Cyber Security Weekly Podcast

We speak with James Sillence, Vice President, Technical Account Management, South Asia for Tanium.____JOIN US ON APRIL 4, 2023 for a special virtual deep-dive with Tanium - register here https://www.eventbrite.com.au/e/stay-ready-so-you-dont-need-to-get-ready-tickets-559265035777____Tanium defends every team, endpoint and workflow against the largest attack surface in history by delivering the industry’s first convergence of IT management and security operations with a single platform under a new category, Converged Endpoint Management (XEM).The integrated offering links IT operations, security and risk teams from a single pane of glass to provide a shared source of truth, a unified set of controls, and a common taxonomy that brings together siloed teams for a shared purpose — to protect critical information and infrastructure.James has over 36 years of IT experience spanning diverse areas such as Cybernetics and Control Systems, Network and Application Performance, Data Storage and most latterly, Risk and Security.For the last 10 years, James has been leading technology teams, helping organisations get the most from the solutions that they use to manage and protect their digits assets.JOIN US ON APRIL 4, 2023 for a special virtual deep-dive with Tanium - register here https://www.eventbrite.com.au/e/stay-ready-so-you-dont-need-to-get-ready-tickets-559265035777#xemercedesbenz #endpointprotection #Tanium

Mark Stickells leads the Pawsey Supercomputing Research Centre, a critical national research infrastructure located in Perth, Western Australia.   Before joining Pawsey, Mark led joint ventures between universities, CSIRO and industry delivering national and international research and education programs for Australia’s key energy, resources and agricultural sectors. Appointed as a Fellow of the Australian Institute of Management in WA in 2019 and a Fellow of the Australian Institute of Company Directors in 2020, Mark is also member of CEO’s for Gender Equity. Committed to supporting diversity and inclusion initiatives in his professional and personal life, Mark is an enthusiastic advocate for Pawsey's expertise and enterprise contributing to prosperity and well-being in its region, and for the nation and internationally. Aditi is a dynamic digital communicator and tech enthusiast, who is driven by her passion for creating diverse and inclusive cultures. She is a strong advocate for opening doors for girls and underrepresented groups. With her deep understanding of the tech world and her drive for change and a diversity champion at the Pawsey Supercomputing Research Centre, Aditi works tirelessly to challenge the status quo and create a more inclusive and equitable community. In this interview at SupercomputingAsia 2023 – which returned to a physical format since 2019 - Mark and Aditi shared some of the key developments at Pawsey Supercomputing Centre (Perth, Australia). Kicking off the interview, Mark highlighted some of the initiatives in the four years at Pawsey (since the last physical format) – including Pawsey’s exascale-class system, Setonix (named after Western Australia’s marsupial, the quokka) which is the Southern Hemisphere’s most powerful, energy efficient supercomputer.  He provided some examples of how Pawsey support science (as such specialist support for international radioastronomy projects such as the multinational Square Kilometre Array) and life-saving research projects (such as advanced monitoring and predictive analysis of patients in critical care). On the rate at which “IT” (including supercomputing) consumes energy, Mark noted some of the “energy future” work – such as novel use of battery and other technologies to accelerate efforts towards net zero supercomputing. To provide essential compute and data infrastructure and HPC services supporting Australian researchers, Aditi pointed to the importance of talent development – including diversity and inclusivity, and internship programs for students. Mark and Aditi also touched on the collaborations to progress the quantum computing efforts by industry and government researchers. Wrapping up, Mark and Aditi shared how Pawsey is now part of the “exascale” community, and how Pawsey will continue to actively support collaborations and sharing to tackle challenges beyond borders. Recorded 1st March 2023, 8.30am, SuperComputingAsia 2023, Singapore Expo.Previous interview with Mark Stickells of the Pawsey Supercomputing Research Centre is available here https://blubrry.com/mysecurity/42779200/episode-146-high-performance-computing-hpc-and-why-it-matters-for-australia-pawsey-supercomputing-centre/

