BrakeSec Education Podcast

Bryan Brake, Amanda Berlin, and Brian Boettcher

A podcast about the world of Cybersecurity, Privacy, Compliance, and Regulatory issues that arise in today's workplace. Co-hosts Bryan Brake, Brian Boettcher, and Amanda Berlin teach concepts that aspiring Information Security professionals need to know, or refresh the memories of seasoned veterans. read less
NewsNews

Episodes

p2-accidentalCISO, building trust in new places
Feb 13 2024
p2-accidentalCISO, building trust in new places
Full Youtube VOD: https://www.youtube.com/watch?v=uX7odQTBkyQ      Questions and topics: Let’s talk about Mindful Business Podcast What’s the topics you cover? Topic #1: discuss your experiences when you were a new leader.  What worked? What didn't? What would you have done differently? Do you emulate your manager's style? What have been your go-to management resources?  What is a good piece of advice that you’ve been given or that you impart to others that relates to leadership? Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc) Topic #3: What are bare minimums for building ‘secure’ Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security?  Additional information / pertinent LInks (Would you like to know more?): Twitter/Mastodon: https://twitter.com/AccidentalCISO https://infosec.exchange/@accidentalciso The Mindful Business Security Show: https://www.mindfulsmbshow.com/ https://twitter.com/mindfulsmbshow Show points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: https://linkedin.com/in/brakeb  Brakesec Website: https://www.brakeingsecurity.com Youtube channel: https://youtube.com/@brakeseced Twitch Channel: https://twitch.tv/brakesec
AccidentalCISO on BrakeSecEd, talking Leadership, SaaS development, and Appsec
Feb 2 2024
AccidentalCISO on BrakeSecEd, talking Leadership, SaaS development, and Appsec
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information, and do not represent views of past, present, or future employers.   Recorded: 28 Jan 2024 Youtube VOD: https://youtube.com/live/uX7odQTBkyQ Questions and topics: Let’s talk about Mindful Business Podcast What’s the topics you cover? Topic #1: discuss your experiences when you were a new leader.  What worked? What didn't? What would you have done differently? Do you emulate your manager's style? What have been your go-to management resources?  What is a good piece of advice that you’ve been given or that you impart to others that relates to leadership? Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc) Topic #3: What are bare minimums for building ‘secure’ Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security?  Additional information / pertinent LInks (Would you like to know more?): Twitter/Mastodon: https://twitter.com/AccidentalCISO https://infosec.exchange/@accidentalciso The Mindful Business Security Show: https://www.mindfulsmbshow.com/ https://twitter.com/mindfulsmbshow Show points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: https://linkedin.com/in/brakeb  Brakesec Website: https://www.brakeingsecurity.com Youtube channel: https://youtube.com/@brakeseced Twitch Channel: https://twitch.tv/brakesec
How to get more headcount, BLUFFs Vulnerability, and Ranty Clause debuts!
Dec 4 2023
How to get more headcount, BLUFFs Vulnerability, and Ranty Clause debuts!
