In this episode

• Court strikes down Wyndham's challenge to FTC power
  • We have covered this before
  • Wyndham argued due proces and lack of case law - asked for dismissal
  • Court said no dismissal, FTC has standing
  • FTC is arguing that Wyndham made promises it did not keep
  • Should be interesting to watch this go to court (or likely not)
  • http://www.csoonline.com/article/2975915/data-breach/wyndham-vs-ftc-corporate-security-pros-need-to-lawyer-up-about-data-breach-protection-experts-say.html
• Ashley Madison hauled into court by class-action suit
  • Lots of thorny issues here, must separate out moral from legal
  • Shines light on the continued bias for breach prevention
  • Interesting Streisand effect here
  • http://www.csoonline.com/article/2975755/data-breach/ashley-madison-hauled-to-court-in-class-action-suits-over-data-breach.html
• Verizon launches Hum OBD port vehicle monitor and communication tool
  • In light of the stunt-hacking against Chrysler/Jeep is Verizon tone deaf?
  • ..or are they simply that confident in their security?
  • There is no mention, by the way, of security of the device on the web site
  • http://www.macnn.com/articles/15/08/26/service.not.reliant.on.verizons.network.uses.any.ios.or.android.phone.130118/
• The move to EMV cards (chip & sign) in America is changing how fraud happens
  • EMV cards cost a fortune to implement
  • Solving a problem the finance industry did not have
  • http://www.bankinfosecurity.com/interviews/emv-shift-preparing-for-fraud-migration-i-2850#

In this MicroCast, live from HTCIA Conference 2015 in Orlando, FL, Michael and I quickly set the stage for a conversation on conference speaker/attendee engagement. 

[Raf] One of my biggest pet peeves as a speaker is getting a room-full of people who watch (and listen) me speak, wait for me to finish, and leave when I'm done.

[Michael] As an attendee, you need to know what you "do" and what you're looking for from the conference.

--> Here's the link to the article Michael mentions: http://paulsohn.org/how-to-connect-with-anyone-you-just-met-with-5-questions/

We welcome the discussion on this topic, #DtSR on Twitter!

In this episode...

• We discuss what life is like as the CISO when you have all the responsibility for, but no administrative access (or hands on keyboard)
• Brandon tells his story about how his IT organization went from in-house, to out-house, and how they got where they are
• Brandon tells us the process and strategy he uses to get a handle on his security
• We discuss why visibility is one of the most important things to outsourced IT (and security)
• Brandon tells a story of an incident where things went very sideways
• We discuss the balance between outsourcer scalability and customer deviations
• Brandon tells us why sometimes it takes 3 months to scan your environment for a vulnerability ( your head will explode )
• …and so much more

Guest

• Brandon Dunlap ( @bsdunlap ) - Brandon is the global Chief Information Security Officer for a an employee-owned, global leader in building critical infrastructure in energy, water, telecommunications and government services currently operating in more than 100 countries through consulting, engineering, construction, operations and program management.

In this episode...

• Just when you thought America's neutered "chip & sign" was a safe
  
  • http://krebsonsecurity.com/2015/08/chip-card-atm-shimmer-found-in-mexico/
  • Admittedly we put these stories in here just to get Michael all fired up
• Ashley Madison's data and source code and CEO's email spool now released and public
  • http://www.theregister.co.uk/2015/08/20/ashley_madison_email_dump/
  • http://www.csoonline.com/article/2973575/business-continuity/ashley-madison-self-assessments-highlight-security-fears-and-failures.html
  • So much to talk about that's just wrong with this story...
• Uber is hiring people for security
  • http://www.ibtimes.com/uber-boost-security-staff-after-data-privacy-concerns-2055903
  • Does more headcount equal better security?
  • Where will these people come from given the shortage of talent? <snark>
• That gadget you attached to your OBD2 port on your car to "save on car insurance" may be used to kill you
  • Seriously
  • The dangers of all these wireless & connected devices is scary
  • Risk assessment anyone?
  • http://www.wired.com/2015/08/hackers-cut-corvettes-brakes-via-common-car-gadget/
  • Someone get Flo on the phone...
• Windows 2003 which is now expired still has 609,000 public servers on the Internet
  • Translates into roughly 175M websites (Netcraft)
  • Why are thse out there?
  • Is there really a risk or is this hype?
  • http://www.zdnet.com/article/windows-server-2003-servers-insecure-unpatched/
• ATC systems go down as they were ...<drumroll> being updated!
  • Common problem of ancient systems going down due to upgrade
  • ATC has ZERO patch window
  • ..also close to ZERO ability to test patches/updates in "lab" environment
  • Complex, ancient systems fail when they're upgraded, sometimes catastrophically
  • http://thehill.com/policy/cybersecurity/251310-software-limits-exposed-in-air-traffic-outage

In this episode...

