In this edition of the Soap Box podcast we’ll be hearing from Ryan Kalember, the EVP of cybersecurity strategy at Proofpoint, a company best known for being an email filtering giant.

Proofpoint’s biggest challenger in that space is Microsoft, and if you’ve been paying attention you’d know that Microsoft is doing an absolutely massive push into the security space. It claims security is a $10bn revenue centre for the company, which is a bit of a screwy situation given a lot of the insecurity its security products mitigate is introduced through deficiencies in its core products.

And, largely, that’s what this interview is about – the screwy incentives that are driving Microsoft’s decisionmaking. More emphasis on security product development, and less effort on securing its core products.

Of course it’s self-serving for Ryan and Proofpoint to give Microsoft a kicking, given Redmond is its primary competitor. But the thing is, Ryan makes some very good points.

We talk about the incentives thing, and then we talk about why active directory is a trashfire and why the replication of the domain trust model in AzureAD is going to eventually bite us all in the ass. The circle of life, enterprise computing fail edition. Enjoy.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• T-Mobile owned hard
• USA no fly list winds up on unsecured ElasticSearch in Bahrain… because reasons
• Facebook scrambles to secure Afghani accounts
• Hacker steals and returns $600 from de-fi platform
• Healthcare sector struggles with ransomware attacks
• A very sweet TCP-based amplification technique that will be A Problem
• Much, much more

Evan Sultanik and Dan Guido will be joining us to talk about Fickling – a tool developed by Trail of Bits to do unnatural things to the Python Pickle files that are heavily used as a means to share machine learning models. The machine learning supply chain is really quite wobbly, and they’ll be joining us later to talk about that.

I am stoked to be publishing this interview. This Soap Box is brought to you by Rumble, the asset discovery company founded by HD Moore. For those of you who don’t know, HD is a security legend, having done all sorts of amazing research over the years and creating Metasploit all the way back in 2003.

This guy, as you’ll hear, vibrates at a slightly higher frequency than the rest of us. He’s one of those people who’s not only insanely talented, but he’s also insanely hardworking, which is why we get to have nice things like Metsaploit and, now, Rumble.

So: What is Rumble? It’s is an active asset discovery tool. You set it loose on your network and it shows you what’s there… but this isn’t your grandma’s portscanner. This thing can see through walls and around corners, and what it finds will genuinely blow you away. A couple of weeks ago a guy by the name of Tom Lawrence did an awesome 15 minute demo of Rumble for his YouTube channel.

I would highly recommend you watch it, even before you listen to this podcast. He does a fantastic job of demoing the product and showing that it’s able to make sense of what it sees to a very surprising degree. Tom demos it on a small network, but yeah, it scales – HD says Rumble counts a Fortune 5 among its customers.

Anyway, what HD has done with Rumble is create a tool – a lightweight scanner you can run from basically anywhere in a network – that will show you networks you didn’t know existed, it’ll identify devices with ridiculous granularity… it can even tell you if a windows box has EDR on it or a wireless card installed, all with an unauthenticated network scan.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• The United States backing away from “releasing the hounds”
• Apple has dropped its lawsuit against Corellium
• “Activists” dox Belarusian security apparatus
• Another sign hiding IR reports behind legal privilege is looking shaky
• Apple implements new child protection tech
• Much, much more

After this week’s news we’ll hear from Matt Cauthorn from ExtraHop Networks in this week’s sponsor interview. We’ll be talking about ransomware hack and leak and about how ransomware crews are losing credibility. You used to be able to actually trust them to just unlock you or keep your data private, but that’s not so much the case anymore.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• US President Joe Biden says next shooting war will result from cyber incident
• The Sun tabloid reports UK government weighing “cyber strike” against Iran
• Australia, UK and USA release list of most commonly used CVEs
• NSA drops Kubernetes security guide
• Much, much more!

This week’s show is brought to you by Cmd Security. It makes what can best be described as a security agent for Linux. It can handle everything from user action restriction to IDR functionality, and Cmd’s co-founder Jake King will be along in this week’s sponsor slot to talk about what he’s seeing out there in Linux land. Jake says there’s a big cloud modernisation push happening right now as people re-architect their “legacy cloud” infrastructure into more modern setups.

In this sponsored edition of the Risky Biz Soap Box podcast VMRay’s VP of Products Uriel Cohen joins me to talk about its Email Threat Defender product.

They’ve glued some automated sandbox analysis to their fancy phishing/link analysis/detection tech and they’re pitching it as a secondary control. That means no, they’re not trying to replace big services like Proofpoint or Microsoft’s upper tier filtering, but as a seat belt to catch things that slip the net.