Show Topic Summary: Ms. Berlin proposes a question of how to gather more headcount with metrics, we discuss the BLUFFS bluetooth vulnerability, and “Ranty Claus” talks about CISA’s remarks of putting the onus on device product makers to remove choice for customers and implement secure defaults. #youtube VOD: https://www.youtube.com/watch?v=emcAzTx9z0c  Questions and topics: https://cyberscoop.com/cisa-goldstein-secure-by-design/ https://hackaday.com/2023/12/02/update-on-the-bluffs-bluetooth-vulnerability/ Additional information / pertinent LInks (Would you like to know more?): https://cyberscoop.com/jen-easterly-secure-by-design/ https://www.cisa.gov/resources-tools/resources/stop-passing-buck-cybersecurity  Examples of companies forcing changes https://www.bleepingcomputer.com/news/microsoft/microsoft-will-roll-out-mfa-enforcing-policies-for-admin-portal-access/   https://github.com/aya-rs/aya - eBPF implementation in Rust https://ossfortress.io/   https://www.darkreading.com/endpoint-security/critical-logofail-bugs-secure-boot-bypass-millions-pcs  Show points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake on Mastodon.social, https://linkedin.com/in/brakeb  Brakesec Website: https://www.brakeingsecurity.com Twitter: @brakesec  Youtube channel: https://youtube.com/c/BDSPodcast Twitch Channel: https://twitch.tv/brakesec
Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs
Sep 23 2023
Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.   Guest Bio: Nicole is the Chief Product Officer at Axio. Nicole has spent her career building awareness around the benefits of usable security and human-centered security as a way to increase company revenue and create a seamless user experience.  Youtube VOD Link: https://youtube.com/live/tFaAB9an47g  Questions and topics: Usable security: is it an oxymoron? What determines if the security is ‘usable’ or no? We sacrifice security for a better UX, what can be done to alleviate that? Or is it some sort of sliding scale in “poor UX, amazing security or awesome UX, poor security” Examples of poor UX for ‘people’: MFA, and password managers. SEC updates and ‘material events’ and how that would affect security, IR, and other company reporting functions.    Also, additional documentation (Regulation S-K Item 106) https://www.linkedin.com/posts/nicole-sundin-5225a1149_sec-adopts-rules-on-cybersecurity-risk-management-activity-7090065804083290112-ISD8 Are companies ready to talk about their cybersecurity? Can the SEC say “you’re not doing enough?”  What is ‘enough’? Are we heading toward yet another audit needed for public companies, similar to SOX? When does an 8-K get publicly disclosed? Materiality is based on a “reasonable investor”? So, you don’t need to announce that until you’re certain, and it’s based on what you can collect? Cyber Risk Management and some good examples of how to set up a proper cyber risk organization Additional Links: https://csrc.nist.gov/CSRC/media/Projects/usable-cybersecurity/images-media/Is%20Usable%20Security%20an%20Oxymoron.pdf http://web.mit.edu/Saltzer/www/publications/protection/Basic.html https://www.sec.gov/news/press-release/2023-139 https://www.sec.gov/news/statement/munter-statement-assessing-materiality-030922 https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/sec-final-cybersecurity-disclosure-rules.html https://www.nasa.gov/centers/ames/research/technology-onepagers/hc-computing.html  https://securityscorecard.com/blog/what-is-cyber-security-performance-management/
John Aron, letters of marque, what does a "junior" job look like with AI?
Sep 3 2023
John Aron, letters of marque, what does a "junior" job look like with AI?
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.   Guest Bio: John is the CEO of Aronetics. An avid climber and runner, John has spoken at many conferences about topics like ZeroTrust, BIOS/UEFI security, communication security, and malware. Aronetics is a technology-enabled service provider.    Youtube VOD: https://youtube.com/live/5dIVTwVZLAU Linkedin VOD: https://www.linkedin.com/video/live/urn:li:ugcPost:7101738254823030784 Show Topic Summary:   John joins us to discuss “letters of Marque” in an effort for hackers to ‘hack back’... the overreliance on automation, and communication siloes. We also talk about what a ‘junior position’ in infosec looks like with AI doing all the “Level 1 SOC Analyst” type roles normally given to someone fresh to the security industry.   Questions and topics: Is infosec over reliant on automation? Automation comes with its own challenges. Documentation woes Automation is usually found in userland   Aronetics’ Thor provides defense and counter-offense tamper-proof technology digitally tied to    Letter of Marque - good idea, or geopolitical disaster waiting to happen? Siloes and communication -best ways to overcome those in an org and outside? How do we overcome siloing?   