Risky Biz Feature Podcast: The politics of cybersecurity

Has the Colonial incident made cybersecurity a "retail politics" issue?

In this podcast we’ll be hearing from an Australian politician, Tim Watts. He’s a member of our federal parliament and serves as our shadow minister for communications and cybersecurity. For our overseas listeners, the “shadow” part of his title is there because he’s a member of the opposition party, so he’s not in government. But, of course, if the Labor party wins the next election he’ll be our communications and cybersecurity minister.

Anyway, Tim is a bit of an anomaly in politics because he has a genuine, nerd-like interest in the field we so love. Tim and I chat pretty regularly, and I can say that yes, 100%, his interest in this field is genuine and he has a firm grasp on the issues that matter.

I thought now would be a great time to run an interview on the politics of infosec. While it’s true that policymakers spend time thinking about this stuff, cybersecurity hasn’t yet crossed over into being what they call a “retail politics” issue. But thanks to the Colonial pipeline ransomware incident, that might be about to change.

Risky Business #624 -- Ransomware farce continues

Healthcare systems in Ireland, New Zealand among latest targets...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • The aftermath of the Colonial ransomware attack
  • Biden signs cybersecurity EO
  • DarkSide crew hounded off the Internet. For now.
  • Ransomware campaigns continue, hitting health, insurance targets globally
  • IIS PoC released
  • Rapid7 discloses Codecov-related source code breach
  • Much, much more

This week’s show is brought to you by AttackIQ. Its VP of Product Mark Bagley and Senior Director of Cybersecurity Strategy and Policy Jonathan Reiber are this week’s sponsor guests.

Risky Biz Snake Oilers: Google pitches BeyondCorp for Enterprise

PLUS: Make Intune actually useable with Devicie and hear more about Trend Micro's XDR...

As regular listeners would know, Snake OIlers is a wholly sponsored podcast series we do here at Risky Biz HQ where vendors give us money so they can come on and pitch their products to you, our dear, dear listeners.

And we have three vendors along today to pitch you:

  • Google Cloud Security is in the top slot pitching their Zero Trust product suite BeyondCorp Zero Trust for Enterprise.

  • Devicie, an Australian startup, that developed a solution that makes Microsoft Intune useable.

  • Trend Micro joins the show to talk about its latest XDR features

Risky Business #623 -- Ransomware threatens US energy security

Chris Krebs joins the show to talk Colonial...

On this week’s show Patrick Gray, Adam Boileau and Chris Krebs discuss the week’s security news, including:

  • An analysis of the Colonial pipeline ransomware attack
  • More ransomware news
  • UK and US expose APT29’s preferred exploits (again)
  • IntrusionTruth drops a new post
  • 128m Apple devices were hit by XCodeGhost
  • Much, much more

This week’s sponsor interview is with Aaron Parecki, a Senior Security Architect at Okta. He’s also been a spec editor and member of the oath working group at IETF for nearly 11 years, so he knows a thing or two about OAuth. He’ll be joining me after the week’s news to talk through the latest OAuth guidance the IETF is going to release.

Risky Business #622 -- GitHub weighs exploit ban

PLUS: Should software ship with a "bill of behaviours"?

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • GitHub weighs banning exploits
  • Ransomware galore
  • Belgian government crippled in DDoS attack
  • Intrusion Truth Twitter account suspended
  • More Pulsesecure victims identified
  • Much, much more

This week’s show is brought to you by ExtraHop networks, and they’ll pop along in this week’s sponsor interview to float a really, really good idea. The Biden administration EO on cybersecurity will mandate software is shipped with a so-called software bill of materials so customers will actually know what’s in their supply chain. Ben Higgins and Ted Driggs from Extrahop will join us today to argue they should also supply a bill of behaviours; data in a standardised form that will tell you things like what domains and IPs the software will connect to.

Risky Business #621 -- Ultra professional criminal attackers ascendant

Infosec's trajectory looks a bit depressing right now...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • USA imposes sanctions over SolarWinds campaign
  • Enterprise border devices being attacked everywhere by all and sundry
  • Malvertising is coming back
  • Ultra professional criminal attackers are ascendant
  • All the latest ransomware, supply chain and other infosec news

This week’s sponsor interview is with Brian Dye, CEO of Corelight. We speak to him about what he’s calling “Open NDR”. A lot of the big SOCs have settled on their preferred ways of sharing threat information, and Brian drops by to talk all about those trends.

