Defensive Security Podcast Episode 43

November 18, 2013Podcastdefacement, GRC, malware, Syrian Electronic Armyjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

More advice from Bob; PCI 3 is here; Stats from a survey of malware analysts; A report from EastWest on measuring the Cyber Security Problem; The benefits of a GRC program; and we talk about web defacements.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email
PCI 3: http://www.bankinfosecurity.com/critiquing-new-version-pci-dss-a-6208
Study of malware analysts, highlighting that it’s apparently common to not disclose breaches: http://www.threattracksecurity.com/documents/malware-analysts-study.pdf
EastWest produces document outlining need for better incident/breach metrics: https://dl.dropboxusercontent.com/s/84odmpmtoee7rbu/MCP%20Final%2010_22_2013.pdf
VERIS Community already has this: http://www.veriscommunity.net/doku.php?id=public and it’s part of the input for the DBIR
Benefits of a grc application: http://www.computerworld.com/s/article/9243025/The_best_data_security_offense_is_a_good_defense?taxonomyId=17&pageNumber=1

Defensive Security Podcast Episode 42

November 11, 2013Podcastadobe, advanced malware, malware, passwordsjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Bob drops some more advice on malware; More details emerge about the Adobe password breach and it isn’t pretty; Long live the security perimeter; Snowden highlights the importance of not sharing passwords, and the downside to when it happens; A new 0day impacting Internet Explorer is making the rounds; And part 2 of our talk on advanced malware.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/

http://www.networkworld.com/news/2013/110513-long-live-perimeter-275650.html?page=1

http://news.cnet.com/8301-1009_3-57611528-83/nsa-workers-reportedly-shared-their-passwords-with-snowden/
http://arstechnica.com/security/2013/11/internet-explorer-users-face-drive-by-attacks-targeting-new-0day-bug/

Defensive Security Podcast Episode 40

October 28, 2013Podcastadvanced malware, compliance, DDOS, hacking, malware, phpjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Federal employees circumventing onerous security controls resulting in breaches; Cryptolocker is scary stuff; PHP.net hacked, and the response; DDOS attacks getting much larger, but lasting less time; Our discussion on advanced malware.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

http://www.networkworld.com/news/2013/101713-federal-security-breaches-traced-to-274944.html
http://www.securelist.com/en/blog/208214109/Cryptolocker_Wants_Your_Money
http://bartblaze.blogspot.com/2013/10/phpnet-compromised.html
http://arstechnica.com/security/2013/10/hackers-compromise-official-php-website-infect-visitors-with-malware/
http://www.pcworld.com/article/2056188/brace-for-stronger-ddos-attacks-security-firm-warns.html

Defensive Security Podcast Episode 39

October 21, 2013Podcasthacking, incident response, malwarejb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Hackers hide drugs coming through Belgium port by repeatedly hacking port computer systems; Aligning security with business priorities and other sage advice; how [not] to respond to a malware incident; on the security of jump boxes; reminder about security risks to small businesses; defining metrics for an incident response organization.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

http://www.csoonline.com/article/741530/security-spending-continues-to-run-a-step-behind-the-threats?page=1
http://www.techrepublic.com/blog/it-security/how-to-respond-to-a-malware-incident/
http://www.infoworld.com/d/security/jump-boxes-improve-security-if-you-set-them-right-228742
http://www.marketplace.org/topics/tech/hacked-small-businesses-often-have-no-place-turn
Presentation at RSA security analytica: https://www.youtube.com/watch?v=EDR6SwQ_i0I | https://community.emc.com/docs/DOC-27380

Defensive Security Podcast Episode 38

October 14, 2013Podcastandroid, dns, infosec, iOS, security, watering holejb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Study on personality traits and susceptibility to phishing; Android is apparently more secure than iOS; Don’t forget to factor malicious BHO’s into your plans; Don’t forget to factor malicious BHO’s into your plans; More registrar attacks; Insider threats are number 1; Defending against watering hole attacks.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

Pages: 1 2

Defensive Security Podcast Episode 37

October 9, 2013Podcastadobe, black hole, derbycon, hackingjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

The depressingly small impact from the arrest of the black hole exploit kit author; detecting malware embedded in hardware; altering CPUs during manufacturing to weaken random number generation; investigation into major identity theft operation results in discovery that data brokers were infected and that Adobe’s source code and 2.9M user IDs were stolen; recapping Derbycon 3.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email Continue reading Defensive Security Podcast Episode 37 →

Defensive Security Podcast Episode 36

September 22, 2013Podcast, SecurityHidden Lynx, Liberty Mututal, NSA, password security, passwords, Schnucks, Snowdenjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

How to change your SSN; How Snowden was able to access and steal the documents; Liberty Mutual sues Schucks grocery store over cyber breach insurance policy; Barclays and Santander banks hit with physical IT attacks; password security

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email Continue reading Defensive Security Podcast Episode 36 →

Defensive Security Podcast Episode 35

September 15, 2013Podcastencryption, man in the middlejb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

Paying attention to security is important – regulators are swirling: HTC and TrendNet have to submit to independent security audits every other year for 20 years, 50 other companies need to as well; encrypting your endpoints is not optional – just do it; and a winding discussion on man in the middle attacks.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email Continue reading Defensive Security Podcast Episode 35 →

Defensive Security Podcast Episode 34

September 9, 2013PodcastDDOS, NSA, Red Team, Snowdenjb

Podcast: Play in new window | Download | Embed

Subscribe: RSS

On preventing Snowden-style data leaks in your organization; should companies really worry about NSA spying?; On the usefulness of Red Team exercises; and how to defend against DDOS attacks.

Subscribe in iTunes | Podcast RSS Feed | Twitter | Email

http://investigations.nbcnews.com/_news/2013/08/26/20197183-how-snowden-did-it?lite

http://akamai.infoworld.com/t/data-security/how-secure-your-company-against-nsa-inspired-hacking-226264

http://www.darkreading.com/vulnerability/getting-the-most-out-of-a-security-red-t/240160471