Overcoming security challenges?Identity management - 2FA is everywhere, there’s already ways around 2FA, so what now? 3FA? Biometrics? Make everyone carry around physical tokens that we can lose?   Blog post: https://www.aronetics.com/post-quantum-cryptography/ What do we need to protect against? Nation states with quantum computers? Rubber hose cryptography?   Crime thrives in areas of low visibility. https://www.aronetics.com/unknown/    https://www.aronetics.com/inside-the-breach/ (threat detection - the crime thrives in low vis areas)   Show points of Contact: Brakesec Website: https://www.brakeingsecurity.com Youtube channel: https://youtube.com/c/BDSPodcast Twitch Channel: https://twitch.tv/brakesec Amanda Berlin: @infosystir@infosec.exchange (Mastodon) @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake on Mastodon.social
Megan Roddie - co-author of "Practical Threat Detecion Engineering"
Aug 25 2023
Megan Roddie - co-author of "Practical Threat Detecion Engineering"
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers. Buy here: https://subscription.packtpub.com/book/security/9781801076715 Amazon Link: https://packt.link/megan Youtube VOD: https://www.youtube.com/watch?v=p1_jQa9OQ2w   Show Topic Summary: Megan Roddie is currently working as a Senior Security Engineer at IBM. Along with her work at IBM, she works with the SANS Institute as a co-author of FOR509, presents regularly at security conferences, and serves as CFO of Mental Health Hackers. Megan has two Master's degrees, one in Digital Forensics and the other in Information Security Engineering, along with many industry certifications in a wide range of specialties. When Megan is not fighting cybercrime, she is an active competitor in Muay Thai/Kickboxing. She is a co-author of “Practical Threat Detection Engineering” from Packt publishing, on sale now in print and e-book. Buy here: https://subscription.packtpub.com/book/security/9781801076715   https://packt.link/megan ← Amazon redirect link that publisher uses if you want something easier on the notes   Questions and topics: Of the 3 models, which do you find you use more and why? (PoP, ATT&CK, kill chain) What kind of orgs have ‘detection engineering’ teams? What roles are involved here, and can other teams (like IR) be involved or share a reverse role there? Lab setup requires an agent… any agent for ingestion or something specific?  How does Fleet or data ingestion work for Iot/Embedded device testing? Anything you suggest? How important is it to normalize your log output for ingestion? (app, web, server all tell the story) Additional information / pertinent LInks (Would you like to know more?): Unified Kill Chain: https://www.unifiedkillchain.com/ ATT&CK: https://attack.mitre.org/  D3FEND matrix BrakeSec show from 2021: https://brakeingsecurity.com/2021-023-d3fend-framework-dll-injection-types-more-solarwinds-infections  Pyramid of Pain: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html https://www.securitymagazine.com/articles/98486-435-million-the-average-cost-of-a-data-breach  https://medium.com/@gary.j.katz (per Megan, ‘it’s basically Chapter 11 of the book’) Show points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake on Mastodon.social, Twitter, bluesky Brakesec Website: https://www.brakeingsecurity.com Twitter: @brakesec  Youtube channel: https://youtube.com/c/BDSPodcast Twitch Channel: https://twitch.tv/brakesec
Bsides Seattle and Austin, SecureBoot patch, and more
May 27 2023
Bsides Seattle and Austin, SecureBoot patch, and more
BrakeSec Show Outline – No Guest   Show Topic Summary (less than 300 words) Bsides Seattle and Bsides Austin   Youtube VOD: https://youtube.com/live/UGRaRSYj7kc    Questions and potential sub-topics (5 minimum): Bsides Seattle update and Bsides Austin Patching the unpatchable https://en.wikipedia.org/wiki/Parkerian_Hexad  Power and influence  (is power bad? Is influence?) 5.  https://deliverypdf.ssrn.com/delivery.php?ID=357001027119125105074103081006094117005092014048001013007086030071009081068110103025024041103038045036033080107020112080097022024073029064061065125002071028013110008011045013116002084024000066075067001126004101003027004086091007025096080019022003104&EXT=pdf&INDEX=TRUE (A Theory of Creepy: Technology, Privacy and Shifting Social Norms) (contact info for people to reach out later):   Additional information / pertinent Links (would you like to know more?): (contact info for people to reach out later): https://www.bleepingcomputer.com/news/security/microsoft-shares-guidance-to-detect-blacklotus-uefi-bootkit-attacks/ https://www.bleepingcomputer.com/news/security/malware-dev-claims-to-sell-new-blacklotus-windows-uefi-bootkit/   Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast  Email: bds.podcast@gmail.com
lynsey wolf, conducting insider threat investigations, CASB and UEBA utlization to good use.
