Down the Security Rabbithole Podcast (DtSR)

Today I had the pleasure of sitting down with one old friend, and one new. As a speaker at the HTCIA International conference, and the CISO Summit - I had the opportunity to gain some valuable insight, meet lots of excellent leaders, and force some new relationships. As a wonderful side-effect I had the pleasure of sitting down with Mike Murray of Mad Security, and Vince Skinner an attendee of the...

I want to thank our guests - Beau Woods and Joe Knape for joining us this morning. It was great to have these two well-versed commentators on the show ...vote with your downloads folks - if you want to make this a regular thing leave us a comment! Topics Covered RedHack 'hacks' Turkish police website, stops border traffic? -  http://www.hurriyetdailynews.com/redhack-hacks-turkish-police-...

Every once in a while this podcast has a guest who makes us truly feel blessed to be doing this - Rob Dubois is one of those people. If you don't know anything about Rob, go read his website, listen to this podcast and check out his book. He is a real American hero, a fantastic human being, and a true patriot. On behalf of James and I - I want to extend a hearty thank you for the time Rob spe...

Since James is out this week with something called "work", I've pulled in two friends (affectionately known as "The Joshes") Josh Marpet and Josh C . Big thanks for these fine gentlemen for stepping in and co-chairing this Monday morning quarterback session... I hope you enjoy! Topics Covered Fraudsters target "wire payment switch" at banks to steal millions  - ...

In this episode... Rob gives us a little history lesson Rob keeps going on the history lesson, IDS, open vs. closed circuits We discuss "defense in depth" from back-in-the-day James re-introduces us to the "security onion" Rob talks about "programming for super-high-speed" and scale Constructing things to truly "build scalability in"... Designing networks as...

Topics Covered The trash bin that stalked me (seriously, only in London) -  http://arstechnica.com/security/2013/08/no-this-isnt-a-scene-from-minority-report-this-trash-can-is-stalking-you/  and a follow-up as we recorded today:  http://www.bbc.co.uk/news/technology-23665490 No data breach in Indianapolis, after laptop stolen/recovered -  http://www.theindychannel.com/news/call-6-investigators/sta...

In this episode... Dave reminisces a bit... Dave discusses 'digitall signed malware' and that it means We discuss whether it's true that 'all networks are compromised' We discuss consumer-grade vs. corporate-grade threats, and why they're different An interesting point by Dave about why enterprises aren't learning from  their compromises We discuss customized mal...

Ladies and gentlemen, we are over the 50 episodes mark !  If you've enjoyed the podcast, please go rate us in the iTunes store, or leave us a note here. Have you checked out past episodes?!  There are some gems in there, I promise, and worth your time. Topics Covered Charlie Miller and Chris Valasek demonstrated (and will disclose code to) the hack which allows complete (tethered) remote cont...

Welcome down the rabbithole as we hit EPISODE 50! I'm thrilled that we've made it this far, and look forward to having you along for the ride into the future! At this point, I'd like to encourage you to listen to some of the fascinating guests we've had on this show, people I'm proud to have had a chat with, in the past archives... suggest guests, or just leave us a commen...

Topics Covered 9 Years After Shadowcrew, Feds Get Their Hands on Fugitive Cybercrook http://www.wired.com/threatlevel/2013/07/bulgarian-shadowcrew-arrest vBulletin Forums compromised (~15-~150k) to serve malware http://news.softpedia.com/news/Around-150-000-vBulletin-Forums-Compromised-Abused-to-Serve-Malware-366442.shtml America's EAS (Emergency Alert System) is open to compromise (still) ht...

In this episode... We get a little insight into the mind of Tomer, and how he thinks about security We get an insight into what HP Software IT Management is doing to ensure security in the products they release We discuss making security more than just a security  line-item, and a business requirement There are many " uncomfortable pauses " :) We discuss Tomer's risk-focused approac...

* Apologies for this very important episode getting out a bit late ladies and gents, experienced a loss in the family so things were a little slow to re-start, we should be back on track for next week's episode. Topics Covered Political hacktivism is making a big splash in international news -  http://www.ilovechile.cl/2013/06/17/chile-democratic-partys-official-site-hacked/87737 http://www.k...