We talk about what they’re trying to do, look at the limitations of static and dynamic detection and talk about all sorts of other stuff too. Enjoy!

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• Analysis suggests the Kaseya REvil incident was actually a bit of a fizzer
• They also obtained a decrypt key and no one knows how
• EU to follow US Treasury on Bitcoin controls
• Israeli Government has eyes on NSO fallout
• PetitPotam Active Directory technique is very bad news
• Much, much more…

This week’s show is brought to you by Remediant. Remediant makes a PAM solution that’s, well, quite different from the traditional password-vault style solutions. That’s put them in an interesting situation lately with Gartner. Remediant scored an honourable mention as a PAM to take note of, alongside Microsoft, but the thing is they don’t even qualify as a PAM vendor under Gartner’s own criteria. This might mean the analyst firms need to re-jig the way they evaluate and rank tech given there are so many more ways to skin cats these days. Remediant co-founder Paul Lanzi will join me in this week’s sponsor slot to talk through all of that.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• USA and friends send a sternly worded letter
• NSO group in the news, but parts of the coverage don’t add up
• Google TAG drops another great post
• We unveil the details of the earth shattering Kaseya 0day cyberweapon
• MORE

This week’s show is brought to you by Signal Sciences, which is now a part of Fastly. Instead of booking an interview with one of their staff, they suggested we interview one of their customers – so this week’s sponsor guest is J J Agha, the CISO of Compass, the American real estate website.

He’ll be joining us to talk about his general approach, and yes, Signal Sciences is a part of that, but he’ll speak to automation and orchestration and a bunch of other stuff too.

In this podcast we chat with Rob Joyce, the NSA’s Director of Cybersecurity.

As many listeners would know Rob has a pretty interesting resume, having served as a special advisor on cybersecurity to US president Donald Trump, and, before that, leading Tailored Access Operations for NSA. More recently he served as the NSA liaison to Britain’s GCHQ, but he returned to the USA this year to take up his new post as the head of NSA’s defence-oriented Cybersecurity Directorate.

And here’s the thing: Rob is a senior bureaucrat who is genuinely passionate about technology. His con talks are fantastic. He did one on how to make TAO’s life hard in 2016 that was really a blockbuster technical talk, and he’s even done a talk about how to engineer wildly over-the-top Christmas light displays.

I’m telling you this to let you know that, well, Rob is a real, actual security geek. He’s the hacker-bureaucrat, if you will.

Anyway, he generously made himself available to do this interview with us and we covered a bunch of stuff: The terrible state of enterprise security, cloud service providers being dumb with their defaults, the role of the intelligence community in combating ransomware and more. But we started off with some nuts and bolts discussion about what NSA’s cybersecurity directorate actually does. Enjoy!

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• REvil takes a vacation
• Kaseya finally patches VSA
• Morgan Stanley data exposed by third party Accellion hack
• CISA issues emergency directive on MS print spooler bug
• Patrick and Adam dream up ways for the US government to pressure vendors
• MORE

This week’s show is brought to you by Senetas. They’ve traditionally made layer 2 encryption gear but, as you’ll hear, they’re moving with the times! Senetas CTO Julian Fay joins us this week to talk through a bunch of stuff – what they’ve been working on, a really interesting project they had to abandon because of COVID and the latest news on the move to quantum-resistant crypto.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• Our take on the REvil attack against Kaseya customers
• Microsoft’s print spooler bug is a real worry
• Reports the RNC breached by Russia’s SVR
• NSA snaps GRU brute forcing efforts
• Much, much more

This week’s show is brought to you by Material Security, a very interesting startup that has a completely different take on what email security actually is. Material’s co-founder Ryan Noon will be along in this week’s sponsor interview to talk about the cool stuff they’re doing on the analytics side.

On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

• Microsoft reluctantly and belatedly discloses breach
• Chinese APT suspected of Air India breach
• JBS paid $11m even though they successfully restored systems
• cl0p money launderer arrests
• Ransomware news roundup
• The latest research and MORE

This week’s show is brought to you by Greynoise. Its founder and CEO, Andrew Morris, joins us this week to talk through some of the work he’s been doing to extend Greynoise’s use cases. It’s a great chat, that one.

Aaaaand we’re back on deck! We’re kicking things off this week with this interview with Joep Gommers, the CEO and founder of EclecticIQ. And FYI, in case you didn’t know, these Soap Box podcasts are wholly sponsored.