Apr 30 2023
lynsey wolf, conducting insider threat investigations, CASB and UEBA utlization to good use.
Show Topic Summary (less than 300 words) Insider threat still exists, Lynsey Wolf talks with us about HR’s role in insider threat, how prevalent investigations are in the post-pandemic work from home environment.   Questions and potential sub-topics (5 minimum): What is the difference between insider threat and insider risk? Motivators of insider threat (not much different than espionage,IMO -bryan)  (MICE: Money, Ideology, Compromise, and Ego.) https://thestack.technology/pentagon-leaks-insider-threat-sysadmin/  75% of all insider threats are being kicked off by HR departments. In short, it's proactive. “How did HR figure that out?” How are investigations normally initiated? What tools are they implementing to check users or predicting a disgruntled employee?” UEBA? CASB? Employee surveys that are ‘anonymous’? Someone who reported others and it was dismissed? What if HR ‘gets it wrong’ or ‘it’s a hunt to find people no into ‘groupthink’ or ‘not a culture fit’? https://www.cbsnews.com/news/french-worker-fired-for-not-being-fun-at-work-wins-lawsuit-cubik-responds/ How can organizations be mindful of how and what data is collected to mitigate risk without affecting employee trust? And who watches the watchers to ensure data is handled responsibly? Are there any privacy guidelines companies need to understand before they implement such a system? (GDPR? CCPA? Privacy notices? Consent to monitoring on login? https://securiti.ai/blog/hr-employee-data-protection/ ) Are companies causing the thing they are protecting against? (making an insider threat because they’ve become repressive?) (hoping there’s an ‘everything in moderation idea here… finding the happy medium between responsible ‘observability’ and ‘surveillance’) Lots of ‘insider threat’ tools, including from EDR companies. Do companies do a good job of explaining to employees why you need EDR? Quiet Quitting - latest term for companies to use to describe “employee has a side gig”. How does this figure into insider threat? Is it assumed that people only have one ‘thing’ they do, or did the lack of a commute give people more time during the pandemic to diversify? Solutions for employees? Separate their work and private/side gig? Learn what their contract states to keep conflicts of interest or your current/past employer from taking your cool side project/start-up idea away from you? Solutions for companies?   Additional information / pertinent Links (would you like to know more?): (contact info for people to reach out later): https://www.cisa.gov/detecting-and-identifying-insider-threats  https://venturebeat.com/data-infrastructure/how-observability-has-changed-in-recent-years-and-whats-coming-next/  https://ccdcoe.org/library/publications/insider-threat-detection-study/  https://resources.sei.cmu.edu/asset_files/TechnicalReport/2016_005_001_454627.pdf (insider threat ontology) https://www.intelligentcio.com/apac/2022/08/01/survey-reveals-organizations-see-malicious-insiders-as-a-route-for-ransomware/  https://www.helpnetsecurity.com/2022/04/08/organizations-insider-threats-issue/  