In this episode... The gang discusses the issues with the rapid escalation of connectivity in modern-day industrial control systems What specialized skills are needed to be a SCADA or ICS hacker A nervous pause as vulnerabilities in ICS systems which could affect the adult beverage industry are touched upon Discussion on how to deal with 25 year  patch cycles Why is it that embedded devices simply...

This week, James is flying solo on the microphone catching you up on all the latest news and BIG  stories since I'm at HP Discover, Las Vegas and Suits and Spooks in La Jolla, CA. A busy week all the way around, some pretty earth-shattering news coming out! Topics Covered We couldn't be the only ones NOT covering the big NSA leak and revelations of spying and other surveillance. Somewher...

In this episode... We discuss the true nature of many of the security products decisions CISOs have to make every day Frank and Raf make very poorly thought-out sports analogies There are uncomfortable length of silence ( mostly edited out ) The crew discusses NSS Labs, and what they do to help the CISOs out there make smarter decisions "Someone" asks about anti-virus... [ More info on N...

It's June already?! Where has the first half of 2013 gone? James and I break down the last 2 weeks of interesting InfoSec news in a short "Monday morning quarterback" style... enjoy! Topics Covered Evernote adds 2-step veficication for their authentication, and follows suit with just about every other 'modern' app. Following on the hells of Twitter, LinkedIn, FaceBook, App...

In this episode... John  discusses some of the foundational principles of Threat Modeling We talk about why threat modeling is like your time in high school We discuss why threat modeling is such an incredibly important tool to the enterprise John gives us some nuggets of his experience with threat modeling enterprise applications Guest John Steven ( @m1splacedsoul ) - John Steven is the Internal...

Welcome to Monday, May 20th 2013 as James and I discuss the last 2 weeks' worth of Information Security news and relate it (attemptively) to your enterprise day-job. This week was a bit on the lighter side, with the quote of the year (as far as I'm concerned) winner going to the Washington State Administrative Office of the Court for ...well, you'll just have to read the rest of the...

In this episode... Kevin, James and I discuss why penetration testing reports are often so worthless Kevin and I disagree. Then we agree, sort of. We discuss the major differences between the 'builder' and 'breaker' mindset, and whether they're actually different  people Kevin gives some fantastic examples of how context and experience is critical in penetration testing We...

It's another beautiful Monday (somewhere) and we've got the news of the last 2 weeks covered, and we're breaking it down for you. The news this week is, well, quite frankly kind of dark. Everything tells us we're in for a rough ride for the rest of the year, and it's only getting worse. If I sound a little funny, it's because I'm talking through a massive sinus i...

In this episode... Live (live-to-tape) from 44Con, London, England. It's amazing, listening to this episode recorded at 44Con last fall, how little the landscape of enterprise security has changed. I took some time during the busy conference to sit down with Ian Amit and Dennis Groves to discuss Ian and my talks (which were perfectly aligned, and completely unplanned!) on the state of securit...

It's Monday April 22nd, 2013, and here are the topics from the last 2 weeks James ( @jardinesoftware ) and I ( @Wh1t3Rabbit ) will be talking about as we Monday-morning-quarterback the last 2 weeks in Information Security... Fair warning, we have way too many topics to fit into 20 minutes... so went a little bit longer but both feel it's well worth your time. Laugh, cry, and be informed....

In this episode... A critical discussion on the available 'cyber intelligence' reports from various vendors How hard is attribution in cyber space, really? "Alternative analysis" - why isn't it being used enough in cyber intelligence reporting? Discussion on 'degrees of certainty' and its apparent lack of application to cyber intelligence Extensive discussion on...

In this second episode of our Monday morning InfoSec quarterbacking, James and I actually got through the news items we had lined up in just about 20 minutes. I count this as a win. Topics Covered Choice Escrow & Land Title, LLC vs. BancorpSouth, Inc. | At issue is the Uniform Commercial Code (UCC) as it applies to commercial entities taking "commericially reasonable methods" to secu...

First ...a milestone. I want to take this time to formally welcome Mr. James Jardine , of SecureIdeas, as my permanent co-host to the podcast. James has experience podcasting as he already co-pilots the Professionally Evil Podcast , and he's witty, knowledgeable, and awesome to work with on the microphone. I ask that you all give James a warm welcome! In this episode... Overview of what cyber...