Beers with Talos Podcast

Recorded May 11, 2020 – Craig wins MVP of the podcast for his attempts to avoid discussing… something. Anyway, we went a little long on this podcast, but stick with us as we wind through the recent Executive Order on cybersecurity, and then discuss another… interesting take on how we should then combat these new threats. I feel almost obligated to let you know before you listen, it’s a letter of m...

You’re not going to believe this, but everyone actually agreed on something in this episode. And no, it’s not regarding the best flavor of beef jerky. In this episode, we discuss a new category of threat actors that we’re choosing to call privateers. The guys discuss why this classification is much needed in the security community, the previous research on this topic, and the ways private security...

Most people would expect us to approach the Winter Olympics from a security perspective. Why are athletes using burner phones? Are we worried about any state-sponsored attacks? Not this year, folks! Instead, we rank each country’s curling uniforms, discuss the origins of ski jumping and debate which events would be the most difficult to compete in. On the actual cybersecurity front, we did carve o...

Re-uploaded on July 22, 2022 to fix audio issues — We’re back from RSA, Cisco Live and COVID breaks (yes, those things are all absolutely related). Paul Eubanks joins the show to talk about his recent blog post on unmasking ransomware actors on the dark web. He’ll go over several different tactics he and his team use to remove actors’ anonymity that’s so important when actors are working on these...

We’ve all heard that popular refrain by now: “Well I have nothing to hide so I don’t care if the government sees my data.” This week, we tell these people they are completely wrong. Ashlee Benge joins the show to discuss her upcoming BlackHat talk on the types of data and personal information health apps track. This has taken on special importance in the overturning of Roe vs. Wade in the U.S, mak...

We wanted to prep for the RSA/ Cisco Live stretch of June by looking back on security conferences past. Mitch, Matt and Liz got together to talk about their best and worst conference memories. Plus, Mitch has an overview of everything Talos is doing at RSA and Cisco Live, including a LIVE episode of Beers with Talos next week at RSA. There is a little security talk at least, as we also cover the l...

This is a very different episode in that it isn’t really a BWT episode at all. Hazel Burton from the Security Stories podcast invited Matt and Mitch to come on with the leader of Talos, Matt Watchinski. The idea was to chat with Hazel and her co-hosts Ben and Sana about burnout from three levels of a security research team. What followed as we all started talking was real and unfiltered conversati...

Recorded March 30, 2021 – What better way to discuss supply chain attacks than to have Matt demonstrate how easily you can blend your payload into normal operations via Twitter shenanigans? We’re talking about (surprise!) supply chain attacks and how their rise to prevalence is notable, albeit expected. Supply chain gets linked in with privacy concerns as we round out the ep discussing the Signal/...

Recorded March 2021 – ICS and SCADA systems are deeply embedded all around us in critical infrastructure. Today we talk about some of the inherent issues in infrastructure security and take a wide-ranging look at the ICS- and SCADA-specific issues found there. Joe Marshall from the Talos Outreach group joins to share his insights on the space and how donuts are the ultimate career track switching...

We’ve been quiet for a minute, but we have a few new EPs ready to go, starting with some of your questions from Twitter. And yes, one of the first questions concerns Craig and the robots. Do you have a question you’d like to ask us for the next listener questions episode? Send us a tweet (links below). Ask us anything security related or something else entirely. It’s your question, I’m not going t...

Recorded January 8, 2020 – It’s hard to believe that we have made 100 episodes of BWT. It easily feels like two or three times that many. This is a long winded show, as we welcome back our buddy Nigel for this special milestone. As an unintentional nod to our early episodes, the opening roundtable gets way off track and we basically host an “In-between” ep in the middle of a regular show. We also...

This EP was recorded toward the end of the year and lived a quiet, but meaningful life in the production queue patiently waiting it’s turn to get released. In this Ep, we dig into a discussion on passwords and some of the issues both conceptually and in practice. Passwords aren’t inherently problematic, but how they are used…sometimes is. We discuss best practices to share with your friends and al...

Recorded early November, 2020 – This is an EP we recorded in early November but got pushed back in the end of year shuffle to make production schedules work. We’re happy to put this one out now with somewhat belated takes on (somewhat recent) health care ransomware attacks. We discuss a few key questions that are rather evergreen. Why is health care targeted in this way (and other verticals for th...

Recorded November 24, 2020 –On this EP, Mitch and Matt are joined by Wendy Nather to discuss the newly released Cisco Security Outcomes Study. The results and findings of the research are interesting and somewhat surprising. As often happens with most good research, we end up asking more questions - in this case, geared toward the nature of the relationships found in the data. Special thanks to We...

We got delayed with the holidays and PTO, but here is a long awaited ep. The rest of the year is on deck to release through the holidays, so fret not. In this EP we talk about QR codes becoming pervasive as easily deployed “touchless tech” (and how they could help the robots try to kill Craig), and then we take a look at some recent DOJ and APT activity that begs the question: is bringing charges...

Recorded October. 9, 2020 –We are running a short bench today after Nigel’s retirement and Joel being on vacation. We start off talking about how specific use cases don’t equate to the death of entire defensive technologies, despite the frequent assertions otherwise you may find on Twitter. The key to defense in depth is that no silver bullet stops everything - nothing is surprising here. The big...

Recorded Sept. 25, 2020 –Today is Nigel’s last episode as a regular host of BWT. Join us in wishing him a happy transition to his next chapter - as we all know, Nigel won’t ever actually retire. Today’s show is us chatting with Nigel - about his career and his take on the industry as he entered, and now as he moves on to whatever comes next. Every aspect of Talos is better off because Nigel was he...

On today’s show we take several of the larger security myths that are often heard around things like patching vulnerabilities - specifically the notion that more patches indicate less secure software. We also talk about other “common knowledge”-esque bits of advice we’ve all often come across. We could do a whole episode on silver bullets that (spoiler alert) weren’t. Let us know some of your favo...

Disinformation is front and center right now. As disinformation efforts constantly increase, platforms struggle to contain the problem without giving the appearance of censuring or controlling all information present. A Talos research team recently published some findings on the building blocks of disinformation campaigns (available via link below). Special guest Kendall McKay joins us to discuss...

Recorded August 14, 2020 –Let’s talk about FUD - it’s not enough to just say FUD sucks. Let’s talk about exactly how and why producers of FUD are garbage nightmare monster people. We also cover how they are actually damaging themselves, not just the people and organizations that buy their hype. We have rather strong opinions on this, so we invited Meredith Corley, an actual professional on the top...

Recorded July 31, 2020 –This week in BWT land, we’re discussing hacktivism - from the unintended consequences to the tropes perpetuated by Hollywood. Regardless of the reason or cause, hacktivism often wields DDoS and web defacement as easily deployed tools. We discuss some instances where using code as a weapon without deeper understanding can have disastrous consequences. The crew also digs deep...

Recorded July 17, 2020 –The gang’s all back this week, and we take on what happens when you get pwnd, hacked, or your data is leaked. It happens to all of us eventually, one quick moment connecting to public wifi, clicking on a bad link when you just aren’t paying enough attention, or your account data is leaked through no real fault of your own. So, what do you do first when it happens to you? Su...

Nigel is out this week, but we have a couple light and breezy topics on the docket: 0-day research and the institutions of democracy. FUN STUFF!! First, we chat about 0-day research tools and the questions raised around them, contrasted to the time before security research was widely accepted. We spend the last half of the show discussing some of the findings and finer points of Matt’s recently re...

Has it been 3 years already? We have a great episode to celebrate! We start off chatting about the origins of BWT and what made it… I don’t know… the way that it is. We also have some great guests. Hazel and Ben from the Security Stories podcast come by to talk about another anniversary of note to all of us - NotPetya. We also chat about what makes storytelling a powerful tool (even in security),...

Recorded June 5, 2020 –Prod. Note: Things are a hot mess right now and the team thinks that there are voices you have needed to hear more than ours, so we held back on releasing a few episodes. This is the last of those withheld eps, please pardon any weeks-old info. Be safe, be kind, and listen to each other. Black lives matter. This was a difficult show to make in light of the events the week pr...