https://www.fortinet.com/resources/cyberglossary/what-is-ueba  https://www.gartner.com/en/information-technology/glossary/cloud-access-security-brokers-casbs  https://thecyberwire.com/glossary/mice https://qohash.com/the-high-price-of-trust-the-true-cost-of-insider-threats/  https://abc7chicago.com/classified-documents-jack-teixeira-air-national-guard-arrest/13126206/ (Air National Guardsman accused in military records leak makes 1st court appearance - story still developing as of 16 April 2023) https://www.theverge.com/2020/8/4/21354906/anthony-levandowski-waymo-uber-lawsuit-sentence-18-months-prison-lawsuit    Show Points of Contact:
3CX supply chain attack, Mark Russinovich and Sysinternals, CISA ransomware notifications, and emotional intelligence
Apr 8 2023
3CX supply chain attack, Mark Russinovich and Sysinternals, CISA ransomware notifications, and emotional intelligence
Show Topic Summary (less than 300 words) 3CX supply chain attack, Mark Russinovich and Sysinternals, ransomware notifications from CISA, and emotional intelligence Youtube VOD: https://www.youtube.com/watch?v=afZHiBUr-2g  Questions and potential topics (5 minimum): https://www.straitstimes.com/tech/downloading-a-cracked-version-of-fifa-23-or-hogwarts-legacy-for-free-it-s-probably-malware  https://leadershipfreak.blog/2023/03/27/the-7-powers-of-questions/  https://securityintelligence.com/articles/is-it-time-to-hide-your-work-emails/  https://www.lollydaskal.com/leadership/what-remote-leaders-do-differently-to-be-successful/  https://www.lollydaskal.com/leadership/the-role-of-emotional-intelligence-in-leadership-why-it-matters/  https://www.cybersecuritydive.com/news/3cx-mandiant-investigate-supply-chain-attack/646543/  https://www.bleepingcomputer.com/news/security/openai-chatgpt-payment-data-leak-caused-by-open-source-bug/  https://www.cybersecuritydive.com/news/cisa-pre-ransomware-notification/646041/  https://www.sentinelone.com/labs/the-life-and-times-of-sysinternals-how-one-developer-changed-the-face-of-malware-analysis/    Additional information / pertinent Links (would you like to know more?): https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/  https://www.orangecyberdefense.com/global/blog/research/3cx-voip-app-supply-chain-compromise  https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/ https://www.linkedin.com/feed/update/urn:li:activity:7047156405715300352/  Sigma Rule - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_malware_3cx_compromise_susp_children.yml  https://en.wikipedia.org/wiki/Information_Sharing_and_Analysis_Center  https://www.cisa.gov/news-events/news/cisa-establishes-ransomware-vulnerability-warning-pilot-program  https://www.fda.gov/media/166614/download  https://www.amazon.com/Windows-Internals-Part-architecture-management/dp/0735684189  https://medium.com/@martin-thissen/llama-alpaca-chatgpt-on-your-local-computer-tutorial-17adda704c23    Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast  Email: bds.podcast@gmail.com
Dish Network is still busted, John Deere avoiding OSS requests, Is DAST dead?
Mar 24 2023
Dish Network is still busted, John Deere avoiding OSS requests, Is DAST dead?