Snake Oilers: Greynoise! MergeBase! Votiro!

Turn down your SOC workload, get better SCA and block nasty macros...

In this edition of Snake Oilers we’ll be hearing from three very different vendors who’ve all been doing interesting stuff.

Greynoise: An infosec startup darling, Greynoise can tell you when an attack you’ve detected is internet-wide, automated activity. Very useful for de-prioritising entire alert sets.

MergeBase: Software Composition Analisys (SCA) with two key differentiators. MergeBase says it gives users MUCH better remediation advice than competitors, and also offers a “in prod” dynamic SCA product that feeds Java app telemetry back to app/security teams. Very cool, and getting popular.

Votiro: Regular listeners would know about CDR company Votiro. They’ve spent the last little while updating their product to better deal with macro-based threats. There’s some site-specific machine learning pixie dust as well as some more generic static detections and re-writes.

Risky Business #620 -- Project Zero burns Western counterterrorism operation

We're glad we don't have to make those sort of decisions at Risky Biz HQ...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Ubiquiti insider blows whistle on breach
  • Cyber insurer ransomwared
  • Project Zero burned a Western counterterrorism operation
  • Australian parliament, media, politicians all under attack
  • Executive Order would require vendors to notify US government of incidents
  • Much, much more…

This week’s sponsor guest is a special one. Metasploit creator and Rumble.run founder HD Moore will join us to talk all about his new venture, the Rumble asset discovery tool. It’s an absolutely fantastic interview, as you’d expect from HD.

Risky Business #619 -- REvil crew demands $50m from Acer

PLUS: Why we were wrong on Exchangapalooza '21...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • REvil demands US$50m from Acer in ransomware attack
  • Shell added to Accellion victim list
  • Governments banding together to tackle ransomware
  • BEC theft hits $1.8bn in 2021: FBI
  • Exchange tyre fire is, surprisingly, almost under control
  • MORE

Remediant’s Paul Lanzi will pop along in this week’s sponsor interview to talk about how they’ve integrated their PAM solution with Carbon Black. It’s an integration that is actually somewhat obvious in hindsight: if a box has been popped then some accounts have, too, so tying these things together does make sense.

Risky Biz Soap Box: 12 years since Operation Aurora. Have we learned anything?

Okta's Marc Rogers talks about some uncomfortable truths...

This is a wholly sponsored podcast brought to you by Okta.

In this interview we chat with Marc Rogers, the executive director of Cybersecurity at Okta.

The question that we’re exploring in this interview is whether or not we’ve managed to move the infosec needle since the Chinese government hacked Google back during the Operation Aurora attacks of 2009.

Risky Business #618 -- MS security licensing faces congressional scrutiny

US lawmakers baulk at Microsoft's "millions for basic security features" policy...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • The latest on the Exchange tyre fire
  • Lawmakers in the USA have had enough of Microsoft’s ridiculous licensing tiers
  • White House mulls software security rating system
  • Joseph Cox’s SMS adventures
  • Things didn’t quite work out for APT6920 Arson Cats
  • Much, much more

This week’s show is brought to you by VMRay. They asked us to interview one of their customers in this week’s sponsor segment so Brad Marr, the CISO of Life Fitness, pops in to walk through his VMRay use case.

Risky Biz Feature Podcast: Chasing crooks through the blockchain

Distributed ledgers give us unprecedented insight into illicit economies...

This podcast was made possible thanks to the support of the Hewlett Foundation’s Cyber Initiative. They’ve provided us with grant funding so we can do feature podcasts that will be of interest to people working in policy roles. The idea is educate people working in policy about issues that they’re in a position to do something about.

In this interview we spoke with Kim Grauer, the head of research at Chainalysis.

Chainalysis makes software that cryptocurrency exchanges, regulators, law enforcement and intelligence services use to get insight into what’s happening in terms of bitcoin and other cryptocurrencies moving around. You would have heard us talk about their reports in the news segment of Risky Biz a few times because they have a habit of publishing really interesting insights into things like the ransomware economy.

