In this episode...

• Dave Kennedy wraps up DerbyCon 2013, and gives us the statistic you don't want to tell your management
• Dave announces the top secret guest for DerbyCon 4
• Chris & Gabe discuss risk modeling using REAL automated tools
• Gabe introduces us to his concept of using a 'big data' approach to risk modeling
• We discuss risks, network segmentation, and other things you're doing wrong

Guests

• Dave Kennedy ( @Dave_Rel1k ) - Dave Kennedy is the founder of TrustedSec, and the brain behind DerbyCon.
• Chris G ( @SecbitChris ) - Chris is one of the brains behind the SecuraBit podcast
• Gabe B ( @gdbassett ) - Gabe is an industry expert

I want to thank Mr. Josh Corman ( @JoshCorman ) for guest-commentating today's episode, and lending his expertise and industry leadership point of view.

Topics Covered

• UK's GCHQ has been using Prism (Courtesy of the NSA) to spy on you ... the revelation continues - http://www.telegraph.co.uk/news/uknews/law-and-order/10106507/GCHQ-has-been-accessing-intelligence-through-internet-firms.html
• Wisconsin trucker vs. Koch Industries, just what is a "direct loss"? - http://www.kfdi.com/news/local/Wisconsin-man-pleads-guilty-in-cyber-attack-on-Koch-Industries-223365221.html
• iPhone, fingerprint reader, #IsTouchIDHacked - http://www.forbes.com/sites/markrogowsky/2013/09/22/iphone-fingerprint-scanner-hacked-should-you-care/
• Can the FTC (and other government entities) go after companeis who fail to do reasonable security? (also, what does that mean?) - http://www.computerworld.com/s/article/9242531/FTC_lacks_data_breach_authority_says_accused_medical_lab?taxonomyId=17&pageNumber=2
• The gang that popped Bit9 is at it again, IE 0-day in the wild - http://www.computerworld.com/s/article/9242570/Security_org_raises_Internet_threat_level_after_seeing_expanded_IE_attacks

More information on The Cavalry

The talk: "The Cavalry Isn't Coming: Starting the Revolution to FSCK it all!"

The video of the more mellow, smaller BSides "warm-up before DEF CON 21" is here: http://www.irongeek.com/i.php?page=videos/bsideslasvegas2013/1-2-2-the-cavalry-isnt-coming-starting-the-revolution-to-fsck-it-all-nicholas-j-percoco-and-joshua-corman

Twitter: @iamthecavalry

URL: http://iamthecavalry.org

email info@iamthecavalry.org

google group: https://groups.google.com/d/forum/iamthecavalry

Josh Corman's Bio:

Joshua Corman is the Director of Security Intelligence for Akamai.  Mr. Corman’s cross-domain research highlights adversaries, game theory and motivational structures. His analysis cuts across sectors to the core security challenges and toward emerging technologies and shifting incentives. 

A staunch advocate for CISOs, Corman also serves as a Fellow with the Ponemon Institute, on the Faculty for IANS, co-founder of Rugged Software and was a 2009 Top Influencer of IT in NetworkWorld. Corman received his bachelor’s degree in philosophy, graduating summa cum laude, from the University of New Hampshire.

For those of you unfamiliar with the event, HP Protect is the premier event of the year for the HP Enterprise Security products and services organization, held to bring customer practitioners, industry experts, products/services managers and their support specialists together to not only solve real-world problems but to also help set the course for the next year. If you've not had a chance to attend the event and you're an HP customer, or you're interested in the event - check out the HP Protect website.

I was a guest at the conference this year and had an amazing opportunity to sit down in 3 separate sessions with a serviceEpis provider, a practitioner, and 2 vendor-partners and talk real-world security... 

Episode 3 - Vikas Bhatia (CEO of Kalki Consulting) and Anton Goncharov (Managing Principal of MetaNet, LLC) - In this discussion, we just barely scratched the surface on the challenges SMEs face with integrating security into business processes and developing security solutions on a shoestring. This discussion focuse entirely on processes and the need for business integration and insight - and is likely the starting point for many further conversations to come.

For those of you unfamiliar with the event, HP Protect is the premier event of the year for the HP Enterprise Security products and services organization, held to bring customer practitioners, industry experts, products/services managers and their support specialists together to not only solve real-world problems but to also help set the course for the next year. If you've not had a chance to attend the event and you're an HP customer, or you're interested in the event - check out the HP Protect website.

I was a guest at the conference this year and had an amazing opportunity to sit down in 3 separate sessions with a serviceEpis provider, a practitioner, and 2 vendor-partners and talk real-world security... 

Episode 2 - Wasif Shakeel, Program Director Information Security, General Dynamics - Wasif and I discovered that we have entierly too much in common, and talked about the need for a sane, process and measurement approach to security and handling the "needle in a haystack" problem many Security Operations Centers are faced with.

For those of you unfamiliar with the event, HP Protect is the premier event of the year for the HP Enterprise Security products and services organization, held to bring customer practitioners, industry experts, products/services managers and their support specialists together to not only solve real-world problems but to also help set the course for the next year. If you've not had a chance to attend the event and you're an HP customer, or you're interested in the event - check out the HP Protect website.

