In this episode

With me gone, James and Michael run feral!

• It's June, so here are the top 3 security priorities for CISOs for 2015 (yes in June)
  • http://www.information-age.com/technology/security/123459699/top-3-security-priorities-cios-2015
  • Boils down to: patch faster, improve credentials, code better
  • Is this the right list? 
  • It mentioned side-stepping cloud and mobility. What if migrating to the cloud offers the opportunity to not worry about patching or code, and improve your credentials? 
  • Someone pointed out to me that this matches the OPM hack; perhaps this is just content driven from that? Does that make it more or less valid?
  • Let us know… #DTSR
• Cybersecurity tops advisors's compliance worries: poll
  • http://www.thinkadvisor.com/2015/06/24/cybersecurity-tops-advisors-compliance-worries-pol
  • More people concerned. 
  • This directly undercuts the notion that people don’t care. They do care. They care about their money. The advisors entrusted with their money care. People care. 
  • The question for us: what are we doing? How are we helping?
• Why it's worth divorcing information security from IT
  • http://www.forbes.com/sites/frontline/2015/06/22/why-its-worth-divorcing-information-security-from-it/
  • No. No it’s not. We don’t need more silos, we need less. 
  • This feels a bit like “we’re not getting what we want… so the answer is reorg.”
• Keeping your kids safe (online) this summer -- with our very own TV star, James!
  • http://www.news4jax.com/news/summer-online-safety-for-kids/33747246
  • James, tell us about the experience - and how you don’t have nearly the control you think you’ll have
  • What did you do to prep?
  • What was your one big take away?
  • Now that you did the interview, any new thoughts?
  • Folks… what do you do? #DTSR - congratulate James on a great interview, then share your ideas (and yes, this is an enterprise play -- you can AND SHOULD share this with your employees)

In this episode...

• What is the Security Advisor Alliance?
• We discuss some of the issues facing CISOs today
• Clayton gives us his perspective on how to solve some of those issues
• Clayton tells us about the mission of the SAA
• If your'e a CISO, are you signed up for the SAA Summit?  Shoot Clayton an email

Guest

• Clayton Pummill ( @cp48isme ) - https://www.linkedin.com/pub/clayton-pummill/10/32a/44a - Clayton is the executive director of the Security Advisor Alliance. He also has a storied background so I encourage you to give it a check!

In this episode...

• Facebook has released PGP-encryption-enabled email communications
  • The anti-privacy platform will now encrypt emails to you if you give them your PGP public key
  • Does no one see the insane irony here?
  • http://www.theregister.co.uk/2015/06/01/facebook_pgp_support/
• White House issues mandate for HTTPS (by default) for all federal websites
  • "By the end of 2016"
  • Is this a good thing? A bad thing? Or does it even matter?
  • http://www.huffingtonpost.com/2015/06/08/https-federal-websites_n_7539164.html
• Attackers are using medical devices to pivot into health care networks
  • The Internet of Medical Things is insecure
  • There are challenges here, but the risks of moving faster aren't negligible
  • Lots to be thought about here
  • http://www.csoonline.com/article/2931474/data-breach/attackers-targeting-medical-devices-to-bypass-hospital-security.html
• Kaspersky gets popped, cue the typical verbiage
  • "Three previously unknown techniques"
  • "..highly sophisticated attack used up to three zero-day exploits.."
  • http://www.bbc.com/news/technology-33083050
• PwC healthcare spending study is disturbing
  • Predicts a 6.5% dip
  • Security is one factor in increasing cost
  • http://hitconsultant.net/2015/06/10/pwc-healthcare-spending-growth-rate-to-dip/
  • http://www.csoonline.com/article/2934929/security-leadership/why-the-dip-in-healthcare-spending-is-actually-a-risky-opportunity-for-security-leaders.html

In this episode...

• Defenders are set up to fail? how and why
• How do we fill forensics and IR positions?What skills and qualifications do forensics/IR need to have?
• How can enterprises get better at IR from where they are today?
• How do we solve some of the problems plaguing the security industry?

Guest

• Andrew Case ( @attrc ) - Andrew Case is a senior incident response handler and malware analyst.He has conducted numerous large-scale investigations that span enterprises and industries. Andrew's previous experience includes penetration tests, source code audits, and binary analysis.  He is a core developer on the Volatility memory analysis framework and co-author of the highly popular and technical forensics analysis book "The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory".

Apologies to anyone who is having issues downloading this episode!

In this episode...

• The ACLU encourages the government to get into bug bounties
  • Read the original letter: https://www.aclu.org/sites/default/files/field_document/aclu_-_iptf_recommendations_submitted.pdf
  • Points 1 & 2 are at sane
  • Point 3 makes a hard left into into crazy-town
  • http://thehill.com/policy/technology/243265-aclu-says-government-should-offer-rewards-for-finding-security-flaws-on-its
• The massive taxpayer data fraud (not really a breach) is believed to be the work of Russia, says the IRS
  • Does it really matter?
  • Was this a breach or an abuse of functionality?
  • Would your company have caught this?
  • http://www.cnn.com/2015/05/27/politics/irs-cyber-breach-russia/index.html
• CareFirst says their recent breach affects only about 1.1M people
  • Healthcare is clearly in the "bad guys" target zone
  • Quick to point out what the attackers did not get access to
  • Of course it was a sophisticated cyberattack
  • http://abcnews.go.com/Technology/wireStory/carefirst-data-breach-affects-11m-people-31187250
• CNA Financial business unit refusing to pay out claim to Cottage Health System
  • Claims hospital "failed to continuously implement procedures and risk controls identified"
  • CNA unit alleges many failures -- but is this fair?
  • http://www.businessinsurance.com/article/20150515/NEWS06/150519893