• We discuss the ever-growing need for strong leadership in security
• I ask whether experience and longevity in a position naturally brings leadership qualities
• We talk through how leadership interplays with other competencies
• Michael asks whether the security leader has a place at the executive table (the "big kids table")
• Michael asks if the MBA has value in security leadership
• We discuss the model my team uses for leadership and how we build them
• Michael and Heath discuss various competency models for leadership
• We discuss measuring, KPIs and relative distance
• We discuss how leaders can make better decisions
• Heath leaves us with an Alex Hutton quote

In this episode...

• The Belgian government's internal phishing test has "gone off the rails" a bit
  • Used a legitimate entity to test against
  • Panic and hilarity ensued, but mostly panic
  • http://www.networkworld.com/article/2951514/security/belgian-government-phishing-test-goes-offtrack.html
• British ICO makes a 180,000 pound fine
  • Disconnect between policy and reality
  • Was anything lost?
  • 2 big failures lead to a fine
  • https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/08/ico-fines-nationwide-money-lender-the-money-shop-180-000/
• McAfee and Black Hat attendee surveys wildly different
  • Answers you get depend on who and how you ask
  • Interesting answert though...
  • Lesson: The more experience you have, the less confidence?
  • http://www.slate.com/blogs/future_tense/2015/07/21/two_surveys_of_cybersecurity_professionals_show_starkly_different_attitudes.html

In this episode

• Raf asks - Why haven’t we solved the same old software security bugs?
• James asks how a security team gets out of the way and still get better security?
• We discuss threat modeling, and channel a bit of John Steven
• Jeff talks about the OWASP ESAPI and standard security libraries and controls
• Jeff talks about “libraries with known vulnerabilities” and the role of open source components
• Raf brings up the ugly side of enterprise outsourcing - code development by committee
• We discuss static, dynamic and run-time security tools
• Raf asks Jeff what the RIGHT approach to creating a software program looks like

Guest

• Jeff Williams ( @PlanetLevel ) - Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. In 2002, Jeff co-founded and became CEO of Aspect Security, a successful and innovative consulting company focused on application security. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many other widely adopted free and open projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.

In this episode...

• "Hackers remotely kill a Jeep!"
  • Lots to talk about
  • Basics of segmentation weren't followed, aren't followed
  • Discussion on software 'fitness' and liability
  • http://www.cato.org/blog/hackers-remotely-kill-jeep
• Firefox blocks Flash and FaceBook calls for its death
  • Should it concern you that FireFox can change your config without your permission or an update?
  • How helpful is this? Does the message/pop-up actually DO anything to stop users from clicking YES?
  • http://money.cnn.com/2015/07/14/technology/flash-firefox-facebook/index.html
• Ashley Madison (the cheating website) breached!
  • Check their privacy policy - is it consistent with actions?
  • Did this event delay or possibly end the company's aspirations of going public?
  • The morality of AM's business model shouldn't be an issue here - but it keeps coming up
  • http://www.csmonitor.com/World/Passcode/2015/0722/Ashley-Madison-breach-a-painful-reminder-of-online-data-s-permanence
• British Gas bows to criticism over blocking password managers
  • http://www.scmagazineuk.com/british-gas-bows-to-criticism-over-blocking-password-managers/article/426463/
• US Court says "pocket dialed" called are NOT private
  • http://www.itworld.com/article/2951715/security/us-court-says-pocketdialed-calls-are-not-private.html

In this episode

• Talent shortage - is it real, and how bad is it?
• We discuss: what does negative unemployment actually mean?
• Michael asks- ecurity is still relatively new, how do we determined what “qualified” means?
• What skills are necessary to be a good security professional?
• Hiring - we discuss how we get better at screening potentially qualified employees
• We discuss how we can vet out real experience, versus resume skills
• Mark and Michael discuss specialization, automation, and optimizing our workforce
• Mark shares his thoughts on growing and retaining top talent

