Hacked Off

It's the last podcast of the year, so Holly is revisiting some of our key guest interviews from 2020. We also couldn't do a 'A Year in Review' without discussing the impact of the pandemic on business security, and how now is the time to revisit your change management and risk register. Key points: 0'34 Our new training course 4'00 Lockdown and change management 6'49 Time to review the risk regist...

Generally when you think of eCommerce attacks you probably think of theft of personal information and payment cards, when in fact there are many ways a hacker could attack your online store. Holly Grace discusses the most common threats to eCommerce businesses, and a few you may not have considered before! Key points: 0'47 CIA - Confidentiality, Integrity and Availability 1'38 Denial of Service At...

Application Program Interfaces have increasingly become a target for hackers. With 6 of the OWASP Top 10 vulnerabilities being API related, it is no surprise that OWASP released their first list of API Security Top 10, last year. For those wanting to better understand the process of API penetration testing, Holly Grace takes you through the process, from scoping the job to which vulnerabilities to...

Is your online store ready for Black Friday and Christmas shopping? Have you considered how automated bots, fake reviews, plugins and a data breach could wreak havoc over the busiest shopping period of the year? This podcast is a perfect starting point for eCommerce businesses wanting to secure their business ahead of the mad rush! 0'52 Preventing the use of automated bots and buying scripts. 3'33...

This month there has been a lot going on in the world of cybersecurity. With major IT firm Sopra Steria getting hit by a cyberattack, Apple paying out over $250,000 to a team of bug hunters for finding 55 vulnerabilities in Apple systems, as well as the USA indicting 6 Russian Intelligence Officers for a range of attacks such as attacks against the Ukrainian Power Grid and the 2017 NotPetya attack...

Threat modelling is broader than just security, and DevSecOps is more than just secure code. Application Security Advocate, Alyssa Miller talks passionately about the importance of a collaborative approach to security, where implementing a culture of building efficiently and understand security as you go, can help with getting ahead of the game. 0'22 Alyssa Miller - the Application Security Advoca...

Mobile Device Management increases security, reduces risk and plays an important role in Government certified assurance models. Holly Grace discusses the role of device management for Cyber Essentials, and the challenges that come with employees using their own devices at work. Key points: 1'08 What is Mobile Device Management (MDM)? 3'05 Device Management for Cyber Essentials 8'27 Bring your own...

We speak to fellow co-worker and Senior Security Consultant at Secarma, Joe Thorpe, who specialises in app testing. He gives us the low down on hacking mobile apps, how they're similar to web apps, which vulnerabilities are most common and how to choose the right testing for your mobile app. Key points: 0'43 What is mobile application testing? 3'43 Similarities to web application testing 4'49 Find...

In September's Month in Review, Holly Grace is delighted to announce that this month's hacks aren't just all about ransomware! From political motivation to notoriety, she discusses the different kind of motives a hacker may have, and the kind of attacks they might use to get what they want. Key Points: 0'55 Financially Motivated: KuCoin Hack 3'07 Insider Threat: AT&T Hack 7'09 Politically Motivate...

There's more to firewalls than simply installing them and leaving them to it! WatchGuard's Senior Sales Engineer Martin Lethbridge, joins Holly Grace Williams to discuss common firewall misconceptions, and how to get the most out of your firewall to ensure your organisation is safe. 0'22 Guest introduction 2'10 Firewall misconceptions - they aren't just for your network perimeter 6'52 Protecting y...

Although perimeter breaking vulnerabilities are quite rare they're certainly not unheard of - Firewalls aren't perfect systems and they can have vulnerabilities too. In this week's episode, Holly Grace looks at some previous critical vulnerabilities in firewalls and tries to highlight some key lessons learned. 4'37 The firewall vulnerability 'BEIGNCERTAIN' 7'22 Protecting your organisation against...

Our latest 'Intro' podcast takes a look at Firewall Security. Holly discusses different types of firewalls, the importance of network segmentation and Firewall Configuration Security Reviews, and how firewalls are targeted during a pentest. 1'30 How firewalls are they targeted during a Penetration Test? 8'29 Network segmentation 11'08 How threat actors jump between networks 13'56 Next Generation F...

From bribery to bug bounties! In August's Month in Review podcast, Holly Grace discusses the failed social engineering attack on a Tesla employee, and the uproar off the back of Slack's minimal payout to a researcher for a critical security bug. Key points: 1'20 The failed social engineering attack against Tesla 3'05 How to test your organisation against bribery 8'21 Critical security bug discover...

