Synopsis

LIVE from day 2 of the ISSA International conference 2012, in Anaheim, California I cornered Eric Cowperthwaite after a much-anticipated year-long wait... and we talked about his prediction that in the next 2 years many of the traditional IT employees will be employed as either business-IT resources in the enterprise, or IT-technical resources at an IT outsource or cloud provider... Eric's predictions tend to be right on the money so it'll be interesting if some of the things he advocates in this microcast come true!  Only time will tell.

Guest

• 
  Eric Cowperthwaite - Eric is the Chief Security Officer at Providence Health & Services, and a strong advocate of pragmatic security.  Eric has a long history from Army Recruiter, to outsource services delivery with EDS, to his many years of service to the ISSA and Providence Health & Services.  In addition to being a good friend and colleague, Eric has a snarky sense of humor, and tends to be not afraid of speaking his mind ... and as it turns out his predictions become reality in the near future.  Eric can be found on Twitter as @e_cowperthwaite, and on LinkedIn.

Syhopsis

When I caught up with these two gentlemen in Amsterdam over the week of Black Hat 2012, I knew we wouldn't run out of things to talk about!  We ended up chatting for quite some time, and I think you'll find this conversation interesting from hearing of David's recent work with Oracle, and Jim's perspective on "the fix"... I kept the conversation going and am probably at last partially responsible for how long this podcast ended up being.  It's well worth the time, in my opinion, as we cover the following topics:

• Attacking Oracle (David's talk had to be shelved, but he talks about ways to attack Oracle via putting a string into a numeric query - by manipulating the meta-environment)
• Jim & David talk about how to do sane SQL Injection protection (bind everything!)
• David talks about some contrived ways of hacking Oracle databases, that are 'outside the business logic' and explains why validation is still important
• Jim brings up structural validation of inputs (useful white-listing)
• David brings up that his exploits from 2007 are STILL working in 2012 - terrifying
• "Parameterize it, or jeopardize it" - Jim's campaign to rid the world of SQL Injection
• David talks about unconventional database forensics that identify attacks via weblogs
• Vendors have upped their game to protect applications, developers are still writing bad code
• Jim Manico "We are entering the golden age of hackers" ... does this mean better security?!
• David discusses how if MS had stopped development of NEW features, WinNT4 would be 'secure' by now... but innovation & features will continue to drive forward - security suffers
• Jim asks "does the [development] framework of the future, consider security as a built-in?"

Guests

• Jim Manico - One of the people who holds OWASP together, Jim is an enthusiastic espouser of the Web App Security word.  You can find him providing training, practical advice, and code knowledge all over the place, particularly for the OWASP organization.
• David Litchfield - David has been taking Oracle to task over their claims of database security for years, and continues to be a driving force behind penetration testing, database forensics, and all things Oracle security.

Synopsis

This week we went free-form with two of my favorite InfoSec insiders ...people you probably follow on Twitter but can't quite place.  Here are some of the topics covered this week:

• The Apple UDID theft - what really happened, why, and what more is there to this story?
• Information vs. DISinformation...the battle for online trust
• Speaking of distrust - where do you go post-breach?
• InfoSec intelligence is a lot harder to do than just reading mailing lists and Twitter, there's a ton to this (scratching the surface)
• Change management's impact and possible salvation for IT and InfoSec
• Legacy systems and why they are the ball and chain, and why we can't nuke them
• The user ... how do we get past just hating on the user in InfoSec?

Guests

• @DarthNull - David is a mobile hacked with Intrepidus Group, and active puzzle-solver extraordinaire
• @InfoJanitor - He's a long-time InfoSec guy, working for a 'big company' ...and if he told you more than that, well ...you know.