldwide preempt critical security threats throughout their IT environments, and communicate the risk the threats pose to the business. Our patented, proven, award-winning enterprise solutions are backed by more than 15 years of applied expertise from CoreLabs, the company's innovative security research center.
  
  Eric was formerly the CSO of Providence Health & Services, a healthcare delivery organization with $12.5 billion in revenue, 32 hospitals and more than 65,000 employees, headquartered in Seattle, WA. 

Hey all - Raf here and I wanted to thank James for flying solo as my wife and I celebrate the brith of Niccolai and Isabella our new twins! I'll be back in our next episode...

Topics Covered

• The buzz over calling yourself a 'hacker' - http://www.theguardian.com/technology/2013/oct/24/hacker-computer-seized-us-open-source (Raf's note - I personally think the way this has been spun is largely to gain clicks/readers, it was very well analyzed here - http://theprez98.blogspot.com/2013/10/omg-call-yourself-hacker-lose-your-4th.html
• A follow-up on Dick Cheney's pacemaker paranoia - http://www.dotmed.com/news/story/22298
• Big name limo service hacked, discloses info on big-name clients - http://krebsonsecurity.com/2013/11/hackers-take-limo-service-firm-for-a-ride/
• Look out, hackers may be targeting SAP users - http://www.computerworld.com/s/article/9243727/New_malware_variant_suggests_cybercriminals_targeting_SAP_users?taxonomyId=17
• Java patching lagging, attackers exploiting, story at 11 - https://www.securityweek.com/java-attacks-jump-user-patching-lags-kaspersky-lab
• It just got real. Real 2010, that is, as Yahoo unleashes bug bounty program - http://www.tripwire.com/state-of-security/top-security-stories/yahoo-unleashes-new-bug-bounty-program/

Special thank you to the US District Attorney's office for the Southern District of California for a fantastic interview and for letting us pick Sabrina's mind for the podcast... 

In this episode...

• Hackers, carders, and the disturbing trend of them pairing up with the traditional mafia
• The challenge of VPSes in cyber-crime
• Evangelizing the truths about cyber-crime to businesses, average person
• An insight into the way that 'bad guys' specialize in the criminal underground
• An insight into (bottom-up) investigative models available to law enforcement, as it pertains to hackers
• Are cyber criminals fleeing or hacking from non-extradition countries?
• The delicate dance of involving the government in a hacking or breach case
• Seeking the white whale - an organization that hasn't been breached (yet)
• 3rd party data sharing and your privacy - do you have any left?

Guest

• Sabrina Feve - Sabrina is an Assistant US Attorney (AUSA) for the Southern District of California, specializing in hacking and cybercrime cases.