Down the Security Rabbithole Podast

Mon, 28 July 2014

Topics covered

Certificate pinning back in the spotlight with the GMail iOS app having some difficulties, but there is a bigger issue here. We discuss.
- http://securityaffairs.co/wordpress/26577/hacking/gmail-app-flaw-mitm.html
Nearly 3 years later, the NASDAQ hack attributed to FSB/Russian 'state sponsored' hackers, via 2 "zero day malware'. Highlighting need for attribution, common language, and other issues in security.
- http://www.infosecurity-magazine.com/view/39397/nasdaq-hackers-used-two-zero-days-but-motives-a-mystery/
Cyber insurance - is this a forcing function to improve overall security, or yet another carpet to sweet security problems under?
- http://www.reuters.com/article/2014/07/14/us-insurance-cybersecurity-idUSKBN0FJ0B820140714
A judget has just ruled that your "GMail account" has the same legal (or lack thereof) protections as a hard drive you own. Dangerous precedent, or nothing new?
- http://nakedsecurity.sophos.com/2014/07/22/your-gmail-account-is-fair-game-for-cops-or-feds-says-us-judge/
- also relevant - http://nakedsecurity.sophos.com/2013/08/14/google-says-gmail-users-cant-expect-privacy/

Not discussed, but interesting reads:

"Operation Emmental" is an assault against 2FA and online banking
- http://secureidnews.com/news-item/operation-emmental-attacks-online-banking-and-2fa/
Looks like healthcare is next on the list of verticals targetted... filed under things we all suspected, but will soon see
- http://healthitsecurity.com/2014/07/24/how-healthcare-can-learn-from-retails-it-security-mistakes/ h/t to Eric Cowperthwaite

Mon, 21 July 2014

In this episode

Jim Tiller - a few things you probably didn't know?
In the last 15 years, what has changed, and what hasn't?
Why isn't security moving forward?
"Complexity is the camouflage for bad guys" -Jim
Chasing the moving line of 'security'
"Fixing the airplane as it flies"
How do enterprise security organizations push away from playing 'prevent' permanently?
Fundamentals, fundamentals, fundamentals ... you're still failing
What things are CISOs doing that they're NOT right now?
Where will security be, as a discipline, in 10 year?

Guest

Jim Tiller ( @Real_Security ) - Jim has been in the security industry since the very early 90’s and has continued his mission in working with individuals, groups, organizations, and companies around the world to collaborate, develop, and implement business aligned security strategies and technologies. Through his career he's worked with and in numerous organizations for the advancement of information security technologies, practices, and standards and through these activities help organizations achieve their goals. Find Jim on LinkedIn here.

Mon, 14 July 2014

Topics covered

Florida Information Protection Acf of 2014 is in the books, and it brings "sweeping changes" to the data breach disclosure process in Florida. Good thing or bad? You decide
The DoJ has nabbed a 'prolific hacker'... a Russian national. Russia calls it kidnapping. Tensions flare. Again.
- http://mashable.com/2014/07/08/russian-man-hacking-retailers/
Chinese man charged with industrial espionage
- http://arstechnica.com/tech-policy/2014/07/chinese-businessman-charged-with-hacking-boeing-and-lockheed/
US Banks are calling for a "Cyber War Council" (so much wrong here, it's incredible...)
- http://www.businessweek.com/news/2014-07-08/banks-dreading-computer-hacks-call-for-cyber-war-council#p2
The ultra-ultra-legacy code problem and why we're not getting security any higher up the ladder any time soon
- http://www.businessweek.com/articles/2014-06-25/the-talent-that-keeps-your-50-year-old-software-running-is-retiring-dot-now-what
Payroll processing company Paytime was hacked and breached. But in the midst of the rush to file law suits, at least one company is pledging to stand by Paytime in this rough time... sanity prevails?
- http://www.witf.org/news/2014/07/at-least-one-company-stands-by-paytime-after-data-breach.php

Mon, 7 July 2014

In this episode

Who is Dan Geer (just in case you live in a cave and don't know)
Dan's definition of security - "The absence of unmitigatable surprise"
What exactly is the pinnacle goal of security engineering?
Responsibility, liability and when software fails as a result of security issues
In a liability lawsuit - "What did you know, when did you know it?"
The fraction of the population who could sign an "informed consent" is falling - so now what?
Why ICANN is actually making all of this so much worse
What do we do about "abandoned software"?
Fixing security bugs in software is a tricky business...good, bad, worse
Are things getting better [in security]?
Dan talks about a "diversity re-compiler" and how we can make the exploit writer's job harder
(from Jason White) -What "low hanging fruit" issues are we simply not addressing properly right now?
(from Jason White) If the Internet were being built from scratch today, what would you keep and throw away?

Guest

Dan Geer - Dan Geer is a computer security analyst and risk management specialist. He is recognized for raising awareness of critical computer and network security issues before the risks were widely understood, and for ground-breaking work on the economics of security.

Geer is currently the chief information security officer for In-Q-Tel, a not-for-profit venture capital firm that invests in technology to support the Central Intelligence Agency.

In 2003, Geer's 24-page report entitled "CyberInsecurity: The Cost of Monopoly" was released by the Computer and Communications Industry Association (CCIA). The paper argued that Microsoft's dominance of desktop computer operating systems is a threat to national security. Geer was fired (from consultancy @Stake) the day the report was made public. Geer has cited subsequent changes in the Vista operating system (notably a location-randomization feature) as evidence that Microsoft "accepted the paper." --http://en.wikipedia.org/wiki/Dan_Geer