** There is a special gift for our listeners in this episode, from our friends at InfoSec World 2015! Listen to find out how you can go for free.

 We have a promo code!

CLD15/RABBIT – 15% off for “Down the Rabbit Hole” listeners

Topics Covered

• Google picks up really big rocks, but lives in a glass house. As Google drops zero-day on Apple and Microsoft they respond with a lame excuse as to why they aren't patching a vulnerability that puts north of 60% of all Android users at risk.
  • http://m.v3.co.uk/v3-uk/news/2389839/google-puts-60-percent-of-android-users-at-risk-with-webview-security-changes
  • http://www.extremetech.com/mobile/197346-google-throws-nearly-a-billion-android-users-under-the-bus-refuses-to-patch-os-vulnerability
  • http://www.eweek.com/security/google-project-zero-continues-its-microsoft-zero-day-assault.html
  • http://www.zdnet.com/article/googles-project-zero-reveals-three-apple-os-x-zero-day-vulnerabilities/
• Marriott reverses its decision to block guests' personal WiFi devices at their properties
  • http://threatpost.com/marriott-agrees-to-stop-blocking-guest-wifi-devices/110441
• LabMD's request to have an enforcement action against them by the Federal Trade Commission is denied. While this doesn't necessarily mean anything serious, yet, it's definitely one to watch.
  • http://healthitsecurity.com/2015/01/23/ftc-healthcare-data-breach-case-v-labmd-continues/
• Heartland Payment Systems - yes the company that was the posted child for nearly going out of business because of a horrible breach - is continuing to reinvent itself around security, this time making headlines with an offer of a data breach warranty. Strings, as you may suspect, attached.
  • http://www.cspnet.com/industry-news-analysis/technology/articles/heartland-offering-data-breach-warranty
  • http://www.businesswire.com/news/home/20150112005260/en/Heartland-Offer-Comprehensive-Merchant-Breach-Warranty

Watch this podcast page later this week for that freebie Michael told you about!

In this episode...

• The blog post that started it all - http://blog.norsecorp.com/2014/11/10/the-new-reality-in-security-offense-always-wins-and-defense-always-loses/
• Vince, tells us what he means by "Offense always wins, defense always loses"
• We disagree over this snip from his blog post: "To “win” in cyber security, defense must be right 100% of the time, while offense only has to be right once. We must wake up to the reality that defense is an impossible task; no matter what actions we take, we will lose."
• We discuss how we get away from being Eeyore defeatists?
• Vince give us security strategies he is advocating knowing that defense is better equipped, and better funded
• We briefly mention high-value assets, and why it's even more critical today than it has ever been before, and why we still stink at it
• We challenge Vince to give us some tangible steps to managing risk better, to get away from winning/losing?
• We discuss how we compress delivery time lines for security competencies? (Average time to deliver a technical control is months, plus budget cycle - maybe years)
• We close with lessons learned from your Vince's rich experience that he'd like to share with the listeners, to change the nature of the win/lose conversation

Guest

• Vince Crisler - Vince has done some very interesting things in his background including former Communications Officer with the US Air Force, who also worked at the White House as Presidential Communications Officerm backed security start-ups, and chairing a Washington DC OSINT group. He's definitely one of the people you should get to know.

Welcome to a new year of the Down the Security Rabbithole Podcast! We are kicking off this year with a guest on this morning's program, Phil Beyer joined us to talk about the last few weeks that have been a wild, wild ride in the security indsutry!

Thanks for your support so far, and we promise a fantastic 2015 to come.

Topics Covered

• Sony. Sony. Sony. It's all anyone can talk about! They got hacked. They released a movie. They apparently aren't in dire straits. Fascinating.
  • http://www.cbc.ca/m/news/world/sony-pictures-ceo-michael-lynton-says-hackers-burned-down-the-house-1.2894997
  • http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hack
  • http://www.washingtonpost.com/world/national-security/fbi-director-offers-new-evidence-to-back-claim-north-korea-hacked-sony/2015/01/07/ce667980-969a-11e4-8005-1924ede3e54a_story.html
• Meanwhile, an iron plant in Germany was attacked (via cyber) and caused some very serious, and real, damage
  • http://blogs.wsj.com/cio/2014/12/18/cyberattack-on-german-iron-plant-causes-widespread-damage-report/
• Microsoft abruptly cut off patch Tuesday public notifications, unless you're paying extra
  • http://www.computerworld.com/article/2866996/microsoft-abruptly-dumps-public-patch-tuesday-alerts.html
• On January 11th, 2015 a 90-day window expired and Google's new Project Zero disclosed on the world a Windows 8.1 privilege elevation flaw. Microsoft had not yet patched it. War of words is on.
  • https://code.google.com/p/google-security-research/issues/detail?id=123
  • http://www.pcworld.com/article/2867533/google-reveals-windows-81-flaw-mere-days-before-patch-tuesday-fix-irking-microsoft.html

Hi everyone! Welcome to the very first episode of the Down the Security Rabbithole Podcast for 2015! On this opening episode, Jeff Man joins us to talk truth to power on PCI-DSS and shatters myths for us.

In this episode

• Jeff tackles some common misunderstandings about PCI
• The crew discusses PCI – what’s right about it and what’s wrong about it
• Jeff tells us why he believes if you’re secure you’re compliant, but if you’re compliant you’re probably not secure
• The $64M question- Isn’t EMV, P2PE, and tokenization going to spell the end of PCI?
• Jeff tells us what to look forward to with PCI DSS v3.0

Guest

• Jeff Man ( @MrJeffMan ) - Mr. Man has 13 years of DoD experience (10 at NSA as a Cryptanalyst/Information Security Analyst), 18 years of commercial consulting – pen testing, vulnerability assessments, security architecture reviews, and 10 years as a QSA doing PCI (and yet he's never conducted a PCI audit and never been a CISSP). As a QSA he's been involved with most of the major companies that experienced breaches in the mid-2000’s (Walmart, TJX, Heartland) so he can speak with some credibility about recent breaches in the past year or so.