Show Topic Summary (less than 300 words) Dish Network is still busted due to ransomware, your Pixel phone baseband RCE, Nothing runs like a Deere (away from OSS requests, anyway), and “Are we past DAST?”   Questions and potential sub-topics (5 minimum): https://techcrunch.com/2023/03/15/dish-customers-kept-in-the-dark-as-ransomware-fallout-continues/  https://medium.com/@cmanojshrestha/hack-any-social-media-account-using-cookie-stealing-attack-a6cdc4caafc1  https://boringappsec.substack.com/p/edition-18-the-diminishing-returns  https://www.theregister.com/2023/03/17/john_deere_sfc_gpl/  https://www.bleepingcomputer.com/news/security/alleged-breachforums-owner-pompompurin-arrested-on-cybercrime-charges/ (thanks D Mathews!) https://www.bleepingcomputer.com/news/security/microsoft-support-cracks-windows-for-customer-after-activation-fails/  https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html    Additional information / pertinent Links (would you like to know more?): https://www.shopbiscoff.com/lotus-biscoff-xl-two-pack-case-bulk-size https://twitter.com/InfoSystir/status/1636847843683041280?s=20            Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec Youtube: https://www.youtube.com/c/BDSPodcast  Email: bds.podcast@gmail.com
Nickolas Means talks about Security, Devops velocity, blameless orgs, and conferences infosec should attend
Mar 4 2023
Nickolas Means talks about Security, Devops velocity, blameless orgs, and conferences infosec should attend
Guest info Name and Title: Nickolas Means, VP of Engineering at SYM Email/Social Media Contact: @nmeans on Twitter, @nmeans@ruby.social on Mastodon Time Zone (if other than Pacific): Central (Austin, TX)   Show Topic Summary / Intro We welcome Nickolas Means to the stream. Nick is the VP of Engineering at Sym, the adaptive access tool built for developers. He's been an engineering leader for more than a decade, focused on helping teams build velocity through trust and autonomy. He's also a regular speaker at conferences around the world, teaching more effective software development practices through stories of real-world engineering triumphs and failures. He’s also the co-host of “Managing Up” a podcast with  Management tips, stories, and interviews to help navigate the challenges of managing creative and technical teams.   Questions and potential sub-topics (5 minimum): 'blameless environment' during an incident. We can discuss working an incident and if a 'blameless' environment the exception or the rule (stories from the trenches are always welcome) Building a compliance program without tanking your engineering velocity... I'd like to speak about that in terms of overall security (product security, scanning, license checks, and more) Is there a playbook to building more efficient dev and security teams? Can cross training dev in basic security, or security in sprint planning processes make a better experience for all? Will we ever solve ‘shifting left’? What does Shifting Left really mean to engineering teams, or is that a term security people created to try and speak ‘dev/eng’?  ‘Managing Up’... security is often asked to do a lot. Be STO when you don’t manage the resources, timeline, etc. When teams are small, you’re either in the operational/tactical, when management wants a ‘tactical/strategic’ view. What can the overall business do to create a good working relationship out of the gate? “Make a dashboard” is all well and good, except when your org lacks maturity across the board. What are some realistic expectations management should have when the company is small?  (I will provide additional context during the stream)   Additional information / pertinent Links (would you like to know more?): https://managingup.show/ - Managing Up Podcast “Management tips, stories, and interviews to help navigate the challenges of managing creative and technical teams.“ https://symops.com/ - Adaptive access management tools built for engineers https://www.ted.com/talks/brene_brown_the_power_of_vulnerability?language=en https://www.terraform.io/ https://news.stanford.edu/2022/12/05/explains-recent-tech-layoffs-worried/    Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec  Youtube: https://youtube.com/c/BDSPodcast
SPECIAL INTERVIEW: John Aron and Jerod Brennen
Feb 10 2023
SPECIAL INTERVIEW: John Aron and Jerod Brennen
BrakeSec Show Outline (all links valid as of 27 Jan 2023, subject to change)   Is it scheduled?  Yes || No|| Completed   Date:  2023/01/26   Guest info Name and Title: John Aron, Founder/CEO of Aronetics Email: john@aronetics.com Time Zone (if other than Pacific): Eastern Standard   Guest info Name and Title: Jerod Brennen Email: jerod@brennenconsulting.com Time Zone (if other than Pacific): EST   Show Topic Summary (less than 300 words) Clear the fog of marketing truths and viable solutions that actually deter and defend adversarial action.   Questions and potential sub-topics (5 minimum): Edge devices everywhere A paradigm culture shift is necessary How/What kind of culture shift is needed?  In 2007, Steve Jobs unveiled the iPhone with no mention of how to keep it safe While DARPA that created GPS, shares a sorry - not sorry       4. Working from Home or the office, how can you guarantee security with travel between both? This type of computing isn’t possible in government circles. 5. The New York Times 2019 Fall Special - So the internet didn’t turn out the way we hoped. How can we restore sanity and normalcy to using a computer when there is a persistent threat everywhere?  Who is under ‘persistent threat’?  6. Jerod: decentralization of technologies and empowering makers and people    Additional information / pertinent Links (would you like to know more?): Even Nobodies Have Fans Now. (For Better or Worse.) - The New York Times.pdf(local copy) (local copy defeats paywall) ) So the Internet Didn’t Turn Out the Way We Hoped. Now What_ - The New York Times.pdf (local copy defeats paywall) https://identity.foundation/  https://www.scmp.com/news/china/science/article/3206384/chinese-scientists-claims-new-quantum-code-breaking-algorithm-raise-eyebrows-us
Layoff discussions, another TMO breach, OneNote Malware, and more!