Guest

• Mark Orlando ( @MarkAOrlando )  - As the Director of Cyber Operations, Mark is responsible for Foreground’s Federal practice as well as the Virtual Security Operations Center (V-SOC) managed service. He leads a national team of analysts, engineers, incident responders, and managers who secure some of the most high profile networks in the Federal, financial, commercial, and power and utilities industries. As the senior operations subject matter expert, he is also responsible for security services strategy and advises on strategic Foreground initiatives such as threat intelligence analysis, custom analytics development. Mark is also a key advisor to the company’s award-winning educational unit, Foreground University. Prior to joining Foreground Security, Mark advanced through the technical ranks as a Security Analyst and Technical Lead in a variety of operations environments. In his 13+ years of experience, he has built and led security operations teams at the White House, the Department of Energy, the Pentagon, and numerous commercial organizations. He has also managed the operations division of a major Managed Security Service Provider supporting hundreds of private and public sector clients. Mark enjoys teaching and learning from others. He has presented on security operations and assessment at the Institute for Applied Network Security Forum and RSA Conference. Mark has earned the CISSP, PMP, CEH, ITIL, and multiple SANS GIAC certifications and holds a B.S. In Advanced Information Technology from George Mason University. Mark served in the US Marine Corp where he was a Marine Artillery NCO.
  
  Foreground Security (http://foregroundsecurity.com/)

In this episode...

• Peter Morin joins us to talk through the upcoming HTCIA International 2015 Conference in sunny Orlando, Florida.
• We talk through a preview of talks, events, and some interesting reasons you should be going to HTCIA Int'l
• Check out the incredible lineup of keynotes, speakers and talks - http://www.htciaconference.org/
• Come see the #DtSR crew live and in person as we record and broadcast from the conference

In this episode...

• Appears as though Windows 10 WiFi Sense could have some issues with WiFi -- more on this as it develops
  • Why is the default opt-in, and why in the world do I have to change my SSID to opt out?!
  • Is it really a good idea to use an SSID to describe security constraints on your network? (Hint: NO)
  • http://www.computing.co.uk/ctg/news/2415787/windows-10-wi-fi-sense-security-warning-over-automatically-shared-passwords
• "Washington Post will encrypt the news"
  • Ridiculous click-bait headline
  • Is this a good idea? Should everything be HTTPS?
  • What about ads, are we defeating ourselves?
  • https://hacked.com/washington-post-encrypt-news/
• OPM hackers stole 21.5 million people worth of records
  • That's all government employees, past, present, and under-cover (possibly)
  • 1.1 million biometrics (fingerprints) -- quick! go reset your fingerprints... oh wait
  • Bad --> worse --> catastrophic --> now what?
  • http://www.computerworld.com/article/2946031/cybercrime-hacking/opm-hackers-stole-data-on-215m-people-including-11m-fingerprints.html
• Katherine Archuletta, Director of OPM, resigns
  • Shock. Awe. Not.
  • Did everyone else see this one coming?
  • Does this change anything? Does her departure make anything better or is she the sacrificial lamb, the way Washington operates?
  • http://www.nytimes.com/2015/07/11/us/katherine-archuleta-director-of-office-of-personnel-management-resigns.html

In this episode

• We take a little peek inside the mind of a CEO, from the security perspective
• We discuss the state of information security in the last decade
• Dan shares his wisdom on how the role of a security professional and security leadership has changed over the course of his career
• We discuss about the talent shortage - and get an in-depth look at solving some of this problem
• Dan shares with us his views on balancing people, processes and technology resources to achieve meaningful security
• We talk strategy, and Dan and the guys talk through why it's so vital
• We get Dan's "closing remark" (something you won't want to miss)

Guest

• Dan Burns, CEO Optiv, Inc. -  Dan Burns brings more than 23 years of business, technology and security industry experience to his role as chief executive officer. In this role he is responsible for the development and implementation of high-level strategies and direction of the company’s growth. Being able to provide clear insight into navigating the complex information security landscape is a priority for Burns. His philosophy is to focus on building long-term relationships with clients, working with them to simplify their lives and becoming a trusted information security partner rather than a reseller or outside consultant.
  From 2002 when he co-founded Accuvant, until 2012 when he assumed his position as the company’s first CEO, Burns served as senior vice president of Accuvant’s sales organization. In that role, he was responsible for strategic planning, sales growth and problem resolution. Burns co-developed and helped to successfully execute on Accuvant’s initial vision – to build a company with the breadth, depth and capabilities to address the information security needs of organizations worldwide. He launched the sales force and grew it to a national powerhouse organization within a 10-year period, conducting business with nearly half of the Fortune 500, and driving $740M in revenue in 2014.
  Prior to his achievements with Accuvant, Burns was the regional vice president of sales for the western region of OneSecure. He played an integral role in transitioning the organization from a managed security services (MSS) provider to a product company, delivering to the marketplace the first intrusion prevention system (IPS) and generating $40M in product sales in the first year.
  Previously, as the western region vice president for Exault, an integrator, consulting organization and reseller, Burns secured some of the largest enterprise clients in the Rocky Mountain region and helped grow revenues to nearly $150M in two years. He also held positions at Access Graphics, Arrowpoint, and Netrex where he supported some of the largest telecommunication companies in building their information security programs, implementing technology and taking advantage of Netrex’s world-class MSS.
  Burns earned a bachelor’s degree in economics from San Jose State University

