Hey everyone! We're almost done with 2014 and another new year is right around the corner. We thought this was the perfect time to sit back, relax a little and reflect on the year that was...and boy was it ever!

Jack Daniel & Allison Miller join Michael, James and I on the podcast to talk it all out, share a few chuckles and try to make sense of it all!

Thanks for listening everyone, it's been an epic year and we look forward to more awesome things in 2015!

In this episode

Attorney and CFAA expert Shawn Tuma joins us to talk about the US vs. Salinas case where Mr. Salinas was threatened with 440 years in jail, and now plead down to a misdemeanor. Prosecutorial discretion, or attorneys-gone-wild?

Link: http://www.wired.com/2014/11/from-440-years-to-misdemeanor/

Topics covered

• The unfolding case of the Sony Pictures Entertainment breach
  • http://blog.wh1t3rabbit.net/2014/12/when-press-aids-enemy.html
  • http://www.thedailybeast.com/articles/2014/12/12/shocking-new-reveals-from-sony-hack-j-law-pitt-clooney-and-comparing-fincher-to-hitler.html
  • http://www.csoonline.com/article/2857455/business-continuity/fbi-says-theres-nothing-linking-north-korea-to-sony-hack.html
  • http://www.csoonline.com/article/2854672/business-continuity/the-breach-at-sony-pictures-is-no-longer-just-an-it-issue.html
• The phishing scam that succeeded at hitting a big chunk of Wall Street - it probably would have fooled you too. Here's what we've learned
  • http://arstechnica.com/security/2014/12/phishing-scam-that-penetrated-wall-street-just-might-work-against-you-too/
• Iranian hackers hit Las Vegas behemoth with a sophisticated attacked ... wait it was a Visual Basic base?!
  • http://arstechnica.com/security/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/
• Judge refuses to dismiss case against Target, brought on by banks who are the ones who take the brunt of the losses-
  • http://arstechnica.com/tech-policy/2014/12/judge-rules-that-banks-can-sue-target-for-2013-credit-card-hack/

In this episode

• Michelle explains to us what Enterprise Architecture is, and what it isn't
• Michelle gives her take on how both security and enterprise architecture both support each other
• We discuss the roll of standards, standards, standards - and why you can't have security without it
• We talk about GRC
• We talk through roles & responsibilities definition between security, architecture, and the rest of IT
• "Application Portfolio Rationalization" --the most impossible project. Ever.
• Michelle schools us on data, high-value assets, meta-data and the really hard topics for security
• Michelle gives us a series of examples of "HOW" we can find high-value assets, and start security there
• Michelle addresses the phrase "business alignment" since it's pivotal to enterprise architecture

Guest

• Michelle-Marie Strah ( @CyberSlate ) - Director, Enterprise Architecture at NBCUniversal – recently joined the newly formed Strategy and Architecture team at NBCUniversal designed to drive enterprise architecture, solutions architecture and innovation management across all companies in the NBCUniversal global portfolio. Previously she was at Microsoft Corporation worldwide headquarters where she was responsible for leading emerging markets cloud deployments, go to market and compete strategies in Latin America for public, private and hybrid cloud offers (both Azure and partner hosted clouds). As part of her role on the Applied Incubation Team she worked closely with partners, CIOs and government officials as well as internal CTO, legal, and chief security officer teams in the region to ensure privacy and security standards for government and private sector cloud adoption in Latin America. As an enterprise architect, Michelle specializes in governance, risk, compliance, information security and enterprise information management and has decades of experience in highly regulated industries, government, defense and healthcare.

Additional Links

• IBM Security Framework: http://www.redbooks.ibm.com/abstracts/sg248100.html?Open
• OSA: http://www.opensecurityarchitecture.org
• TOGAF: The Open Group Architecture Framework: http://www.opengroup.org/togaf/

Topics covered

• Sony Pictures is having a very, very bad couple of days - and it could keep getting worse.
  • http://www.theverge.com/2014/11/24/7277451/sony-pictures-paralyzed-by-massive-security-compromise
  • http://www.csoonline.com/article/2852982/data-breach/sales-contracts-and-other-data-published-by-sonys-attackers.html
• A newly discovered (but old) comment bug in Wordpress affects ~86% of sites. The story isn't what you think it is-
  • http://www.consumeraffairs.com/news/newly-discovered-comment-security-bug-affects-86-of-wordpress-blogs-112414.html
• The Australian government is blaming a data breach from February on ... "awareness"? Michael disagrees (and he's right).
  • http://www.esecurityplanet.com/network-security/australian-government-data-breach-linked-to-poor-security-training.html
• The public release of the research on Regin malware has it pegged as the most advanced thing since the computer - so what?
  • http://money.cnn.com/2014/11/23/technology/security/regin-malware-symantec/index.html?hpt=hp_t2
  • https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom-nsa-gchq/
  • Symantec whitepaper: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/regin-analysis.pdf
• The Justice Department is using a 225 year old law to tackle a modern problem of encrypted cell phones through the manufacturer.
  • http://blogs.wsj.com/digits/2014/11/25/case-suggests-how-government-may-get-around-phone-encryption/
• The court system...works? 440 year jail threat down to a misdemeanor in no time flat
  • http://www.wired.com/2014/11/from-440-years-to-misdemeanor/
• Updates:
  • Target doesn't feel like all the banks' losses are their problem, here's why - http://arstechnica.com/tech-policy/2014/11/target-to-judge-banks-losses-in-our-card-breach-arent-our-problem/
  • In spite of the massive breach, Home Depot financial outlook is bright - http://www.forbes.com/sites/maggiemcgrath/2014/11/18/home-depot-outlook-bright-despite-data-breach/