Risky Business

Risky Business #238 -- BYOD is here whether you like it or not

May 11, 2012 -- In this week's show we take a look at the big burning issue of BYOD.

Neal Wise of Assurance.com.au joins us to discuss some common approaches. Neal says one reason companies are starting to address the issue is because staff are already bringing devices in and connecting them to corporate resources regardless of company policy. In other words it's happening whether you like it or not.

Risky Business #237 -- Opsec for dummies

May 3, 2012 -- On this week's show we're taking a look at basic opsec with an incident responder friend of ours. We'll be talking about some sensible strategies people can use when they're up to illegal stuff on the Internets, because, you know, watching all these guys getting busted for owning FBI websites from their own IPs is getting boring.

This is useful stuff to understand on the defensive side, too.

Plus Adam Boileau joins the show with his take on the week's news.

Risky Business #236 -- What to do with 300mb of VMware source?

April 27, 2012 -- In this week's feature interview we're chatting with reverse engineer Jonathan Brossard about the theft of VMware source code from a third party. Lulzsec-linked hax0rs have owned up around 300mb of VMWare source and they say they're dropping it on May 5.

We believe them.

Predictably, VMware says it's no big deal, but Jonathan says that line is basically horseshit. He'll be joining us to tell us why.

Risky Business #235 -- Why you really should read Mark Dowd's book

April 20, 2012 -- We've got a jam-packed show this week! We'll be hearing from Ruxcon organiser Chris Spencer about a new conference he's putting together. It's called BreakPoint and he's trying to establish it as a truly international conference.

We'll also be chatting with Mark Dowd about his, shall we say, more interesting vulnerability disclosure practices.

Risky Business #234 -- UK spy laws under the microscope

April 14, 2012 -- On this week's show we're taking a look at new laws in the United Kingdom that are designed to automate the collection of certain types of intelligence from telcos and ISPs.

The information itself has previously been accessible without warrant by UK intelligence agencies, but now they'll be able to bring up the data with a few keystrokes in real time.

Risky Business #233 -- Max pwnage

April 5, 2012 -- On this week's show Adam Boileau and Patrick Gray talk through the week's security news headlines, including:


  • Up to 500,000 Macs pwned by the Flashback Trojan

  • Auto-updater finally out for Flash

  • UK proposes completely stupid laws

  • 1.5m credit card numbers looted

  • Zeus still active after MS takedown



Tenable Network Security CSO Marcus Ranum stops by for this week's sponsor segment. Big thanks for Tenable for making this week's show possible!

Risky Business #232 -- Huawei, the NBN and Chewbacca

March 29, 2012 -- This week we talk to CommsDay founder and publisher Grahame Lynch about the Australian Government's decision to ban Chinese Networking vendor Huawei from supplying equipment to the National Broadband Network.

The government says it will block Huawei's participation in the rollout of the $36 billion network on security grounds following a negative assessment by Australian spy agency ASIO. Read Grahame's take here.

Risky Business #231 -- Hacktivism a genuine threat: DBIR

March 23, 2012 -- This week's feature interview is a chat with Verizon Business Security Solutions' Bryan Sartin about the annual Data Breach Investigations Report, or DBIR.

Risky Business covers the report [pdf] every year.

It's basically a post mortem of the previous year -- what sort of records were breached and by who? What were their motivations? What were their techniques?

Risky Business #230 -- Can security tester accreditation work?

March 16, 2012 -- This week's feature interview is with Alastiar MacGibbon, CEO of CREST Australia -- the Council of Registered Ethical Security Testers.

In the UK CREST is a big deal, and now it's on its way to Australia and NZ. There's even a similar organisation in the USA that is doing things the CREST way. So this approach could actually become a worldwide, accepted accreditation for security testers.

I know one extremely capable tester who flew over to the UK to take the CREST tests and wound up flunking the team leader portion of one of them, so it's not your typical rubber stamp.

Risky Business #229 -- Adrian Lamo on the LulzSec arrests

March 9, 2012 -- On this week's show we're catching up with Mr. Popular himself, Adrian Lamo.

Adrian is best known as the guy who turned in alleged Wikileaks source Bradley Manning, but he also has some very interesting perspectives on the LulzSec arrests.