Whilst Secarma perform Penetration Testing which is in-depth approach to security testing, organisations can get additional assurance through ongoing automated security scanning Nick Blundell, AppCheck's Head of R&D, joins us on our podcast to discuss how vulnerability scanners work, their pros and cons, and how they compliment Penetration Testing to achieve a balance of depth and frequency. 0'20...

The OWASP Top 10 is a list of the 10 most common web application vulnerabilities. This podcast provides an introduction to this awareness document, and why it's so beneficial to organisations and their journey to better security. Key Points: 1'00 Who are the Open Web Application Security Project? 2'18 What is the OWASP Top 10? 7'55 The current OWASP Top 10 list 9'04 Why it's such a useful document...

This podcast provides an excellent introduction to vulnerability scanning, covering how it works and what it tests. It discusses the benefits of vulnerabilities scanning and how alongside penetration testing, can provide an organisation with a more continuous testing model. Key points: 1’34 What is vulnerability scanning? 2’16 What does vulnerability scanning test 9’09 How a scanner grades a vulne...

In July it was revealed that travel company CWT paid $4.5 million in ransom to cyber criminals. Whilst shocking, ransomware is unfortunately not new and not uncommon. Secarma’s MD, Holly Grace Williams, discusses why ransomware is such a popular option for cyber criminals and how companies can prepare for potential attacks with incident response training. Key Points: 1’05 Paying ransoms 2’00 Why i...

After a brief break, the Hacked Off Podcast is back! If you missed our MD’s Trusted Tech Talks webinar last week, Holly Grace Williams summarises the key points of her presentation, Encryption isn’t Magic: Hackers Can Break It. She discusses why encryption is a little more complex than being on or off and the importance of configuring it correctly. Key points: 0’33 Introduction 4’20 Cyptography la...

In today's episode we talk about penetration testing realism versus efficiency, and why sometimes aiming for a security test that exactly matches the options available to criminals isn't always possible and why sometimes it isn't always desirable. It's all about the context. Key points: 1'05 The motiviation behind an assessment is key 2'10 When realism is key 3'45 when total realism isn't possible...

Privacy is a right and it is important to protect that right, but operational security it hard. Mike Jones joins us again to talk all things OpSec and we cover some things to check to make sure your privacy is protected. Key Points: 1'30 Why is Privacy important? 4'20 Photos, GPS and Geotagging 10'15 Social Media settings 12'15 Removable Media 14'15 Communications security and Leaks 18'00 Privacy...

In today's episode we talk about incentivising your Security Team and making sure that the defensive team are getting praise for a job well done. As well as noting that the red team's job isn't over when they find a high impact vulnerability. Key Points: 0'49 There's more to staff retention than bonuses 1'40 The problem of the romanticisation of the red team 3'30 Measuring progress in security imp...

Adam Louca joins us today to talk about how to get the most out of security products, and how to cut through the marketing to find out what works for you! Key Points: 0'30 What is a technologist? 2'05 Why do we have to cut through vendor noise? 4'21 How you can determine the truth of products 9'25 Planning for the unknown 12'00 How to know products are working 19'50 Network segmentation, antivirus...

Kevin Fielder joins us today discussing building security and building security teams. We talk risk appetite, balancing likelihood and impact, and team culture! 1'20 Where to start 4'00 Risk Appetite and moving quickly 11'13 Balancing appetite, likelihood and impact 15'15 Keeping the security team happy 18'45 Team Culture 25'45 Team Development and building Careers 38'25 How DevOps affects buildin...

Today we have a Marc Avery, Kevin Fielder, and Sean Atkinson discussing how to build a business security strategy. We talk about cyber insurance, operational security, and building security in companies. As well as detours to talk about Equifax getting hit by Hurricane Irma, the problems of working from home, and company culture. Key Points: 01'00 Guest Introductions 05'10 The security risk of the...

Mike Jones is a former member of anonymous, a former confidential informant, and is here to talk about building better security. We talk about everything from Cyber Prevent programmes to help people avoid becoming cyber criminals to becoming a better penetration tester. 01'12 Working with Anonymous 03'25 Meeting with the Suits 04'18 Working as a Confidential Informant 16'50 A hacker's impression o...