Take 1 Security Podcast: Episode 8

Take 1 Security Podcast: Episode 8



START CONTENT


* New SSL attack called FREAK


* Has to do with falling RSA back to a deprecated and weak level
* Requires the client and server are both vulnerable
* The solution is to patch
* Many orgs will also want to note which servers were vulnerable
* The lesson is that you don’t reduce security to increase it
* Backdoors x time = regret

* Using Ruby’s Open-URI could be dangerous


* open-uri monkeypatches kernel.open
* open(params[:url]) can execute |ls

* Hilary Clinton used a personal email address and did not store correspondence on government servers for her entire 4 years as Secretary of Defense


* This seems highly suspect
* First you’re putting that data at risk in a personal system
* Second you’re obviously trying to hide your conversations

* Facebook can access your account without your password
* Google no longer encrypting Lollipop by default


* Was one of the main selling points for 5, and now it’s gone
* They said it was simply a driver issue

* DLink routers have a remote command injection bug


* Could allow DNS hijacking and other attacks

* ISIS has threatened some members of the Twitter team for disabling their accounts


* This really puts a point on public presence for me
* I’m a strong proponent of the belief that the way to avoid attack is to avoid being a target, not to be hard to attack once people want to
* This works for personal attacks, not for countries obviously

* There has been some major fraud happening with people connecting stolen cards to ApplePay


* The issue isn’t a security problem with ApplePay, but rather with standard bank / card security issue

* Up to 18.8 non-Anthem customers exposed in the Anthem breach


* This is in addition to the 80 million actual anthem customers

* GoPro vulnerability on its website exposes customer Wi-fi passwords


* Expect more of this

* Uber took over 5 months to issue a breach notification


* There was a breach of driver names and license numbers that they just now disclosed

* Seagate NAS vulnerability allows unauthorized root access


* This raises the cloud storage issue I blogged about last week



END CONTENT

Play Podcast

Notes


* Sorry about my voice on this one. I’m a bit sick. :(

Become a Member: https://danielmiessler.com/upgrade

See omnystudio.com/listener for privacy information.

Episoder(532)

A Conversation with Abhishek Agrawal from Material Security

A Conversation with Abhishek Agrawal from Material Security

In this conversation, I speak with Abhishek Agrawal, co-founder and CEO of Material Security. We talk about: - Material's Security innovative approach to email security by not just preventing unauthorized access but also containing damage from potential breaches. -Abhishek's background in data infrastructure at Dropbox and how product mangers can become successful CEOs due to their cross-functional expertise.  - The need for customized security measures for different organizations, the role of AI in detecting email threats, the importance of single-tenant environments for sensitive customers and the potential risk of default settings in productivity suites like Google Workspace. Among other topics.  Abhishek's Background and Material Security (00:00:00)Email Security and Productivity Suite (00:01:01)Geographical Connection and Coffee Meetup (00:02:06)Product Managers as CEOs and Co-founders (00:02:59)Empowering Product Managers (00:05:01)Product Management and Marketing Importance (00:08:04)Email as a Content Repository (00:09:39)Securing Email Content (00:11:03)Data Protection for Email (00:12:10)Redacting and Canaries (00:12:57)Email Security vs. Data Security (00:14:53)Abuse Cases and Control Layers (00:17:32)Mailbox Compromise and Lateral Movement (00:17:39)Threat Scenario Analysis (00:20:15)Language Models for Detection (00:22:19)Optimism in AI Tools for Defense (00:24:34)Customized Detection Categories (00:25:52)Security Controls Trend (00:26:20)Security Concerns for Law Firms (00:27:07)Email Copy Distribution (00:27:24)API-Based Integration (00:29:08)Monitoring LM Functionality (00:30:42)Threat Intelligence and Detection (00:32:54)Product Design Philosophy (00:35:56)Data Protection (00:38:01)Flexibility in Deployment (00:39:26)Main Products (00:40:33)Posture Management (00:44:01)Broadening Product Coverage (00:48:49)Google Workspace Threat Detection (00:50:05)Challenges with CSP (00:51:13)Contextual Intelligence (00:52:02)Balancing Depth and Breadth (00:53:15)Learning about Material (00:53:40)Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

7 Jun 202454min

UL NO. 435: Making New Things is Post-AI Safety

UL NO. 435: Making New Things is Post-AI Safety

Jason Haddix's AI Course, Microsoft Recall analysis, exercise erasing trauma, AI and the jobs problem… ➡ Check out Vanta and get $1000 off:vanta.com/unsupervised Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

7 Jun 202424min

UL NO. 434: Can You Articulate Yourself in 50 Words?

UL NO. 434: Can You Articulate Yourself in 50 Words?