The WA Cyber Security Innovation Hub is excited to be delivering the second CyberWest Summit, 10-11 May, 2023 at the Pan Pacific, Perth WA. CyberWest Summit is WA’s flagship event providing cyber security education and awareness to key sectors and highlighting WA cyber security capabilities.The conference will deliver three content streams: Critical Infrastructure & Supply Chain Cyber Uplift, Securing Local & State Government, and Cyber Skills & Education ​Pathways.Troy Hunt, a world leading security researcher and commentator, will deliver a top-rated keynote on security and other technology concepts from around the world.Troy Hunt created HIBP as a free resource for anyone to quickly assess if they may have been put at risk due to an online account of theirs having been compromised or "pwned" in a data breach.For more information visithttps://www.cyberwestsummit.com.au/ (https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqazlmV196bzF2U3pzRWo0NWlDWUdEeldtLXdlQXxBQ3Jtc0tsZy1IWHZrS0ktT3hra0xZZXYzOVBieGNkZUtIY0NDTkVfX19jUGJDSmgzUWFEX1p3VVNuVFZ2NjNxY25lUkctNlZnc1ZmdnZOS0stMDdLQlRTMDAzZk5qMFJPQTgtazNuOGRyZmZzeTFQNTdNTEEwSQ&q=https%3A%2F%2Fwww.cyberwestsummit.com.au%2F&v=nHeUrEGUzBI)https://haveibeenpwned.com/ (https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFVCSFcySkRQaTY4eWlLcGpsTU1YLW9Kanl5d3xBQ3Jtc0ttbjNFVEdWZGUzSEdTYVk3aFZ3bVBTSW1tcmc1Szd6R1pTRllJWlhZdFdpOGhXOEZ0WXV2elVraEl5R0NuN25odlR0em91LUVEV29xUUJkVVVIWXlJVS1ZTFdoYVlPNzdaVjdITVFaY0JKUldwR1pDNA&q=https%3A%2F%2Fhaveibeenpwned.com%2F&v=nHeUrEGUzBI)https://www.troyhunt.com/ (https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa04xc3RnWWJWOW1ZZ0FNRUpsWkNpTE1zR0RhUXxBQ3Jtc0trX29VMEptUzhxSlFVVkJKTE5yR0VMRWI1SGp1U3R5d182djJhRmpHTU9fc2NQdHdTdC0xWXhBMlVGeVhNWHhzZHl0ajk4TW9VMWUzVThXd3RPeHBJd0haMXV3a0tmUXpzdl9LMkZQX0pRMUd1cEMySQ&q=https%3A%2F%2Fwww.troyhunt.com%2F&v=nHeUrEGUzBI)#haveIbeenpwned (https://www.youtube.com/hashtag/haveibeenpwned) #troyhunt (https://www.youtube.com/hashtag/troyhunt) #cyberwest2023 (https://www.youtube.com/hashtag/cyberwest2023) #cyberwestsummit2023 (https://www.youtube.com/hashtag/cyberwestsummit2023)Recorded 8 March, 2023 for MySec.TV

Satoshi Matsuoka (https://en.wikipedia.org/wiki/Satoshi_Matsuoka (https://en.wikipedia.org/wiki/Satoshi_Matsuoka)) from April 2018 has been the director of Riken Center for Computational Science (R-CCS), the Tier-1 national HPC center for Japan, developing and hosting Japan’s flagship ‘Fugaku’ supercomputer which has become the fastest supercomputer in the world in all four major supercomputer rankings in 2020 and 2021 (Top500, HPCG, HPL-AI, Graph500), along with multitudes of ongoing cutting edge HPC research being conducted, including investigating Post-Moore era computing, especially the future FugakuNEXT supercomputer.  He was the leader of the TSUBAME series of supercomputers that had also received many international acclaims, at the Tokyo Institute of Technology, where he still holds a professor position, to continue his research activities in HPC as well as scalable Big Data and AI.  His longtime contribution was commended with the Medal of Honor with Purple ribbon by his Majesty Emperor Naruhito of Japan in 2022. Other accolades include the Fellow positions in societies/conferences ACM, ISC, and the JSSST; the ACM Gordon Bell Prizes in 2011 & 2021; the IEEE-CS Sidney Fernbach Award in 2014 as well as the IEEE-CS Computer Society Seymour Cray Computer Engineering Award in 2022, both being the highest awards in the field of HPC, and the only individual to receive both awards; the Technical Papers Chair and the Program Chair for ACM/IEEE Supercomputing 2009 and 2013 (SC09 and SC13) respectively as well as many other conference chairs, and the ACM Gordon Bell Prize selection committee chair in 2018. In this interview, Professor Satoshi Matsuoka shared some of the highlights from his talk at SuperComputingAsia 2023 (Singapore), including the supercomputing developments in Japan, and Fugaku, the largest in Japan and one of the first 'exascale' supercomputers of the world. With applications ranging from manufacturing, disaster prevention to creating new drugs, he noted that supercomputers allow us to investigate the past, and to predict the future.  To give the audience context, Professor compares Fugaku supercomputer to everyday applications such as gaming (create “virtual worlds, but much more in a scientific way”), and smart phones (20 million times more powerful than a smartphone). In terms of power consumption, it is equivalent to running the Tokyo Disney Resort, and as such, power efficiency is critical in the overall management and operations of Fugaku – especially with carbon neutrality as a key agenda topic today. Professor Satoshi Matsuoka also touched on cybersecurity and how privacy and anonymisiation are growing areas of focus with the increasing adoption of digital twins in medical sciences. Wrapping up, he pointed out some short term goals for supercomputing in Japan to realise further synergies with the “IT” industry, and the efforts for the successor of Fugaku, FugakuNEXT, to be deployed around 2029. Recorded 28th February 2023, 12noon, SuperComputingAsia 2023, Singapore Expo.