Risky Business #617 -- Exchangapalooza '21

Can open, worms everywhere...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • All the Exchange boxes on the planet have pretty much been owned lol
  • See above
  • Someone’s hacking Russian crime forums
  • The Accellion scandal keeps on truckin’
  • Dependency confusion attacks are going berserk in the wild
  • Gab got owned. Again.
  • John McAfee is in all sorts of trouble
  • Much, much more

This week’s show is brought to you by Nucleus Security. Its director of APAC operations, Gil Azaria, joins us in this week’s sponsor interview to talk about how he became a Nucleus customer before he joined the vendor as its APAC guy.

Web shells everywhere

The Risky Biz newsletter for March 9, 2021...

A China-linked espionage campaign against select US targets has exploded into a frenzy of indiscriminate exploitation that has compromised tens of thousands of Microsoft Exchange servers across the globe.

Risky Business #616 -- Exchange 0day party time for Chinese APT crew

But it's not supply chain-related, so it's no big deal, right?

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • Chinese APT crew goes berserk with Exchange 0day
  • Russia hacks Ukraine and USA, India hacks China, China hacks India
  • The NYTimes got something big wrong again (shock horror)
  • CANVAS exploit pack leaks, including their sweet, sweet Spectre exploit
  • Atlantic Council report into offensive capability vendors/contractors
  • Your vCentre gear it probably already on fire: find out why!
  • Much, much more

This week’s show is brought to you by Yubico, the makers of the Yubikey.

Risky Biz Soap Box: ExtraHop CTO and co-founder Jesse Rothstein

SolarWinds NDR alerts were often trees falling in the woods...

This is a sponsored podcast featuring ExtraHop’s co-founder and CTO Jesse Rothstein. ExtraHop is a Network Detection and Response (NDR) vendor that started out offering network health and monitoring tools before being pulled into the security space by its own customers.

Jesse joined host Patrick Gray to talk about the SolarWinds compromise from a Network Detection and Response vendor’s perspective, about cloud security and monitoring, some of ExtraHop’s backstory and more. Enjoy!

Risky Business #615 -- Dependency confusion is, uh, pretty bad

PLUS: US floats new RU sanctions, TikTok gets stay of execution...

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

  • USA floats new sanctions against Russia
  • TikTok, WeChat get stay of execution
  • Dependency confusion is ugh
  • US indicts Lazarus crypto-thieves
  • France ties Sandworm crew to Centreon intrusion
  • MORE

This week’s show is brought to you by Thinkst Canary. Thinkst’s founder Haroon Meer is this week’s sponsor guest and he joins us to have a very Haroon-style conversation. We talk about how security controls and detections often fall over when things happen that take place outside of our assumptions: trojaned software updates, attackers hiding in unconventional places like monitors, things like that. That’s a great conversation.

Accellion customers are getting ransom notices

The Risky Biz newsletter for February 16, 2021...

The five most recent listings on the leak site of the CL0P ransomware group have two things in common. One, and most obviously, they are being extorted. And two, they’ve deployed Accellion file transfer appliances to send large files in their recent past.

Risky Biz Feature Podcast: A primer on Microsoft cloud security

Everything you want to know about Azure AD but were afraid to ask...

Recent attacks by SVR against US targets have mostly been written up under the moniker of the “SolarWinds campaign”. In our view, that’s inaccurate. The defining characteristic of this campaign wasn’t the SolarWinds supply chain stuff, it was the abuse of Microsoft cloud services.

My understanding of how contemporary cloud services work isn’t actually as good as it should be. And that got me thinking – if my understanding isn’t that great, then there’s probably a lot of other people out there who don’t quite grok this stuff, particularly on the policy side. So, I set out to prepare a primer on Microsoft cloud security.

Our guest in this podcast is Dirk-Jan Mollema. He works at Fox-IT in the Netherlands and is one of their core researchers on Azure AD and Active Directory Security. What you’re about to listen to, essentially, is me picking his brain so I can wrap my own head around this stuff. The hope is that some of you will learn along with me!