NetworkChuck's Fabric Video, Algorithms Replace Degrees, AI Transparency, New Grad Difficulty, Windows Goes Full AI, and more… ➡ Check out the Autonomous IT Podcast:https://community.automox.com/autonomous-it-podcasts-144 Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

1 Jun 202427min

UL NO. 433: China's Flawed Strategy

UL NO. 433: China's Flawed Strategy

A new book, A new Fabric pattern, Autonomous fighter jets, Friend trips, and more… ➡ Check out Vanta and get $1000 off:vanta.com/unsupervised Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

29 Mai 202410min

A Conversation with Mike Privette from Return on Security

A Conversation with Mike Privette from Return on Security

In this conversation, I speak with Mike Privette. Mike is the CISO and Cybersecurity Economist at Return on Security. We discuss:- The economic impact of COVID-19, the shift from prioritizing growth to operational efficiency, and the subsequent market crash and rebound in 2024. - The rise of AI in application security, the importance of trust and safety, and the potential for AI to enhance personal digital sovereignty.  -The changing dynamics of startups, venture capital, and private equity in the cybersecurity space.  Among many other topics. Introduction and Guest Welcome (00:00)Return on Security's audience (01:53)Economic trends in cybersecurity & COVID-19 (05:59)Shift towards operational efficiency in cybersecurity companies (09:39)Current cybersecurity trends and rebound effects (13:23)Application Security and AI (15:05)The Evolution of AI Security Companies (16:09)Trust and Safety in Cybersecurity & Discussing Deepfake videos (17:03)Validation of Ground Truth (19:18)Personal and corporate security from AI (20:31)Continuous Defender and AI Filtering (21:31)Validation of True Content to combat misinformation (23:23)AI for News Reports and Corporate Communications (26:16)The Future of AI Security (27:11)The trend of personal digital sovereignty (31:03)Private equity vs. VC vs. startups (33:36)Operational efficiency and the future of startups (36:29)Cybersecurity industry trends and data science (43:36)The Universal Dashboard concept (45:15)Sharing knowledge and connections (45:42)Check Out Return on Security (45:58)Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

24 Mai 202446min

UL NO. 432: Can You Summarize Your Work in a Sentence?

UL NO. 432: Can You Summarize Your Work in a Sentence?

Thoughts on GPT-4o, Dell's API Hack, Russian Campus Campaigns, Google's Pretend Work, and more… ➡ Check out Vanta and get $1000 off:vanta.com/unsupervised Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

24 Mai 202427min

A Conversation on Maritime Security with BlackBerry Threat Intelligence

A Conversation on Maritime Security with BlackBerry Threat Intelligence

In this sponsored conversation, I speak with Corey Ranslem, CEO of Dryad—and the resident expert on Maritime Attacks—and Ismael Valenzuela, VP of Threat Intelligence and Research at Blackberry. We talked about all things Maritime Security, and I learned a whole lot from the conversation. Digital Hijacking at Sea: Unveiling a Cyber Attack Scenario in the Red Sea BlackBerry Quarterly Global Threat Report — March 2024 Maritime Cyberthreats: A Growing Risk to Global Trade (blackberry.com) 00:00:00 Introduction and Guest Welcome00:00:30 Maritime Security Overview00:01:15 Baltimore Incident Discussion00:02:00 Legacy Systems on Ships00:03:20 Connectivity Challenges at Sea00:04:10 Cyber Threats in Maritime Industry00:05:00 Post-Accident Cyber Investigations00:06:00 Potential Cyber Attacks on Ships00:07:30 Threat Scenarios and Models00:08:45 USB and External Media Threats00:09:30 Evolution of Navigation System Connectivity00:10:30 Crew Connectivity and Cyber Risks00:11:30 Lessons from Other Industries00:12:15 GPS Spoofing and Navigation Interference00:13:30 Digital Hijacking of Ships00:14:45 Economic Disruption via Cyber Attacks00:16:00 Financial Motivation Behind Attacks00:17:15 Ransomware in Maritime Context00:18:30 Panama Canal and Economic Impact00:19:30 Cyber Security Maturity in Maritime Industry00:21:00 Legacy Systems and Geopolitical Interests00:22:15 Challenges with Security Solutions at Sea00:23:30 Historical Cyber Incidents in Maritime00:24:30 GPS Spoofing Techniques00:25:15 International Maritime Organization Standards00:26:30 Criminal Trends and Cyber Attacks00:27:45 Open Source Tools and Threat Actors00:28:45 Information Sharing in Maritime Industry00:29:30 Real-World Examples of Cyber Incidents00:31:00 Cruise Ships and Large Yachts Security00:32:15 Autonomous Vessels and Cyber Protection00:33:30 Future of Autonomous Vessels00:34:15 Learning and Improving Cyber Security in Maritime00:35:30 Role of Threat Intelligence in Maritime Security00:36:15 Optimism for the Future of Maritime Security00:37:30 Industry Awareness and Education Efforts00:38:30 AI Integration in Maritime Security Solutions00:39:15 Conclusion and Final ThoughtsBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

16 Mai 202440min

UL NO. 431: Companies are Graphs of Algorithms

UL NO. 431: Companies are Graphs of Algorithms

The US goes skills-based, AI is mostly prompting, simulation -> reality, 30 useful concepts, and more…… Subscribe to the newsletter at: https://danielmiessler.com/subscribe Join the UL community at:https://danielmiessler.com/upgrade Follow on X:https://twitter.com/danielmiessler Follow on LinkedIn:https://www.linkedin.com/in/danielmiessler See you in the next one!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

9 Mai 202411min

Populært innen Teknologi

romkapsel
rss-avskiltet
teknisk-sett
tomprat-med-gunnar-tjomlid
energi-og-klima
shifter
rss-impressions-2
elektropodden
fornybaren
smart-forklart
nasjonal-sikkerhetsmyndighet-nsm
rss-alt-som-gar-pa-strom
rss-alt-vi-kan
teknologi-og-mennesker
kunstig-intelligens-med-morten-goodwin
rss-snakk-om-sikkerhet
rss-bouvet-bobler
rss-digitaliseringspadden
rss-teams-cast-away
rss-bits-and-bytes-for-advokater