Shota Shinogi is a security researcher at Macnica (Japan), pentest tools author and CTF organizer. He is an expert in writting malware for Red Team purpose and to evade the detection from EDR, sandbox, IPS, antivirus and other security solutions. He has more than 10 years experience on the Cyber security industries, starting his carrier with HDD Encryption, NAC, IPS, WAF, Sandbox. He has spoken in several security/hacking conferences; Black Hat, DEF CON, BSides. He is also contributing for the education for the next generation security engineer through the Security Camp from 2015 consecutively in Japan. In this interview, Shinogi gave highlights of his hackathon session (as an instructor at the Global Cybersecurity Camp 2023) on PowerShell based Malware detection He shared the key factors behind PowerShell’s potency (a default tools on Windows, file-less, and hundreds of methods to obfuscate the script, making detection even that much harder). However, with the logging feature built by Microsoft, it is possible to build tools to detect malicious PowerShell script. Shinogi noted the approaches that the impressive results delivered by the hackathon – there were even AI-based algorithms to filter out malicious PowerShell scripts. Recorded 16th February 2023, 4.30pm, ASEAN Cybersecurity Centre of Excellence Singapore, at the Global Cybersecurity Camp 2023 Singapore.

DigiCert, Inc., a leading global provider of digital trust, have releases DigiCert® Trust Lifecycle Manager, a comprehensive digital trust solution unifying CA-agnostic certificate management and public key infrastructure (PKI) services. Trust Lifecycle Manager tightly integrates with DigiCert’s best-in-class public trust issuance for a full-stack solution governing seamless management of corporate digital trust infrastructure. The 2022 State of Digital Trust Survey revealed the cost of poor security practices, finding that almost half of consumers have stopped doing business with a company after losing confidence in its digital trust competency. Trust Lifecycle Manager brings together: • Certificate lifecycle management, streamlining IT operations with certificate discovery, management, notification, automation and integration. • PKI services, streamlining identity and authentication with private certificate issuance for users, devices, servers and other IT resources, and management of the CA hierarchy. This unified management of a company’s digital trust fabric delivers: • A full-stack solution in a single pane of glass that offers superior performance, handling and automation, with single vendor accountability. • Certificate profiles and tools facilitating self-service issuance. • Flexibility for cloud, on-premises or hybrid models, enabling companies to manage their PKI use cases according to their security policy preferences. • Centralised visibility and control over a company's certificate landscape, reducing risk of business disruption and securing identity and access across the organisation. • Deep integration into user and enterprise technologies, supporting existing business systems and processes. We speak with Brian Trzupek, Senior Vice President of Product at DigiCert. A crypto and security tech by day and night, Brian brings nearly two decades of expertise on many security subjects to the team. He's constantly innovating use cases for enterprise PKI. He previously worked for more than six years as VP of Managed Identity and Authentication at Trustwave where he helped fight cybercrime, protect data, and reduce security risk. While at Trustwave, he testified before a congressional panel on the Dec. 2013 Target breach. Prior to Trustwave, he was a founder of Creduware Software, Inc., a company that automated credential password and digital certificate renewal and installation, as well as policy based application monitoring. Trust Lifecycle Manager is generally available now as part of the DigiCert® ONE platform. To learn more, visit www.digicert.com/trust-lifecycle-manager

