Srsly Risky Biz: When good cyber security leads to violence

PLUS: The SEC's Halloween horror show for CISOs

In this podcast host Adam Boileau and Tom Uren talk about the confluence of hacking and real-world violence.

They also discuss the SEC’s decision to charge SolarWinds and its CISO for not being transparent enough about SolarWinds’ real cybersecurity risks. Unfortunately, almost all companies have cyber security problems but disclose them only in very generic ways.

Risky Biz News: SEC charges SolarWinds and its CISO

PLUS: Russia is developing its own VirusTotal clone; Magniber ransomware gang members detained in South Korea; and Atlassian warns of data wiping bug.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu.

You can find the newsletter version of this podcast here.

Risky Business #727 -- Mr Gray goes to Washington

Chris Krebs and Dmitri Alperovitch co-host this week's podcast...

On this week’s show Patrick Gray talks through the news with Chris Krebs and Dmitri Alperovitch. They discuss:

  • The SEC enforcement action against Solarwinds’ CISO
  • The White House AI Executive Order
  • CitrixBleed exploitation goes wide
  • How Kaspersky captured some (likely) Five Eyes iOS 0day
  • Elon Musk’s Gaza Strip adventures
  • Much, much more

This week’s show is brought to you by Greynoise. Andrew Morris, Greynoise’s founder and CEO, is this week’s sponsor guest. He talks about how Greynoise is using large language models to help them analyse massive quantities of malicious internet traffic.

Risky Biz Soap Box: Stairwell will offer platform to researchers

Mike Wiacek and Eric Foster talk about Stairwell's latest bells and whistles...

In this edition of the Soap Box we hear from Mike Wiacek and Eric Foster from Stairwell.

Stairwell makes a product that collects and analyses every executable file in your environment. You deploy file collectors to your systems and they forward all new files to Stairwell for manual and automated analysis. You can do a lot of really cool analysis once you have all that stuff in the same place.

But as you’ll hear, Stairwell is broadening out the use cases for its platform. You don’t want to forward files from every system? You don’t have to. It’s still very useful as an analysis platform. It’s sort of like VirusTotal, but private and with a bunch more bells and whistles. There’s also a bunch of sharing tools in the platform, which gives it a “social network for CTI nerds” flavour.

Srsly Risky Biz: Ransomware's soft underbelly

PLUS: Why care about human rights?

In this podcast guest host Adam Boileau and Tom Uren talk about the recent Ukrainian hacktivist group’s hack and burn attack on a ransomware gang. This makes us think there are definitely opportunities for Western cyber outfits.

They also discuss why companies should think about human rights when they make contingency plans for crises like war.

Risky Biz News: 1Password joins the list of Okta victims

PLUS: Australia and Microsoft partner to build country's cyber shield; September was a record month for ransomware gangs; and major breach at the University of Michigan.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu.

You can find the newsletter version of this podcast here.

Risky Business #726 -- Okta owned while Cisco takes a massive L

Recorded live at NSA's Cybersecurity Collaboration Centre...

On this week’s show Patrick Gray talks through the news with Dmitri Alperovitch, NSA Cybersecurity director Rob Joyce and NSA CCC director Morgan Adamski. They discuss:

  • The Okta breach
  • 40-50k feral Ciscos
  • Why the http/2 protocol flaw is a real headache
  • The Ragnar Locker takedown
  • What the NSA CCC has been thinking about

This week’s show is brought to you by Socket. Socket’s founder Feross Aboukhadijeh joins us this week to talk about their actually-not-crazy use of large language models in their product.

Sponsored: It's better for everyone when DevOps have tools that are secure-by-default

DevOps don't have the time for security. Just give them tools that are secure-by-default.

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Resourcely CEO Travis McPeak about the modern DevOps ecosystem and how just giving developers tools with security baked in keeps everyone safe and happy, and how that’s easier than expecting your software engineers to become cybersecurity experts overnight.

Risky Biz News: Two ransomware gang websites go puff!

PLUS: Mandiant reveals Citrix zero-day; DPRK hackers target JetBrains TeamCity servers; and Five Eyes warn of increasing Chinese espionage.

A short podcast updating listeners on the security news of the last few days, as prepared by Catalin Cimpanu.

You can find the newsletter version of this podcast here.

Srsly Risky Biz: CISA to vendors — fix your products

PLUS: Five Eyes to watch for sticky fingers

In this podcast guest host Patrick Gray and Tom Uren talk about a CISA and NSA advisory that lists the 10 most common network misconfigurations they. It’s 101-level stuff and is particularly sobering because CISA and NSA don’t look at run of the mill networks, they look at important ones. CISA thinks part of the problem is vendors that make insecure-by-default products.

They also talk about a new Five Eyes security intelligence leader summit that warns of PRC intellectual property theft.


SUBSCRIBE NOW:
Risky Business main podcast feed:
Listen on Apple Podcasts Listen on Overcast Listen on Pocket Casts Listen on Spotify Subscribe with RSS
Our extra podcasts feed:
Listen on Apple Podcasts Listen on Overcast Listen on Pocket Casts Listen on Spotify Subscribe with RSS
Subscribe to our newsletters: