This week, Adam and Andy talk about Microsoft Teams and the post-exploit technique that was discovered by Vetra's Project Team and the decision of Patreon to lay off their entire internal information security team. The also talk about Uber's on-going cybersecurity incident including some initial reports of how it happened as well as mitigations to prevent this type of attack in the future.

-------------------------------------------

Youtube Video Link: https://youtu.be/FWnEma4hOWQ

-------------------------------------------

Documentation:

https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens

https://techcrunch.com/2022/09/09/patreon-security-layoffs/

https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless

https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-faqs

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy breakdown what led to Cloudflare dropping Kiwi Farms as a customer, why the media and Twitter were up-in-arms about the whole incident, and their thoughts about the decision.

-------------------------------------------

Youtube Video Link: https://youtu.be/NrNe_n95Tfk

-------------------------------------------

Documentation:

https://blog.cloudflare.com/cloudflares-abuse-policies-and-approach/ 

https://blog.cloudflare.com/kiwifarms-blocked/ 

https://rasbora.dev/blog/I-ran-the-worlds-largest-ddos-for-hire-empire-and-cloudflare-helped

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about cloud security. If you're looking to learn about cloud security concepts, this is the show for you. They talk about basic and advanced security as well as risk assessment and other things you should consider when designing and architecting your security in the cloud.

-------------------------------------------

Youtube Video Link: https://youtu.be/1sc1R8iL3wc

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy pull together all the new product launches and rebranding for Microsoft Security over the last couple of months. Listen in to learn about Microsoft Entra, Defender Threat Intel, App Governance, and Threat Experts.

-------------------------------------------

Youtube Video Link: https://youtu.be/PSm97tY4q1E

-------------------------------------------

Documentation:

https://www.microsoft.com/security/blog/2022/05/31/secure-access-for-a-connected-worldmeet-microsoft-entra/

https://docs.microsoft.com/en-us/azure/active-directory/cloud-infrastructure-entitlement-management/overview

https://docs.microsoft.com/en-us/azure/active-directory/verifiable-credentials/decentralized-identifier-overview

https://docs.microsoft.com/en-us/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti

https://docs.microsoft.com/en-us/azure/external-attack-surface-management/

https://www.microsoft.com/en-us/microsoft-365/blog/2022/04/05/ease-the-burden-of-managing-and-protecting-endpoints-with-microsoft-advanced-solutions/

https://docs.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-threat-experts?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/security/defender/defender-experts-for-hunting?view=o365-worldwide

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy follow up on a few things from the post quantum cryptography episode talking about how one of the quantum resistant algorithms was broken and a lawsuit against the US government related to quantum encryption. They also chat about how TikTok may be storing information of US citizens on Chinese servers. Finally, they talk about how sound can be used as a cyber attack vector.

-------------------------------------------

Youtube Video Link: https://youtu.be/CmcK2bwnqGo

-------------------------------------------

Documentation:

https://arstechnica.com/information-technology/2022/08/sike-once-a-post-quantum-encryption-contender-is-koed-in-nist-smackdown/

http://blog.cr.yp.to/20220805-nsa.html

https://twitter.com/divinetechygirl/status/1560220472742232065?s=21&t=f3k3lt5ALc1VWGUNURu_bg

https://www.neowin.net/news/janet-jackson-song-is-now-an-official-exploit-for-windows-pcs/?fs=e&s=cl

https://www.zdnet.com/article/academics-steal-data-from-air-gapped-systems-using-pc-fan-vibrations/

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about post quantum cryptography this week. They go over why quantum computers are a threat to classical cryptography like public key encryption, quantum key distribution, and finally NIST's selection of quantum resistant cryptography.

