DrZeroTrust

SECOPs teams have faith in the their tools, but question if they will "miss" something? What? Administration releases plan for IoT security and labeling, how will it work? Top10 predictions for 2023 and security. That Zero Trust thing is still in there I hope. The upcoming election and the explosion of AI are already going bonkers, what is next? Those questions and more insights on this episode!

An AI girlfriend talked a kid into trying to kill the Queen of England with a crossbow, yeah. Fortinet vulnerability, how bad is it and are we patching fast enough? What is the number one avenue of exploit for cloud? Hint, it rhymes with bumans. Japan's largest port is under ransomware attack, uh oh. What CEO's really think about their security teams from the World Economic Forum, and more on this...

An event in NYC with BeyondIdentity made me sad for the state of the market, why? What happened with the Supreme Court and the 1st amendment via cyberstalking, huh? "Never before seen hacking tactics" from Chinese APT says Crowdstrike, you sure about that? A church brings "AI" to preach, did they just impact religion? Those points, some hard hitting questions and more on this episode!

Is it possible to take a different approach to threat detection and do better? Why are endpoint security solutions missing the threats that we buy them to detect? Is a counter-terrorism method applicable to threat hunting? How does malware evade allow listing in some instances? What gaps in coverage are we seeing from methodologies for threat intelligence? Those questions and more on this episode!

Samsung is dealing with an insider threat that tried to copy their entire chip manufacturing plant, wow! CISA issued a "binding" directive for ZT, but how binding is it really? The top 10 from the Verizon DBIR, what does that tell us about the space? Another Presidential candidate uses a deepfake to target their adversaries, should we worry? A mother deals with a deepfake voice attack where her da...

NSA released a guide on securing remote access, cool so what should we learn from it? ILTA has produced a study about law firms and their cybersecurity practices. Are they prepared for the threats they face? Deepfakes are showing up on TikTok with stories from dead kids asking for followers (seriously). Lumu published a blog on how MSSP's can adapt to better server their customers. What should we...

Youtube flagged my content for PII violations, but what did I do to get put in the penalty box? CISO's plan on investing more for cybersecurity over the next few years, new research from Nuspire indicates the growing spending trend. Mitiga has found some configuration issues with Gdrive and Gsuite, what should businesses know to defend themselves? Armorblox says brand impersonation is increasing,...

Ever wanted to learn the difference between a Lama and an Alapaca, we talk about that here. Weird but interesting. Crowdsec discusses their approach to changing the way we handle malicious IP's and domains. Their approach to Zero Trust as part of a global network is innovative. We chat about how open source solutions can help businesses of all sizes better defend themselves. Some discussion on col...

Should we be concerned that our leaders (and former leaders) are posting deepfakes onto social media? What can we learn from the Uber case and the final decision by the lawmakers? What did the general counsel do in that case, what about the CEO? How should we plan for a ransomware attack? Can we learn from the lessons that a CISO has been through and be better prepared (hint: yes). When is the bes...

Are K-12 organizations and universities prepared for the onslaught of cyber threats? How long does it take me to find a vulnerable school district, it ain't long? An appeals court has upheld Merck's claim in the the NotPetya case. What does that mean for cyber insurance, and why does this make me so happy? Iran is moving quickly into the realm of influence operations, are they mirroring the Russia...

How hard is it to use "ai" to clone your own voice? I did it and you can hear the sample on this podcast. What should we learn about the recent Pentagon leaker? Was it a technical failure, insider threat, of failure of leadership? What does MIT say about privacy for ChatGPT and "ai" and are there violations taking place? Are MAC's a viable target for ransomware, seems like that is a reality now. T...

Can ChatGPT make me a less crappy programmer? That isn't hard to be honest, but there are implications to consider. Can you use AI (I really hate using that term but you can't beat the market I guess) to be an artist? Does that impact other talented people's future earning potential? How hard is it to use StableDiffusion to create bogus images? How bad was FTX's cybersecurity? Hint: It rhymes with...

How many vulnerable systems out there are connected to the internet with a ten year old vulnerability, with RCE, and have no authentication? Surely the answer is 0? Operation Cookie Monster took down a dark marketplace, so what? Should there be a victory lap? KnowBe4 published some research on state and local security and BEC statistics, what should we learn from that document? Fake ransomware att...

Did the Pope wear a puffy jacket? So what? How might applied deepfakes be used to manipulate the collective narrative? What about our political system? Cofense published their annual report on the state of email security. What can we learn from that? Cymulate also published their analysis of more than 1 million security assessments. What's in there for us to learn? Lloyds CEO said they might take...

Not Blockchain...Or, kinda...But not really?  Anyway listen to smarter folks than me (lots of those) talk about how we can innovate around the use of distributed ledgers as part of a security strategy.  And how is this approach being accepted internationally, especially in Australia?  Cool new methods of enabling security with the folks from Tide (not the soap, the security guys).  Some solid conv...

Did I spread misinformation about the SVB fiasco? Uh oh.  Did Ring get hit with ransomware, and are they secure?  What weird ports do Ring cameras use?  Rubrik has some issues going on, but did they handle it well?  Is it smart to market your organization or brand as Zero Trust?  Oh crap I am in trouble.  SpaceX may have been hit via a third party, ouch.  Why does third party risk continue to lead...

30% of dark web operators are women, according to TrendMicro.  That means more women are operating in the criminal side of cyber than on the defender side, wow.  The TSA is pushing new requirements for airports and airlines, but how secure are they and the FAA?  Layoffs are showing up in cyber, even though companies are doubling or even tripling their profits in the only market that has negative u...

US SOCOM had emails exposed to the internet for weeks thanks to a cloud misconfiguration.  Surely it's not still messed up?  Is the US Treasury as secure as it should be in regards to cyber?  What about using ChatGPT to send emails to students when a mass casualty event occurs?  Good or bad idea?  Does the Supreme Court understand the technology they are enforcing and drafting laws about?  What ab...

Should we worry about the spy balloon?  Why not?  Gartner published some "research" on Zero Trust and how they don't see the strategy as a silver bullet.  Awesome.  Let's analyze that game changing paper.  Venturebeat also published a report on how to get wins from your Zero Trust endeavors this year, what should we pay attention to there?  Why wasn't cyber a topic during the State of the Union?  ...

Can we have a national and international strategy that addresses ransomware?  How would that work?  Is it better to address the "how" of those attacks or the "why"?  What should we do to remove the incentive for these attacks?  Would a US first approach make us a bigger target?  What about kinetic attacks on those hacker groups?  Those questions and more on this super episode!

What happens when marketing attacks and goes "bold" without really understanding their position?  Is it smart to also not pay attention to your social profiles (lol)?  Why is the DoD Red Teaming their ZT providers?  Should you do the same as part of your strategy?  Why not?  Organizations aren't taking cyber warfare seriously according to Armis research, but why?  Is that wise?  Blackberry says ma...

What the h*ll is quantum really?  Why should we care?  Does cracking an algorithm with quantum change the balance of power globally?  Is quantum potentially a WMD?  How can this technology be used by our government and others?  What about the banking system and quantum applications and risks?  Those questions and more on this very nerdy episode!

Checkpoint released a report on the wrap up from 2022, what can we learn from that analysis?  It's a super cool report by the way, ping me for the link!  How secure or insecure are the education systems in the US?  Can I find some glaring issues?  China wants to "work with" the UN on addressing disinformation, ok.  Lol, sure.  What do they mean?  A major shipping system is hit with ransomware, uh...

Is TikTok really a threat to national security?  Why should we be concerned about this app?  Should your kids be on this thing?  What are the implications for national security and those folks who have clearances?  Where does this all go in the next year?  What about social media and the justice system?  Are you still able to get a fair trial in today's news cycle focused world?  How does that aff...

Welcome to 2023 y'all.  Let's get into the new year by looking at some news you need to know.  A major FAA system went down and caused an outage for all of Florida.  How secure is the FAA, and what about other airport safety systems?  Surely, no misconfigurations there.  Right?  Links to study guides for OSCP cert via Reddit, pretty cool huh?  A hospital was hit with ransomware then the bad guys g...