Real CyberSecurity

Was in-person RSAC only a year ago? Selling passwords for candy bars, thinking back to RSA 2020, the good and bad of virtual events, and green M&Ms. Virtual cybersecurity events need to be a rethinking of the event format, not the worst of both worlds. And stop recording sessions months in advance. And Zoom backgrounds.

Greg talks 6G security, allowing Bill to explain the real cybersecurity of 5G security. this leads us to the nexus with how the next gen of communications will need trustworthiness for connected cars.

Bill and Greg dissect parts of the SolarBurst and water filtration hacks, and Bill confirms that all criminals wear hoodies so Greg proposes banning hoodies. We cover the issues of Supply Chain security.

Brian Reed is proof that you can be smart, nice,  a great father, and successful in security. Brian is a long time Atlantan (the city in Georgia, not the underwater one) and has been doing security IBM, ISS, Gartner and Proofpoint. Brian talks about: - 2021 and the nexus between the upsides of DLP and the risks to privacy and surveillance if not done right. - Remote working and security. - Bill&ap...

Bill shines a flashlight on the truth about 5G radiation, and shares his chicken recipes to demonstrate the difference in spiciness. We get seriousness about the security relationship between IoT and 5G and why they are so closely linked.  Bill says good things about Christopher Krebs. Greg explains that investors and products buyers look at security companies differently. Greg laments the greed-o...

Greg and Bill interview John Pescatore from SANS about what's going on in the whacky world of cybersecurity. We cover a lot of ground including the breadcrumbs that attackers leave, the history of SANS, what are the big topics in the SANS community, Zero Trust, supply chain security, 2FA - why isn't it standard?, bug bounty programs, and the idea for a Netflix reality series called &quot...

Bill updates us on some recent threat and vulnerability reports. Greg thinks that all CIOs need an animatronic CISO hype-man, and that people would pay money to have sanctions against them announced by an evil foreign government. Our oddball segment of the day is what mugs we have on our desk. How we build and deliver a great security presentation, but we talk about when we bombed. Bill says Moby...

Live (virtually) from Black Hat we give an update on what is being focused on.  We agree that presenting without a live audience requires a different approach than live stage presentations. Bill reaches for smelling salts when  confronted with rogue industrial robots, and Greg thinks secure voting is easy.  Yes, really. 

Bill and Greg cover the recent Twitter breach and try and unpack what maybe happened and what lessons we can learn from it. We invent a security axiom of "Occam's Younger Dumber Brother's Razor". We recount some insider cases, how too often good deeds are punished, and we give some career advice. And what is becoming a regular segment, we disclose what we're currently read...

We take a helicopter up a few thousand feet to suss out what cloud security is really about. What security problems does cloud fix?  What security problems does it introduce?  One hypothesis is that a lot of IT is unnecessarily 'custom', and so is the security with it.  The reality in the world is there is still a lot of on-premises IT, multi-cloud, and shadow IT today. Bill brings up th...

Current events are highlighting the nasty issues around privacy and broad surveillance.  As some companies announce they will no longer support certain applications of facial recognition we discuss the shift in privacy to being up to the individual.   We talk about "The Channel" during the week when Canalys releases their annual Global Cybersecurity Matrix.  No not TV channels, but the c...

We discuss the issues of dishonesty in cybersecurity marketing, that it's OK to not speak at security conferences, a bunch of non-traditional book references for cybersecurity, and our favorite conferences .  And Bill ends up in Facebook jail for crimes involving cat videos.

Bill gets thrown in Facebook jail for crimes involving cat videos.  We talk about how the importance  minimizing Peak awesomeness is achieved when Bill gives us the security book recommendations from our listeners.  And we lose our minds and go on a security book recommendation binge ourselves. We revisit election security.  Greg has false negative brain syndrome because gets his spies mixed up (A...

We return after Bill has recovered from a denial of service attack, and cover the basics of where MITRE ATT&CK fits into the security world, and how Greg is a fan of it after his initial skepticism. Where does IoT fit into MITRE?  Bill poses a big question - is remote voting security possible?  We agree that ML and AI in automated screening out of job candidates is a garbage practice, and fini...

We kick off with much discussion on CISOs: the secrets and qualities of successful them, where they fit into the org chart and their role and how that has changed.  XDR - what is it?  We try and parse out what XDR means vs platforms, how it helps threat hunting, and how it deals with issues such as alert fatigue, and obfuscation. We also hear that Greg got a haircut from a professional stylist dur...

There's a lot of discussion about webconferencing security, so we do some more! We agree on and name the must-see movie about spies, the difference between stealth and force in locks and lockpicking, attackers playing the long game, and Bill mentions the Mythical Man Month (which is not a statutory holiday). The podcast Greg mentioned was "I Spy" by Foreign Policy.   https://open.sp...

This week we cover a few hot topics and it's a good one. Supply chain integrity is a big one.  And we talk worst security practices.  No, we aren't recommending these.  We discuss about why Y2K provides us with lessons we need. Bill tells a great story about back up tape retrieval and airports, and some good advice on consequences and clear code. Greg relates the story of tampered typewr...

Telework is a big topic right now, and with any big topic we need to answer the questions about security.  Who better to bring on and chat than John Girard?  Recently retired (although up to more mischief than ever) John spent 25 years at Gartner, leading topics like SSL VPNs and mobile device management.  So join John and us talk about telework security, but also some non-security telework advice...

Telework is a big topic right now, and with any big topic we need to answer the questions about security.  Who better to bring on and chat than John Girard?  Recently retired (although up to more mischief than ever) John spent 25 years at Gartner, leading topics like SSL VPNs and mobile device management.  So join John and us talk about telework security, but also some non-security telework advice...

Spring is around the corner so when looking for a high grade fertilizer stronger than manure we decided to combine blockchain and cryptocurrency.  Blockchain is great security technology, but it is usually just badly implemented or treated like magic.  The anonymity and irrefutably are great features of cryptocurrency, but the evil side that stains the technology holds them back as ransomware payo...

Greg provides his post-RSA Conference report.  We discuss the origins of worms and viruses, and continuous audit, Bill discloses his history in code testing, and why buffer overflows persist.  We  give a list of some cool AI-in-security use cases.  There's even a SoundCloud analogy. And more!

Bill and Greg interview Richard Stiennon, who discusses his new book Security Yearbook 2020 and how it is a survey and history of the industry.  We discuss that how non-security CEOs fare in the security market, and why non-security companies don't lead in security.  And how awesome/nasty an "I Told You So, Security Edition" book would be, how small the cybersecurity industry is, an...

Backdoors, software assurance, and supply chain are big topics in cybersecurity and related.  Backdoors can be intentional or just sloppy design.  The concern over manufacturer added backdoors in 5G has been a political and policy issue.  Bill and Greg discover a shared love of Vancouver bar bands of the 80s, and Bill plants a Beastie Boys earworm.

5G security is a real cybersecurity topic (play on words intended).  It's not just a mere upgrade from 4G, like 3G to 4G was.  The architecture of wireless communication is changing and driving more and different edge computing - security changes with that new reality.  And if that weren't enough buzzword-bingo, IoT security will change, and so will privacy and lawful intercept.

Bill and Greg measure the cybersecurity skills gap and find out that is may be measured in units of Mismanagementograms.  Bill seems to know a lot of companies in Southern New Jersey.  We give some career tips for anyone looking at getting into cybersecurity.  Greg mentions feral donkeys, and rants about automated HR CV filters that filter out qualified candidates.  Bill and Greg give shoutouts to...