Jan 24 2023
Layoff discussions, another TMO breach, OneNote Malware, and more!
Lots of Layoffs (meta, Microsoft, Amazon, Sophos, Alphabet, Google) talk about the future effects of that, did it affect security? Attack surface management is risk management, Breaches and the TSA no-fly list leaked, and more! Full youtube video: https://www.youtube.com/watch?v=1Dgq8FpnWPw   Questions and/or potential sub-topics (5 minimum): Layoffs (fear, uncertainty, doubt), what it means for people,  https://www.lollydaskal.com/leadership/5-warning-signs-you-are-being-led-by-a-weak-leader/ “No fly list leaked” https://www.vice.com/en/article/93a4p5/us-no-fly-list-leaks-after-being-left-in-an-unsecured-airline-server Attack Surface Management: https://flashpoint.io/blog/what-is-attack-surface-management/ https://www.bleepingcomputer.com/news/security/beware-hackers-now-use-onenote-attachments-to-spread-malware/ https://securityaffairs.com/141102/hacking/eof-cisco-routers-exposed-rce.html https://www.linkedin.com/posts/threatintelligence_threat-intel-cheat-sheet-by-cyber-threat-activity-7021035081184026624-3GWH? (issues with "step 0")   Additional information / pertinent Links (would you like to know more?): https://www.sec.gov/ix?doc=/Archives/edgar/data/0001283699/000119312523010949/d641142d8k.htm  - TMO’s 8k filing https://www.bleepingcomputer.com/news/security/verizon-notifies-prepaid-customers-their-accounts-were-breached/ https://en.wikipedia.org/wiki/Maia_arson_crimew https://discord.gg/brakesec      Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social  Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec
GPS car hacks, Google Threat report, notable topics of 2020, satellite threat modelling, twitter breach(?)
Jan 10 2023
GPS car hacks, Google Threat report, notable topics of 2020, satellite threat modelling, twitter breach(?)
topics What were the biggest stories of 2022? Any notable trends that you saw https://acut3.github.io/bug-bounty/2023/01/03/fetch-diversion.html (fetch Diversion) I got 5 million steps in 2022! Looking to jog/run 350 miles https://medium.com/@jdowde2/the-security-threat-of-and-in-file-path-strings-d75ee695eb3a  (danger of , and .. in file paths Google’s threat Horizon’s report     Additional information / pertinent Links (would you like to know more?): https://services.google.com/fh/files/blogs/gcat_threathorizons_full_jan2023.pdf (google’s Threat Horizons report) https://securityboulevard.com/2023/01/google-cybersecurity-action-team-threat-horizons-report-5-is-out/  https://medium.com/malware-buddy/6-useful-infographics-for-threat-intelligence-240d6aca333e  https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps \youtube.c https://hbr.org/2016/09/excess-management-is-costing-the-us-3-trillion-per-year  https://thenewstack.io/circleci-secrets-catastrophe/ https://www.nbc29.com/2023/01/06/twitter-leak-exposes-235-million-email-addresses-hack/  https://www.vice.com/en/article/zmpx4x/hacker-monitor-cars-kill-engine-gps-tracking-apps    Show Points of Contact: Amanda Berlin: @infosystir @hackershealth  Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake @bryanbrake@mastodon.social Website: https://www.brakeingsecurity.com Twitch: https://twitch.tv/brakesec