In this episode

With me gone, James and Michael run feral!

• It's June, so here are the top 3 security priorities for CISOs for 2015 (yes in June)
  • http://www.information-age.com/technology/security/123459699/top-3-security-priorities-cios-2015
  • Boils down to: patch faster, improve credentials, code better
  • Is this the right list? 
  • It mentioned side-stepping cloud and mobility. What if migrating to the cloud offers the opportunity to not worry about patching or code, and improve your credentials? 
  • Someone pointed out to me that this matches the OPM hack; perhaps this is just content driven from that? Does that make it more or less valid?
  • Let us know… #DTSR
• Cybersecurity tops advisors's compliance worries: poll
  • http://www.thinkadvisor.com/2015/06/24/cybersecurity-tops-advisors-compliance-worries-pol
  • More people concerned. 
  • This directly undercuts the notion that people don’t care. They do care. They care about their money. The advisors entrusted with their money care. People care. 
  • The question for us: what are we doing? How are we helping?
• Why it's worth divorcing information security from IT
  • http://www.forbes.com/sites/frontline/2015/06/22/why-its-worth-divorcing-information-security-from-it/
  • No. No it’s not. We don’t need more silos, we need less. 
  • This feels a bit like “we’re not getting what we want… so the answer is reorg.”
• Keeping your kids safe (online) this summer -- with our very own TV star, James!
  • http://www.news4jax.com/news/summer-online-safety-for-kids/33747246
  • James, tell us about the experience - and how you don’t have nearly the control you think you’ll have
  • What did you do to prep?
  • What was your one big take away?
  • Now that you did the interview, any new thoughts?
  • Folks… what do you do? #DTSR - congratulate James on a great interview, then share your ideas (and yes, this is an enterprise play -- you can AND SHOULD share this with your employees)

In this episode...

• What is the Security Advisor Alliance?
• We discuss some of the issues facing CISOs today
• Clayton gives us his perspective on how to solve some of those issues
• Clayton tells us about the mission of the SAA
• If your'e a CISO, are you signed up for the SAA Summit?  Shoot Clayton an email

Guest

• Clayton Pummill ( @cp48isme ) - https://www.linkedin.com/pub/clayton-pummill/10/32a/44a - Clayton is the executive director of the Security Advisor Alliance. He also has a storied background so I encourage you to give it a check!

In this episode...

• Facebook has released PGP-encryption-enabled email communications
  • The anti-privacy platform will now encrypt emails to you if you give them your PGP public key
  • Does no one see the insane irony here?
  • http://www.theregister.co.uk/2015/06/01/facebook_pgp_support/
• White House issues mandate for HTTPS (by default) for all federal websites
  • "By the end of 2016"
  • Is this a good thing? A bad thing? Or does it even matter?
  • http://www.huffingtonpost.com/2015/06/08/https-federal-websites_n_7539164.html
• Attackers are using medical devices to pivot into health care networks
  • The Internet of Medical Things is insecure
  • There are challenges here, but the risks of moving faster aren't negligible
  • Lots to be thought about here
  • http://www.csoonline.com/article/2931474/data-breach/attackers-targeting-medical-devices-to-bypass-hospital-security.html
• Kaspersky gets popped, cue the typical verbiage
  • "Three previously unknown techniques"
  • "..highly sophisticated attack used up to three zero-day exploits.."
  • http://www.bbc.com/news/technology-33083050
• PwC healthcare spending study is disturbing
  • Predicts a 6.5% dip
  • Security is one factor in increasing cost
  • http://hitconsultant.net/2015/06/10/pwc-healthcare-spending-growth-rate-to-dip/
  • http://www.csoonline.com/article/2934929/security-leadership/why-the-dip-in-healthcare-spending-is-actually-a-risky-opportunity-for-security-leaders.html