In this episode...

• Jon Callas gives a little of his background and his current role
• We talk through why cryptography is so hard, and so broken today
• Jon overviews compatibility, audit and making cryptography useful
• Jon brings up open source, security, and why "open is more secure" is bunk
• We talk through "barn builders" vs. "barn kickers" and why security isn't improving
• We talk through how to do privacy, active vs. passive surveillance
• We talk through anonymous VPN providers, anonymization services, and how they're legally bound
• Jon talks about appropriate threat modeling and knowing what we're protecting
• We talk through patching -- how to do patching for Joe Average User
• Bonus-- Mobile is as secure (or more) than what we're used to on the desktop

Guest

• Jon Callas ( @JonCallas ) - Jon Callas is an American computer security expert, software engineer, user experience designer, and technologist who is the co-founder and CTO of the global encrypted communications service Silent Circle. He has held major positions at Digital Equipment Corporation, Apple, PGP, and Entrust, and is considered “one of the most respected and well-known names in the mobile security industry.” Callas is credited with creating several Internet Engineering Task Force (IETF) standards, including OpenPGP, DKIM, and ZRTP, which he wrote. Prior to his work at Entrust, he was Chief Technical Officer and co-founder of PGP Corporation and the former Chief Technical Officer of Entrust.
  

Remember folks, as you listen reach out to us on Twitter and hit the hashtag #DtSR to continue the conversation, and speak your mind! Let's hear what your take is on the stories we discuss...maybe you have a unique angle we've not considered?

In this episode--

• Target settled class-action lawsuit over its data breach - for $10M USD
  • Who wins? Lawyers, clearly the lawyers
  • Burden of proof on the victims to show they've suffered a loss to get up to $10,000.00.
  • If you can't prove loss, you can still try to get part of settlement of what's left-over
  • http://www.usatoday.com/story/money/2015/03/19/target-breach-settlement-details/25012949/
• Federal judge dismisses suit against Paytime -- "simply no compensable injury yet"
  • Leaves door open for future suits if someone were to suffer a compensable injury
  • "Once a hacker does misuse a person's information for personal gain...there is a clear injury and one that can be fully compensated with money damages." -- Judge John E. Jones III
  • Watch this case, read the story for yourself
  • http://www.securityinfowatch.com/news/11883806/federal-judge-dismisses-lawsuits-over-paytime-inc-data-breach
• Sacred Heath Health System victim-by-proxy of a data breach
  • Happened at a 3rd party
  • So why is only Sacred Heart in the news?
  • ~40 individuals SSN and patient information
  • "deceptive technique" known as phishing
  • http://pensacolatoday.com/2015/03/sacred-heart-informs-patients-of-billing-information-disclosure/
• Premera Blue Cross "warned about security flaws before breach"
  • Lots to talk about here -- starting with is 3 weeks enough time?
  • OPM audit finds issues, is this a systemic failure or examplary of an enterprise doing its best in a difficult security climate?
  • Before you judge, measure up your own security posture against this article
  • http://www.seattletimes.com/business/local-business/feds-warned-premera-about-security-flaws-before-breach/
• Advantage Dental notifies patients of breach
  • 3 days from initial breach to discovery
  • Amazingly fast detection, but was it adversary or malware?
  • Is this a feel-good, or something else?
  • https://secure.advantagedental.com/index.asp?din=598
• NYC Auxiliary Officer charged with hacking NYPD & FBI systems
  • Insider threat poster child
  • Smart enough to do some interesting things
  • Yet, one of the dumbest criminals we've seen in a long time
  • http://www.fbi.gov/newyork/press-releases/2015/new-york-city-police-department-auxiliary-officer-charged-with-hacking-into-nypd-computer-and-fbi-database

In this episode...

