Special thanks to Michael Santarcangelo ( @catalyst ) for stopping by the show and guest-hosting with James and I! We had fun, and I think you'll all enjoy Michael's perspective and humor.

Topics Covered

• Nieman Marcus breach - all new, same as before, or is it? - http://www.wired.com/threatlevel/2014/01/neiman-marcus-hack/
• Coca-Cola loses laptops ... sort of ... but no worries, no evidence of wrongdoing - http://www.ajc.com/news/business/coca-cola-tells-thousands-of-employees-of-security/nc2NB/
• Breach over at Microsoft, law enforcement documents "likely stolen", but what does that really mean? - http://www.pcworld.com/article/2091480/microsoft-says-law-enforcement-documents-likely-stolen-by-hackers.html
• The (San Jose) police want to use your home surveillence system cameras, I'm not kidding - http://news.cnet.com/8301-17852_3-57617809-71/police-want-to-use-your-home-security-cameras-for-surveillance/

In this episode

• Did the Target/Neiman/? breach finally create a catalyst for change?
• The card system, payment processing infrastructure clearly wasn't designed with defensibility in mind ... who should be changing that?
• Are today's fraud rates finally getting high enough such that card processors, issuers, banks need to depart from the status quo?
• Are the days of "zero fraud liability" to the end consumer coming to an end?
• What about chip & pin? Is the risk less?
• What kinds of pains will the industry go through to make security on payment systems better?
• How is the commercial payments industry different from the consumer?
• Do end users of credit accounts ultimately care about breaches?

Guests

• Laura Claytor ( @the.hgic ) - Laura is a security specialist and veteran within a large US-based banking organization, and is based in the southwest United States
• Alfred Portengen - ( @alfredportengen ) - Alfred has a deep bredth of experience in architecture and security specialty within a multi-national banking organization, he is based in the Netherlands

I can't believe it's 2014 already, and we're rolling through our 3rd calendar year! As we grow and you "regulars" mount, James and I want to thank you for listening, bookmarking, sharing and talking about the podcast. Your patronage has really made a us smile, and you're the reason we do this.

Topics covered

• Reuters: Retail community may be ready for a change in the payment card system and processes - http://uk.reuters.com/article/2014/01/13/uk-target-databreach-retailers-idUKBREA0B01A20140113
• More Snowden fallout: French/UAE Intel satellite deal may be scuttled because of US-made components - http://www.defensenews.com/article/20140105/DEFREG04/301050006
• Ransomware CryptoLocker's uglier, meaner cousin now available for $100... look out! - http://arstechnica.com/security/2014/01/researchers-warn-of-new-meaner-ransomware-with-unbreakable-crypto/
• Schneier: "The Internet of Things" is very vulnerable ...and there's no good way to patch it all - http://www.wired.com/opinion/2014/01/theres-no-good-way-to-patch-the-internet-of-things-and-thats-a-huge-problem/
• Lawsuit filed in the "FaceBook reads my private messages" case - http://money.cnn.com/2014/01/03/technology/facebook-privacy-lawsuit/

In this episode

• Chris Wysopal - who is that masked man?
• Putting some reality to the state-sponsored backdoors (Huawei) and supply-chain compromise
• The risks coming through the door with the products you buy
• The case for setting up an independent testing lab for mitigating 'backdoor' accusations
• Chris does an interesting assessment on software security practices in the enterprise
• Chris discusses holding your vendor to the same standards you hold yourself
• What does it mean that enterprises are doing a "good job" in SwSec
• Chris goes there, open-source components as part of supply chain risk
• James asks "How do smaller buyers leverage scale to hold their suppliers accountable?"
• Why do we still see SQL Injection?! Are we ever going to get rid of it?

Guest

• Chris Wysopal ( @Weldpond ) - Chris is the Founder, CTO and CISO of VeraCode, a company dedicated to software security as-a-service. Chris has a long and storied history in the security industry dating back to L0pht Heavy Industries. His bio and profile can be found on LinkedIn.