In this episode...

• What about public safety, where do we draw the line on open research?
• Self-regulation? Disclosure? What are our options…
• What makes a researcher? We discuss
• “Chilling security research”
• A quick dive into bug bounty programs; do they help?
• Ethics vs. moral compass …we discuss
• Hacker movies, and what they’re doing for our profession

Guests

• Keren Elezari ( @K3r3n3 ) - brings years of experience in the international cyber security industry to the stage. Since 2000, Keren has worked with leading Israeli security firms, government organizations, Global Big 4 and Fortune 500 companies. Keren holds a CISSP security certification, a BA in History and Philosophy of Science and is currently a senior research fellow with the prestigious Security & Technology workshop at Tel Aviv University. In 2012, Keren held the position of Security Teaching Fellow with Singularity University, a private think tank, founded by Dr. Ray Kurzweil and sponsored by Google & NASA amongst others. Since 2013, Keren covers emerging security technologies and trends as a security industry analyst with GIGAOM research, a leading independent media hub. In 2014, Keren became the first Israeli woman to be invited to speak at the prestigious international annual TED conference. Keren’s TED talk has been viewed by 1.2 million people, translated to more than 20 languages and selected for TED’s list of ‘Most Powerful Ideas in 2014’ and for Inc.com’s list of ‘Top TED Talks of 2014’.
• Kellman Meghu ( @kellman ) - heads up a team of Security Architects for CheckPoint Software Technologies Inc., the worldwide leader in securing the Internet. His background includes almost 20 years of experience deploying application protection and network-based security. Since 1996 Mr. Meghu has been involved with consultation on various network security strategies to protect ISP's in Southern Ontario as well as security audits and security infrastructure deployments for various Commercial and Governmental entities across Canada and the Central United States. Kellman has delivered security talks in private corporate focused events, at school internet safety classes for students and teachers, as well as public events such as, SecureWorld Seattle, The Check Point Experience, Bsides St. Johns, Bsides San Francisco, Bsides Iowa, Bsides Detroit, Secure360, Trilateral Conference, and Sector lunch keynote for 2014. Kellman has contributed to live TV interviews in the Toronto area with CP24, CityNews, and CHCH TV, as well as radio station interviews and news articles across Canada and the US.
• Mark Nunnikhoven ( @marknca ) - focuses on helping organizations as they move from the data centre to hybrid environments to working fully in the cloud. Bringing over 15 years of practical experience to the table, he is regularly sought after to speak on cloud computing, usable security systems, and modernizing security practices.

In this episode...

• Friend and security researcher Chris Roberts steps into it... 
  • A poorly-conceived tweet, followed by mass hysteria
  • Most everyone talking about this is missing the point entirely
  • Of course, the EFF jumps in to keep from "chilling research" (roll eyes)
  • http://www.usatoday.com/story/tech/2015/04/19/chris-roberts-one-world-labs-united-rsa-computer-security-tweets/26036397/
  • The EFF take: https://www.eff.org/deeplinks/2015/04/united-airlines-stops-researcher-who-tweeted-about-airplane-network-security
• Corporate threat intelligence teams opting to go anonymous?
  • New company, making intelligence sharing work, anonymously?
  • Many questions on whether anonymity is workable in the intelligence space
  • https://www.eff.org/deeplinks/2015/04/united-airlines-stops-researcher-who-tweeted-about-airplane-network-security
• Target settles with Mastercard for $19M USD
  • Mastercard trying to settle this out, as alternative payout option for victims (this time the issuers, not card holders)
  • http://www.theregister.co.uk/2015/04/16/target_settles_with_mastercard_for_us19_million/
• The looming security threat no one is talking about
  • We're talking about it!
  • Windows 2003 is going out of service... after 12 yrs?
  • Final deadlines is July 14th
  • Panic? Compensating security controls?
  • http://www.healthcaredive.com/news/himss15-the-looming-it-security-threat-that-no-one-is-talking-about/386754/
• HTTP "ping of death" coming to a Windows IIS web-server near you
  • Patch now... people are actively exploiting this flaw to knock over web servers
  • Quick turn-around from "patch released" to "patch reverse-engineered to attack IIS servers"
  • http://www.theregister.co.uk/2015/04/16/http_sys_exploit_wild_ms15_034/
• JPMC algorithmn knowns you're an insider threat, before you do
  • Fascinating, applies to the financial world
  • Uses behavioral indicators
  • http://www.bloomberg.com/news/articles/2015-04-08/jpmorgan-algorithm-knows-you-re-a-rogue-employee-before-you-do

In this episode...

• Where do you even start with “threat intelligence”?
• Ryan talks about context, and why it’s *the* most important thing when it comes to threat intel
• How does a SME make use of a “luxury item” like threat intelligence?
• Michael asks what are 1-2 things you can do *immediately* as an SME?
• What are the basics, beyond the basics of security? Where do you make your first investment?
• Getting your own house in order is harder than it sounds, so what then?
• Michael drops some #RiskCatnip
• Michael breaks down the “feedback loop” and his basic questions to ask/answer
• Down the rabbit hole of shiny boxes, standards, and productized threat intelligence
• The overlap of data on commercial threat intelligence providers

Guest

• Ryan Trost - Ryan is the CIO of ThreatQuotient and knowledgeable on matters of intelligence with his extensive background and history in the community.

In this episode...

• TrueCrypt security audit results are good news, right? 
  • Why are some of the most depended-upon 
  • http://arstechnica.com/security/2015/04/truecrypt-security-audit-is-good-news-so-why-all-the-glum-faces/
• At Aetna, CyberSecurity is a matter of business risk
  • Jim Routh talks about how he runs a security program
  • Security is a matter of business risk, if not you're doing it wrong
  • http://blogs.wsj.com/cio/2015/03/30/cybersecurity-at-aetna-is-a-matter-of-business-risk/
• Why aren't you vulnerability scanning more often?
  • Wrong question.
  • Simple answer -- because scanning doesn't matter if you can't fix the issues you find
  • Example of how security misses the point
  • http://www.csoonline.com/article/2901472/vulnerabilities/why-aren-t-you-vulnerability-scanning-more-often.html
• SecurityScorecard - a new startup that is exposing 3rd party risks to you -- or is it?
  • Interesting business model
  • How legitimate is this, and what are the risks?
  • http://www.businessinsider.com/securityscorecard-raises-125-million-led-by-sequoia-2015-3
• Does removing Windows administrator permission really mitigate 97% of vulnerabilities?!
  • Is this real? If so -- why isn't everyone doing it?
  • Local administrator privileges are starting to fade, but why so slowly?
  • http://blog.norsecorp.com/2015/04/02/removing-admin-privileges-mitigates-97-of-critical-microsoft-vulnerabilities/