Special thank you to the US District Attorney's office for the Southern District of California for a fantastic interview and for letting us pick Sabrina's mind for the podcast... 

In this episode...

• Hackers, carders, and the disturbing trend of them pairing up with the traditional mafia
• The challenge of VPSes in cyber-crime
• Evangelizing the truths about cyber-crime to businesses, average person
• An insight into the way that 'bad guys' specialize in the criminal underground
• An insight into (bottom-up) investigative models available to law enforcement, as it pertains to hackers
• Are cyber criminals fleeing or hacking from non-extradition countries?
• The delicate dance of involving the government in a hacking or breach case
• Seeking the white whale - an organization that hasn't been breached (yet)
• 3rd party data sharing and your privacy - do you have any left?

Guest

• Sabrina Feve - Sabrina is an Assistant US Attorney (AUSA) for the Southern District of California, specializing in hacking and cybercrime cases.

In this episode

• We get a peek into the first member of English Royalty that we've ever had on the podcast
• Baroness Neville-Jones discusses the difficulties in cybersecurity at the government level
• We discuss the challenges of policy, compliance and implementing real-life security
• The Baroness discusses her efforts to raise both the awareness and collective security of business
• The Baroness discusses a bit about critical infrastructure protection
• I ask the uncomfortable question in the wake of the Snowden disclosures - privacy vs. security...

Guest

• Rt Hon Baroness Neville-Jones - Baroness Neville-Jones is a long-time political figure in the UK Parliament, House of Lords. She recently retired from public service and now focuses on the public-private partnership for cybersecurity in the UK. She has an amazing history and rather than try to summarize it here, I simply point you to her biography page at http://www.conservatives.com/People/Peers/Neville-Jones_Pauline.aspx

Thanks to Josh Corman for joining us this morning ... always nice to have Josh's experience and brain power on the show.

Topics Covered

• Gargantuan Oracle CPU (Critical Patch Update) including -51- Java security fixes! - http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html
• Huawei calling for "independent cybersecurity assurance lab" framework, an interesting but difficult thing - http://www.informationweek.com/security/application-security/huawei-proposes-independent-cybersecurit/240162840
• Dick Cheney, fearing an assassination attempt, had wireless pacemaker removed in 2007 - http://www.theguardian.com/world/2013/oct/19/dick-cheney-heart-assassination-fear
• Chesapeake hospice suffers breach, but there's a lesson in the tragedy - http://www.hispanicbusiness.com/2013/10/19/hospice_of_chesapeake_shut_down_computer.htm
• NPI research shows companies will overpay $10.1 billion for IT security solutions in 2013, worse in 2014 - http://www.prweb.com/releases/2013/10/prweb11239951.htm
• Minor Verizon security bug, issues with coordinated disclosure, fix timelines, and the much bigger white elephant in the room - http://prvsec.com/verizon-wireless-message-detail-disclosure.html

Hat-tips this week go to...

• Brian Katz ( @bmkatz ) because we borrowed your 'crapplications' example
• Alex Hutton ( @AlexHutton ) - Josh borrowed your "Alex head asplode"
• Wendy Nather ( @451Wendy ) because we mentioned your 'security poverty line' concept

In this episode...

• James and I host legitimate Polynesian royalty (a princess....) really!
• Katie gives us the skinny on Microsoft's 10 year progression to get to a bug bounty program
• We discuss the merits of bug bounties and execution in a very large enterprise
• Katie gives us as many details as she can about the recent $100,000 payout
• Much... much ... more!

Guest

• Katie Moussouris ( @k8em0 ) - Katie runs the Security Community Outreach and Strategy team for Microsoft as part of the Microsoft Security Response Center (MSRC) team to help drive crucial elements of our security community strategy effort. She is a Senior Security Strategist Lead, and let's not sell her short - she is royalty!
  She created and drove the first ever Microsoft security bounty programs (www.microsoft.com/bountyprograms). Which received 18 vulnerabilities and a new attack technique that will help Microsoft build stronger defenses that will protect the entire platform from this new class of attack.
  She serves as lead subject matter expert in the US National Body for the ISO work item 29147 "Vulnerability Disclosure", scheduled for publication in 2013, and does countless other efforts associated with the ISO standards body and various other industry groups.
   

Big thanks to the soon-to-be-regular peanut gallery ... @JoeKnape and @BeauWoods for jumping in this morning and breaking it down with James and I.

As a personal message to those of you who listen and our community - please ...remember we all live in a giant glass house, and throwing rocks is a bad, bad idea. I've said it before and I'm looking right at the media for this one (ahem...) - unless you've been in a high-stress environment and have successfully thwarted every attack, please don't go trying to personally attack those out there who work hard at it every day. It just makes you look like an idiot. Nobody wins when we name and shame and attack people personally. Remember that when it's your turn to stand in the spotlight.

Topics Covered

• Adobe got popped. Bad. ~2.9 users' information, encrypted credit card details, source code. The only thing worse than this story is the kind of media trolls it brought out... - http://www.computerworld.com/s/article/9242963/Hackers_steal_data_on_2.9_million_Adobe_customers?taxonomyId=82&pageNumber=2 and this unfortunate mess from Richi Jennings https://plus.google.com/117220625678034723010/posts/EjP4JjKFd6w
• 13 Anonymous 'members' indicted for DDoS attacks - http://www.computerworld.com/s/article/9242969/US_indicts_13_Anonymous_members_for_DDoS_attacks
• LA schools gave out "locked down" iPads. Students circumvented. Hilarity ensued. http://blogs.computerworld.com/mobile-security/22929/what-la-schools-forgot-boneheaded-ipad-hand-out
• Senior Iranian Cyber official killed (assasinated?) - http://www.matthewaid.com/post/63207233044/the-mystery-surrounding-the-killing-of-a-senior-iranian
• Proof that the fist people to get paid should be the ones who hold the keys to your doors - http://nycfreshmarket.com/ (as long as the page stands, then check out the tweet I re-posted https://twitter.com/Wh1t3Rabbit/status/387076594407575552 )

So ... does anyone actually read these? If so, let me know on Twitter? Hashtag #DtR