I was a guest at the conference this year and had an amazing opportunity to sit down in 3 separate sessions with a serviceEpis provider, a practitioner, and 2 vendor-partners and talk real-world security... 

Episode 1 - Ian Beckford, Senior Product Manager, TELUS Security Solutions - Ian and I had a lively discussion around the service-provider use of the analytics and network security devices (currently ArcSight and TippingPoint) to provide customers with security solutions which benefit them, while remaining cost effective.

In this episode...

• Mike explains once and for all how the BSides namesake came to be
• We talk about how the industry has evolved over the last 10+ years
• Mike dispenses a little of his philosophy on how to better the industry
• We talk burnout and why it exists, and possibly how to get through it

Guest

• Mike Dahn ( @MikD ) - Mike Dahn is one of the original co-founders of the Security BSides conference many of you have attended, spoken at, or heard of. In addition to that, Michael Dahn is an information security and organizational design strategist responsible for the management of data strategies, project engagements, and cost modeling. With over 12 years of information security experience, Mr. Dahn has managed teams of 50 people and budgets of up to $30m annually for Fortune 500 companies. Today he focuses on leading mobile security strategies and industry relations.
  
  He is an industry leader in regulatory compliance issues who previously worked for Visa, Pricewaterhouse Coopers, and Verizon Business, created PCI training for and trained over 10,000 assessors, merchants, and vendors globally. He contributes regularly to the continued development of the global PCI guidelines.
  
  During his tenure Mr. Dahn has presented to a variety of financial and banking associations (FDIC and NCUA), including regulatory bodies such as the PCI Council, and information security groups on topics including mobile security, compliance, information security programs, auditing and network security, and computer hackers. He has been published in several news articles and TV spots on information security.

Today I had the pleasure of sitting down with one old friend, and one new. As a speaker at the HTCIA International conference, and the CISO Summit - I had the opportunity to gain some valuable insight, meet lots of excellent leaders, and force some new relationships. As a wonderful side-effect I had the pleasure of sitting down with Mike Murray of Mad Security, and Vince Skinner an attendee of the conference and security leader of his enterprise.

We talked about a range of topics from history of the information security industry, to our experiences and the current lack of direction and strategy in much of the enterprise space. We also discussed some topics that dated us quite a bit ...so don't judge!

Guests

• Mike Murray ( @MMurray ) - Mike is the co-founder of Mad Security, an industry veteran and mentor, and an all-around fantastic friend.
• Vince Skinner ( @SkinnerVince )  - Vince is the Informatino Security and Business Continuity Manager, AVP of D.A. Davidson & Co.

I want to thank our guests - Beau Woods and Joe Knape for joining us this morning. It was great to have these two well-versed commentators on the show ...vote with your downloads folks - if you want to make this a regular thing leave us a comment!

Topics Covered

• RedHack 'hacks' Turkish police website, stops border traffic? - http://www.hurriyetdailynews.com/redhack-hacks-turkish-police-website-as-border-traffic-grounds-to-a-halt.aspx?pageID=238&nID=53904&NewsCatID=341
• A few thoughts on the NSA/Crypto from Matthew Green's blog - http://blog.cryptographyengineering.com/2013/09/on-nsa.html
• The FTC settles with TRENDnet (the webcam shouting obscenities at the 2yr old story) - http://www.bostonglobe.com/business/2013/09/04/ftc-settles-complaint-over-hacked-security-cameras/uYjAuRcb4uCz51Zt1HSGbP/story.html
• Citi ordered to pay $10.86/record, more harm than good - http://www.infosecurity-magazine.com/view/34328/citi-ordered-to-pay-55k-to-connecticut-over-2011-data-breach
• NY Times hacked (again) but this time it's DNS ...DNS is baaaaack - http://www.thestreet.com/story/12020336/1/new-york-times-website-hacked-in-likely-malicious-external-attack.html
• "This is why we can't have nice websites" - http://www.reddit.com/r/PHP/comments/1l7baq/creating_a_user_from_the_web_problem/

Other Links

• FTC FAQ (Thanks to Beau Woods) - http://business.ftc.gov/documents/bus35-advertising-faqs-guide-small-business

Every once in a while this podcast has a guest who makes us truly feel blessed to be doing this - Rob Dubois is one of those people. If you don't know anything about Rob, go read his website, listen to this podcast and check out his book. He is a real American hero, a fantastic human being, and a true patriot. On behalf of James and I - I want to extend a hearty thank you for the time Rob spent, and wisdom he's imparted.

In this episode...

• Rob Dubois on being a 'badass'
• the parable of the blind wise men and the elephant
• be reachable and teachable (be a RAT)
• the collision of boots, bits, and threats
• the arrogance of security professionals are a weakness
• fail early, fail often - learn from it
• why plans are useless, and planning is essential
• a George Carlin quote, and a "The Office" reference
• a brutal lesson from PoW training

Guest

• Rob Dubois ( @RobDubois ) - Rob is currently best-known for his book "Powerful Peace - A Navy SEAL's Lessons on Peace from a Lifetime at War". I can't possibly do Rob justice but to call him a true, powerful, "badass"... check him, his book, and his powerful message out for yourself on his blog SEAL of Peace.