• Michael C and the team talk bout "going back to basics" and the need for security fundamentals
• Michael C talks a little about why we (security professionals) fail at fixing problems at scale
• We dive into the need for automation, and Michael C talks about why creating more work for security professionals is a bad thing
• Michael C and the crew talk through why many of our metrics fail, highlighting the need to get away from the typical dashboard approach of "bigger numbers is better"
• We discuss the balance between false positives and false negatives -- a super critical topic
• Rafal brings up the role security professionals play in software security, and why we can't be expected to drive the daily tasks
• We talk through centralized vs. de-centralized security, and how to understand which works better, and where
• Michael C gives us his 3 key take-aways for listeners (don't miss these!)
• We talk through "assume breach", and what it means for security

Guest

• Michael Coates ( @_mwc ) - Currently, Michael is the Trust and Security Officer at Twitter where he leads the information security team and drives overall security efforts across the organization to a common goal and objective. Michael is a staple of the OWASP community now serving on its board and having contributed countless hours and lines of code to the effort. 

In this episode--

• Law firm hit and crippled by ransomware, decides it's not paying the ransom.
  • They aren't quite sure what got encrypted
  • But they have backups...
  • ..and data was likely not exfiltrated
  • http://news.softpedia.com/news/Ransomware-Hits-Law-Firm-Encrypts-Workstation-and-Server-474788.shtml
• Major law firms for ISAC to fight off adversaries, share intelligence
  • Catching up to the threat they're facing
  • Law firms are major targets, given the data they have ("secrets!")
  • Downside: exclusive to a handful of major firms
  • http://thehill.com/policy/cybersecurity/234722-law-firms-to-share-info-about-cyber-threats
• Big kerfuffle about Anthem's refusal of a 3rd party audie
  • They were under no legal obligation...
  • Who out there would submit to a 3rd party audit/test?
  • Sounds like publish shaming, big headline, little story
  • http://www.healthcareinfosecurity.com/anthem-refuses-full-security-audit-a-7980
• Apple Pay being attacked, sort of
  • When technology becomes 'good enough' attackers attack processes, people
  • Lesson -- nothing is "unhackable" even if the tech is great
  • http://www.theguardian.com/technology/2015/mar/02/apple-pay-mobile-payment-system-scammers
• [Slightly-old-but-relevant] Victor Valley College suspends entire IT staff to investigate a vague breach in protocol
  • Very little actually said in disclosure
  • "We don't have any reason to believe we've been hacked by outside hackers"
  • Entire computer system was taken down for nearly 3 hours
  • Emphasizing "no private student or employee information has been compromised"
  • Stay tuned...weird
  • http://www.vvdailypress.com/article/20150130/NEWS/150139991

In this episode...

• We learn the origins of "RSnake" as told by Rob himself
• Rob gives us a peek into the dark side, from his contacts and experiences
• We discuss the black-hat economy as it's verticalized, specialized, and matured
• Rob discusses the balancing act of the good vs. bad and why the situation is as bad as it needs to be
• We discuss some of the things businesses and defenders really need to worry about
• Rob gives us his view of the inevitability of security from SMB to enterprise -- and why things are so good, or bad, or just right
• We discuss the different ways security is being understood, implemented and matured and why it's futile to chase absolutes
• Michael and Rob dive into the labor shortage in security - real, perceived, or misunderstood?
• Rob gives us his outlook on where things are going over the next decade or so

Guest

• Robert "RSnake" Hansen - ( @RSnake ) - Strategic. Web security expert. Visionary. Robert brings more than 20 years of web application and browser security experience, innovation, and vision to the WhiteHat Security team. Under Robert’s leadership, WhiteHat Labs successfully launched Aviator, the most secure browser available, for Mac and Windows, quickly racking up more than 170,000 downloads in less than six months. When asked about WhiteHat Labs’ mission, Hansen said, “Labs will strive to provide prototypes that go beyond customer expectations, to delight the user.” Before WhiteHat, Robert was the CEO of SecTheory and Falling Rock Networks. Robert has co-authored several books including XSS Exploits and Website Security for Dummies. Robert is also the author of Detecting Malice. He is a member of WASC, APWG, IACSP, ISSA, APWG and has contributed to several OWASP projects, including originating the XSS Cheat Sheet. When he is not breaking the web to make it stronger, Robert enjoys watching Formula One racing.