-------------------------------------------

Youtube Video Link: https://youtu.be/v8CVq09tnB4

-------------------------------------------

Documentation:

https://www.whitehouse.gov/briefing-room/statements-releases/2022/05/04/national-security-memorandum-on-promoting-united-states-leadership-in-quantum-computing-while-mitigating-risks-to-vulnerable-cryptographic-systems/

https://www.whitehouse.gov/briefing-room/statements-releases/2022/06/28/fact-sheet-the-united-states-continues-to-strengthen-cooperation-with-g7-on-21st-century-challenges-including-those-posed-by-the-peoples-republic-of-china-prc/

https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy start a two part series on post-quantum computer information security. This first part goes into understanding how quantum computers work and how they differ from classical computers. While it's not necessary to understand how quantum computers work to know the threat to information security they have, as technologist, it's always fun to expand our knowledge on these topics. We hope you learn as much as we did when we researched the topic for this episode!

-------------------------------------------

Youtube Video Link: https://youtu.be/h8E2TL_UMQA

-------------------------------------------

Documentation:

https://www.ibm.com/quantum

https://azure.microsoft.com/en-us/services/quantum/#overview

https://quantumai.google/

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy do a technical deep dive on Exchange Online Protection (EOP). They talk about the pre-delivery and post-delivery protections. They also talk about some of the zero-day protections that Defender for Office 365 provides similar to other competitors in the space and MX record vs API protection.

-------------------------------------------

Youtube Video Link: https://youtu.be/-_pnAIR2Y48

-------------------------------------------

Documentation:

https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/bc-p/3566717

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/exchange-online-protection-overview?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/protection-stack-microsoft-defender-for-office365?view=o365-worldwide

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/defender-for-office-365?view=o365-worldwide

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about privacy both in organizations and your personal life. They talk about some of the new Microsoft Purview Compliance Classifiers and how it might be an invasive for some orgs when implemented in the wrong way. They also talk about mobile device privacy in light of SCOTUS overturning Roe v Wade and how our data might be weaponized against us. Finally, they talk about some privacy tools that can help limit the telemetry to tech companies.

-------------------------------------------

Youtube Video Link: https://youtu.be/o5k3gIMlPjs

-------------------------------------------

Documentation:

https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=In%20development%2CPreview&searchterms=Purview%2Cclassifier

https://www.whitehouse.gov/briefing-room/statements-releases/2022/07/08/fact-sheet-president-biden-to-sign-executive-order-protecting-access-to-reproductive-health-care-services/

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/cell-phone-hipaa/index.html

https://globalprivacycontrol.org/

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]

This week, Adam and Andy talk about some security news relating to Microsoft. First they talk about a phishing campaign that Microsoft detailed that was going on affecting more than 10,000 orgs where the attackers are able to bypass MFA. They also talk about Microsoft's decision to roll back disabling VBA macros by default. Finally, they talk about Microsoft's DART team and how they approach ransomware and incident response.

-------------------------------------------

Youtube Video Link: https://youtu.be/FJnrBMgw89g

-------------------------------------------

Documentation:

https://www.microsoft.com/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/

https://jeffreyappel.nl/blocking-internet-macros-in-office-and-dont-wait-for-microsoft/

https://docs.microsoft.com/en-us/security/compass/incident-response-playbook-dart-ransomware-approach

-------------------------------------------

Contact Us:

Website: http://bluesecuritypod.com

Twitter: https://twitter.com/bluesecuritypod

Linkedin: https://www.linkedin.com/company/bluesecpod

Youtube: https://www.youtube.com/c/BlueSecurityPodcast

Instagram: https://www.instagram.com/bluesecuritypodcast/

Facebook: https://www.facebook.com/bluesecpod

Twitch: https://www.twitch.tv/bluesecuritypod

-------------------------------------------

Andy Jaw

Twitter: https://twitter.com/ajawzero

LinkedIn: https://www.linkedin.com/in/andyjaw/

Email: [email protected]

-------------------------------------------

Adam Brewer

Twitter: https://twitter.com/ajbrewer

LinkedIn: https://www.linkedin.com/in/adamjbrewer/

Email: [email protected]