In this episode

• Chris attempts to explain the consternation with 'security research' right now
• Kevin gives his perspective and why he doesn't quite understand why people don't see they're "breakin' the law"
• Shawn discusses what parts of the CFAA he would like to see reformed
• James drops the question - "What is a security researcher?" ..and rants a little
• Kevin talks about why the security industry needs to self-regulate w/example
• Chris and Kevin debate intent, and "stepping over the line"
• Chris brings up the issue of bug intake at a large company
• Spirited discussion about intent, regulation, actions and separating emotion from facts

Guests

• Chris John Riley - ( @ChrisJohnRiley ) - Chris John Riley is a senior penetration tester and part-time security researcher working in the Austrian financial sector. With over 15 years of experience in various aspects of Information Technology, Chris now focuses full time on Information Security with an eye for the often overlooked edge-case scenario. Chris is one of the founding members of the PTES (Penetration Testing Execution Standard), regular conference attendee, avid blogger/podcaster (blog.c22.cc / eurotrashsecurity.eu), as well as being a frequent contributor to the open-source Metasploit project and generally getting in trouble in some way or another. When not working to break one technology or another, Chris enjoys long walks in the woods, candle light dinners and talking far too much on the Eurotrash Security podcast.
• Shawn Tuma - ( @ShawnETuma ) - Shawn is an attorney with expertise in computer fraud, social media law, data security, intellectual property, privacy, and litigation. He's a Texan, Christian, family man, author & speaker - and an all-around awesome guy.
• Kevin Johnson - ( @SecureIdeas ) - Kevin is the Chief Executive Officer of Secure Ideas. Kevin has a long history in the IT field including system administration, network architecture and application development. He has been involved in building incident response and forensic teams, architecting security solutions for large enterprises and penetration testing everything from government agencies to Fortune 100 companies. In addition, Kevin is an instructor and author for the SANS Institute and a faculty member at IANS. He is also a contributing blogger at TheMobilityHub.

Topics covered

• The FBI paid a visit to the "researcher" who revealed (and tinkered with) the hacked Yahoo! servers - we discuss the various aspects of this case, which we've been going round and round on lately
  • http://www.wired.com/2014/10/shellshockresearcher/
• US Cyber Security Czar Michael Daniel wants us passwords gone, replaced by <drumroll please> .... "selfies"; We wish we were making this one up or the link was to an Onion article, but sometimes the jokes write themselves in a sad, sad way
  • http://www.theregister.co.uk/2014/10/15/forget_passwords_lets_use_selfies_says_obamas_cyber_tsar/
• Pres. Obama has issued an executive order that all government payment cards now must be "chip & pin"; once again underscoring that "just do something" may be worse than actually doing nothing -- we'd love to hear your thoughts?
  • http://www.whitehouse.gov/the-press-office/2014/10/17/executive-order-improving-security-consumer-financial-transactions
• Notable data breaches discussed:
  • K-Mart - http://www.theregister.co.uk/2014/10/12/kmart_cyber_attach/
  • Dairy Queen - http://www.theregister.co.uk/2014/10/10/dairy_queen_restaurants_hacked/
• POODLE, the latest OMG SSL vulnerability; is this really that big a deal that there is a public vulnerability in a protocol that should have become extinct at the turn of the century? (Hint: Sadly, yes)
  • http://www.theregister.co.uk/2014/10/10/dairy_queen_restaurants_hacked/

In this episode

• Ron gives us a brief history of Tenable and TVM for the enterprise
• Ron answers "How do you make network security obtainable and defendable?"
• We discuss TVM as a fundamental principle to many other security program items
• Ron tells us what the modern definition of "policy" is
• We discuss some hurdles and challenges of TVM programs in an enterprise
• We note that security scanning can always break stuff - so how do you get around that?
• Ron tells us why TVM is so much more than scanning
• Michael asks "Why are so many companies stuck in a Prince song (1999)?"
• We attempt to tackle - compliance, risk, and managing to a goal
• Ron answers the question - "Are we getting any better?"

Guest

• 
  Ron Gula ( @RonGula ) - CEO and CTO at Tenable Ron co-founded Tenable Network Security, Inc. in 2002 and serves as its Chief Executive Officer and Chief Technology Officer. Mr. Gula served as the President of Tenable Network Security, Inc. He served as the Chief Technology Officer of Network Security Wizards which was acquired by Enterasys Networks. Mr. Gula served as Vice President of IDS Products and worked with many top financial, government, security service providers and commercial companies to help deploy and monitor large IDS installations. Mr. Gula served as Director of Risk Mitigation for US Internetworking and was responsible for intrusion detection and vulnerability detection for one of the first application service providers. Mr. Gula worked at BBN and GTE Internetworking where he conducted security assessments as a consultant, helped to develop one of the first commercial network honeypots and helped develop security policies for large carrier-class networks. Mr. Gula began his career in information security while working at the National Security Agency conducting penetration tests of government networks and performing advanced vulnerability research. He was the original author of the Dragon IDS. Mr. Gula has a BS from Clarkson University and a MSEE from University of Southern Illinois.

Topics covered

• The petition on WhiteHouse.gov titled "Unlock public access to research on software safety through DMCA and CFAA reform" and ...well we talk about it with an attorney and some necessary skepticism
  • https://petitions.whitehouse.gov/petition/unlock-public-access-research-software-safety-through-dmca-and-cfaa-reform/DHzwhzLD
  • My take: http://blog.wh1t3rabbit.net/2014/10/to-reform-and-institutionalize-research.html
• A Marriott property in Nashville (Gaylord Opryland) will pay $600,000 in an FCC settlement for jamming/blocking guests' personal WiFi hotspots
  • http://www.fcc.gov/document/marriott-pay-600k-resolve-wifi-blocking-investigation
• A Pakistani man has been indicted in Virginia for selling "StealthGenie", an app designed specifically as spyware
  • http://www.justice.gov/opa/pr/pakistani-man-indicted-selling-stealthgenie-spyware-app
• The code for the badUSB attack was published and released at DerbyCon - we discuss implications
  • http://www.wired.com/2014/10/code-published-for-unfixable-usb-attack/
• Cedars-Sinai Medical Center loss of data is much worse than they thought, but it's actually worse than that - a teachable moment here-
  • http://www.latimes.com/business/la-fi-cedars-data-breach-20141002-story.html

Thank you to Shawn Tuma - an attorney specializing in CFAA and a good friend of our show - for stopping by and lending his expertise on this episode. If you enjoy Shawn's insights, consider following him on Twitter ( @ShawnETuma ) or just saying hello!

In this episode

• We discuss the CFAA in regards to Robert Graham's brilliantly written blog post on the topic - http://blog.erratasec.com/2014/09/do-shellshock-scans-violate-cfaa.html
• Shawn gives some key insights on the CFAA including historical context
• Michael asks some tough questions on the discretion and applicability of CFAA prosecution
• James goes on a rant about "security researchers" (it's a gem)
• I'm pretty sure Shawn goes on the record saying security researchers should be credentialed..or was that me?
• We get some advise from Shawn on where this topic goes next, and how to avoid being a target of prosection

Guest

• Shawn Tuma - ( @ShawnETuma ) - Shawn is an attorney with expertise in computer fraud, social media law, data security, intellectual property, privacy, and litigation. He's a Texan, Christian, family man, author & speaker - and an all-around awesome guy.