If your job involves handling threat intel, then I think you’ll really enjoy this conversation. It touches on a bunch of stuff. The first part of this is talking through what EclecticIQ actually offers, currently, then we talk more broadly about operationalising threat intelligence, and finally we talk about EclecticIQ’s new stuff – which include introducing XDR tooling.

As regular listeners know, the soap box podcasts we publish here at Risky.Biz are wholly sponsored. That means everyone you hear in one of these podcasts, paid to be here.

And this edition of Soap Box has become an annual thing – it’s our once-yearly catch up with Jerrod Chong, the chief solutions officer of Yubico, makers of the Yubikey and YubiHSM.

Yubikey is an infosec darling, really, because they’re in the unique position of having a product that’s popular with security professionals like CISOs while also being popular with security-conscious consumers. Businesses get value out of Yubikeys, but so do normal people, thanks to key support being baked into services like Facebook and Google.

As you’re about to hear, there’s a whole new category of use about to open up – Bank of America is launching FIDO2 U2F support for its customers. That’s a big deal – the more FIDO2 keys we get out there the better.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• US Government claws back Colonial ransom bitcoin. We don’t think the FBI acted alone.
• Meet an0m, the cute little app for planning crimes that drinks milkshakes.
• Ransomware stuff, duh.
• Trickbot developer arrested in Florida
• Supreme court upends CFAA “exceed authorised access” element
• Much, much more

This week’s show is brought to you by Datadog. Michael Yamnitsky will be along in this week’s sponsor interview to talk about cloud security posture management. DataDog is launching a product in that space, so we’ll be hearing about the types of issues CSPM products can help to unearth.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• Ransomware attack threatens Australian and US beef supply
• Talos dubs Russian ransomware crews “privateers”
• NYTimes writes another bad story
• More Fortinet pwnage
• Belgian government rolls Hafnium IR and finds, well, something else
• Google unveils new rowhammer techniques
• Much, much more

Haroon Meer of Thinkst Canary is this week’s sponsor guest. Thinkst is spinning up a labs division, but they’ll be doing something different to the same-old bug hunting. That’s a quality conversation.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• The latest news on the health system ransomware crisis in Ireland
• TSA to force pipeline operators to disclose attacks they probably aren’t detecting anyway
• Colonial paying ransom angers US congresspeople who really haven’t thought this through
• Iran targets Israeli systems with new wipers
• Israel targets Hamas systems with guided munitions that go bang
• Much, much more

This week’s sponsor guest is Ryan Kalember, EVP of Cybersecurity Strategy at Proofpoint. He joins us to talk about how compromised o365 accounts are powering all sorts of threat actors right now – from ransomware operators to BEC crews and APT units, everyone loves a popped mailbox.

In this podcast we’ll be hearing from an Australian politician, Tim Watts. He’s a member of our federal parliament and serves as our shadow minister for communications and cybersecurity. For our overseas listeners, the “shadow” part of his title is there because he’s a member of the opposition party, so he’s not in government. But, of course, if the Labor party wins the next election he’ll be our communications and cybersecurity minister.

Anyway, Tim is a bit of an anomaly in politics because he has a genuine, nerd-like interest in the field we so love. Tim and I chat pretty regularly, and I can say that yes, 100%, his interest in this field is genuine and he has a firm grasp on the issues that matter.

I thought now would be a great time to run an interview on the politics of infosec. While it’s true that policymakers spend time thinking about this stuff, cybersecurity hasn’t yet crossed over into being what they call a “retail politics” issue. But thanks to the Colonial pipeline ransomware incident, that might be about to change.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

• The aftermath of the Colonial ransomware attack
• Biden signs cybersecurity EO
• DarkSide crew hounded off the Internet. For now.
• Ransomware campaigns continue, hitting health, insurance targets globally
• IIS PoC released
• Rapid7 discloses Codecov-related source code breach
• Much, much more

This week’s show is brought to you by AttackIQ. Its VP of Product Mark Bagley and Senior Director of Cybersecurity Strategy and Policy Jonathan Reiber are this week’s sponsor guests.

As regular listeners would know, Snake OIlers is a wholly sponsored podcast series we do here at Risky Biz HQ where vendors give us money so they can come on and pitch their products to you, our dear, dear listeners.

And we have three vendors along today to pitch you:

• Google Cloud Security is in the top slot pitching their Zero Trust product suite BeyondCorp Zero Trust for Enterprise.

• Devicie, an Australian startup, that developed a solution that makes Microsoft Intune useable.

• Trend Micro joins the show to talk about its latest XDR features