In this episode

• DREAMR: What is it, and why is it so important to Enterprise Security today?
• Examples of aligning business and security requirements and winning hearts & minds
• How does a security organization get around "see I told you so!" security
• An example of how to make the framework work for you
• We discuss the importance of listening, then listening, then listening some more
• Jessica and Ben explain "accomodating" the business
• Jessica and Ben give us "One critical piece of advice"

Guests

• Jessica Hebenstreit ( @secitup ) - Jessica Hebenstreit has been a member of the Information Security community for over a decade. Having worked on both the technical and business sides of various enterprises, Hebenstreit has a unique perspective that allows for more understanding when balancing competing interests. She is a successful and results-oriented Information Security expert with hands-on information security experience in security monitoring, incident response, risk assessment, analysis, and architecture and solution design. She holds the following certifications, CISSP, GIAC-GSEC, CRISC and SFCP. In March 2012, she earned her Masters of Science in IT (MSIT) specializing in Information Assurance and Security. She is currently the Manager of Security Informatics - Threat Analysis and Response at Mayo Clinic.  She is building a smart response architecture for incident response from the ground up.
• Ben Meader ( @blmeader ) - Ben Meader is a Senior Security professional with a unique blend of technical acumen and business know-how. Meader’s security thought leadership has been battle tested at multi-national firms over the past 13 years ranging from network security and operational security to performing detailed risk assessments and implementing a firm-wide privacy program. He remains up to date in both security and business having received his M.B.A. from DePaul University and has a current CISSP. He is also active in the entrepreneurial community and is Co-Founder of a mobile application company on the side. His education and range of experiences in working with firms both large and small have given him a unique perspective on the role of security within different business cultures and how competing philosophies can collide.

Topics covered

• Hacker flees US for non-extradition country - why?
  • http://blog.erratasec.com/2014/09/hacker-weev-has-left-united-states.html
  • http://www.newrepublic.com/article/117477/andrew-weev-auernheimers-tro-llc-could-send-him-back-prison
• Class-action lawsuit againt Onity lock company ("easily hackable hotel lock") rejectd by judge
  • https://www.techdirt.com/articles/20140903/14134528408/onity-wins-hotels-that-bought-their-easily-hacked-door-lock-cant-sue-according-to-court.shtml
  • http://www.extremetech.com/computing/133448-black-hat-hacker-gains-access-to-4-million-hotel-rooms-with-arduino-microcontroller
  • http://www.forbes.com/sites/andygreenberg/2012/12/06/lock-firm-onity-starts-to-shell-out-for-security-fixes-to-hotels-hackable-locks/
• Home Depot - the dirt start to fly
  • http://arstechnica.com/security/2014/09/home-depot-ignored-security-warnings-for-years-employees-say/
  • https://privacyassociation.org/news/a/following-breach-report-shows-home-depot-has-105-million-in-coverage/
  • https://privacyassociation.org/news/a/2013-05-01-supreme-court-wiretap-ruling-upholds-stringent-standing-to-sue/

In this episode

• Separating the hype from reality of the Chinese hacking threat
• The escalation of economic tensions between US & China, over hacking
• What is the advice for the enterprise regarding state-sponsored attacks?
• The challenge with the uni-directional intelligence flow for government/enterprise
• The challenge with nation-state hacking of critical infrastructure
• The worst-case scenario (quietly happening?)
• Directly addressing the various APT reports (specifically APT1)
• Does a cyber attack warrant a kinetic response?
• Attribution is hard. Is it more than black-magic, and is anyone doing it right?
• The great disconnect between the keyboard jockey and real-life consequences

Guest

• Bill Hagestad II ( @RedDragon1949 ) - Internationally recognized cyber-intelligence & counter-intelligence professional. Technical, cultural, historical and linguistic analysis of foreign nation state cyber warfare capabilities, intents & methodologies...
  Listed on Forbes Magazine as : "20 Cyber Policy Experts To Follow On Twitter". Bill can be found on LinkedIn at - www.linkedin.com/in/reddragon1949

Topics covered

• Apple has been making news, issuing guidance, and refuting a hack - all around iCloud
  
  • http://www.padgadget.com/2014/09/03/apple-warns-developers-not-to-store-health-data-in-icloud/
  • http://www.padgadget.com/2014/09/03/apple-says-celebrity-photo-leak-was-not-due-to-icloud-breach/
  • http://www.cio-today.com/article/index.php?story_id=94027
• HealthCare.gov was hacked, but no worries it was only a test server and no 'data was taken/viewed'. Does this sound like something you've faced in the enterprise ... hmmmm?
  If only there was someone warning them about the insecurity of that site! h/t to Dave Kennedy for standing up and taking political heat.
  • http://www.nationalreview.com/article/387182/healthcaregov-hack-reminiscent-earlier-vermont-exchange-attack-jillian-kay-melchior
  • http://www.computerworld.com/article/2603929/healthcare-gov-hacked-if-only-someone-had-warned-it-was-hackable-oh-wait.html
• Home Depot apparently has suffered a massive breach, much like Target. Interesting? Or ho-hum? (did you Buy The Dip? h/t @DearestLeader )
  • http://seekingalpha.com/article/2478055-home-depot-potential-data-breach-may-have-presented-a-good-opportunity-to-buy-the-stock
  • http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/
  • http://www.csoonline.com/article/2601082/security-leadership/are-you-prepared-to-handle-the-rising-tide-of-ransomware.html
• Norway's Oil & Gas industry is now the target of hackers, seeking to get intelligence on production, exploration - and that all-important state-sponsored competitive edge.
  • http://www.thelocal.no/20140827/norwegian-oil-companies-hacked
• Google is deprecating (in a big way) the use of SHA-1 in certificate way ahead of the set schedule. Is this "Google the game-changer" or "Google the bully"? You decide - tweet us at #DtR
  • http://www.csoonline.com/article/2602108/security-leadership/do-you-agree-with-googles-tactics-to-speed-adoption-of-sha-2-certificates.html
  • http://www.zdnet.com/google-accelerates-end-of-sha-1-support-certificate-authorities-nervous-7000033159/

In this episode

• We discuss the largest challenges in the state government sector
• Brian discusses balancing the need for openness versus security/secrecy
• Phil talks about the challenge of balancing policy with agency needs in state government
• Michael asks how state-level security justifies and prioritizes security requirements
• Raf asks how policy is created that can be both effective, and broad
• The group talks about metrics, policy implementation, and showing value to protecting citizens
• The guys answer "What's the best piece of advice you've gotten in your career?

Guests

• Philip Beyer ( @pjbeyer ) - Philip is a security professional with more than 12 years progressive experience. Currently leading information security for an organization as a function of business goals and risk profile. Consummate generalist with background in multi-client consulting and specialization in risk management, incident handling, security operations, software assurance (OpenSAMM, BSIMM), and technical compliance testing (ISO 27002, PCI-DSS, HIPAA). Confident leader, problem solver, relationship builder, technical communicator, public speaker, presenter, and security evangelist. Fast-paced learner with a strong work ethic and self-starter attitude.
• Brian Engle ( @brianaengle ) - Currently the Chief Information Security Officer & Texas Cybersecurity Coordinator who is a results-oriented executive and leader with over 20 years of progressive experience in Information Technology and Information Security across the government, healthcare, manufacturing, financial services, technology, telecommunications and retail verticals. His specialties include risk management, project management, and cost effective delivery of appropriate security solutions within organizational risk tolerances. Consummate generalist with a background in effective incident management, security and network operations, vulnerability and threat management, as well as technical compliance evaluation and gap analysis.