Dave has 30 years of industry experience. He has extensive experience in IT security operations and management. He is the founder of the security site Liquidmatrix Security Digest & podcast as well as the host of DuoTV and the Plaintext podcast. He is currently a member of the board of directors for BSides Las Vegas.  Previously he served on the board of directors for (ISC)2 as well as being a founder of BSides Toronto conference. Dave has been a DEF CON speaker operations goon for over 10 years. Lewis also serves on the advisory board for the Black Hat Sector Security Conference and the CFP review board for 44CON.  He is currently working towards his graduate degree at Harvard. Dave has previously written columns for Forbes, CSO Online, Huffington Post, The Daily Swig and others. For fun he is a curator of small mammals (his kids) plays bass guitar, grills, is part owner of a whisky distillery and a soccer team. In this interview, Dave Lewis shares his highlights from his keynote presentation at SINCON 2023, the first cybersecurity conference in Singapore for the year 2023. Globalisation and supply chain attacks - He shared his thoughts on how threat actors have exploited globalisation of supply chain: that as organisations move to a cloud-based iteration “for everything” and thereby extending targets of opportunities for the attackers. This means that we have extended from protecting the “four walls” to an “unfathomable number of walls”. In particular, as we digitalise, we have to “make sure we are not outpacing security”, and that we understand our fallback position if “there’s a global catastrophe and we have to cut off from the rest of the world.” One example is critical infrastructure, where there is “accumulated security debt” (e.g. deprecated applications) and where “stakes are higher”. Zero trust - Dave stressed that “zero trust” is an “iterative process” and there is “no end state”. Rather, it is about reducing the risks and addressing the core fundamentals from 30 years ago – managing our core users, our network segmentation, critical applications in our environment. Cybersecurity skills and resources - Dave also shared how we need “more adults at the table”, that maturing our cybersecurity posture requires more senior level involvement. He also advised that we need to “get away from the “sensationalisation” of the hacker culture” – that cybersecurity is not strictly the hacker sub-culture. Cyber threat landscape - Using Wannacry as an example, Dave noted that the SMBv1 vulnerability had been known but remained unfixed for 10 years. This “security debt” was an example of how we as cybersecurity practitioners tend to “lose our focus collectively”. As we are at that “juncture where we have to figure out how we are going to mature as an industry and be able to handle these risks in a coherent fashion”, he predicted that “we will keep making the same mistakes for a while.”  Further, referencing how the ransomware have evolved since the first version by Dr Joseph Popp in 1989, he said “financial motivation will not go away, it is just how they are going to get their money.” Recorded 5th January 2023, 11.30am, VOCO hotel, Singapore.

Rapid7 unites cloud risk management and threat detection to deliver results that secure your business and ensure you’re always ready for what comes next. Reduce your attack surface and eliminate threats with zero trade-offs. Lee Weiner is an IT security technology leader with more than 25 years’ experience taking software products to market and managing the product lifecycle end-to-end while scaling a team. As Senior Vice President of Cloud Security and Chief Innovation Officer at Rapid7, Lee is responsible for leading the direction and delivery of the company’s entire assessment and response product portfolio as well as its innovation initiatives. Before joining Rapid7, Lee was VP of products at LogMeIn, Inc., a provider of cloud-based remote connectivity solutions, where he was responsible for product delivery, product management and product marketing for LogMeIn's remote support product. Lee has also held leadership roles at several software security firms, including Netegrity, Inc., IMlogic, Inc., and Symantec Corporation. Lee received a Bachelor of Arts (BA) degree from the University of Massachusetts. This interview follows our interview with the Rapid7 CEO and Chair of the Board, Corey Thomas during his visit to Australia and New Zealand in November 2022 - to listed to this interview visit https://mysecuritymarketplace.com/av-media/episode-343-reducing-the-attack-surface-ciso-roundtable-takeaways/

Resilience has emerged as a top priority as a staggering 70 percent of organisations surveyed said they had experienced a security event that impacted business in the past two years. These incidents resulted in severe repercussions for the companies that experienced them, along with the ecosystem of organisations they do business with. With stakes this high, it is no surprise that executives surveyed for the report said that security resilience is a high priority for them. Helen Patton is an Advisory CISO at Cisco, where she shares security strategies with the security community. Previously she spent eight years as the CISO at The Ohio State University where she was awarded the 2018 ISE North American Academic/Public Sector Executive of the Year. Before joining Ohio State she spent ten years in risk and resiliency at JPMorganChase. Helen actively encourages collaboration across and within industries, to enable better information security and privacy practices. She believes in improving diversity and inclusion in the workforce, and mentors people interested in pursuing careers in security, privacy and riskmanagement. She advocates for more naps and is anti-bagpipes. Helen has a Master’s degree in Public Policy and has earned various industry certifications. Sheserves on the State of Ohio CyberOhio Advisory Board, the Manufacturing and Digital USA Cybersecurity Advisory Board, and the Ohio State University College of Electrical and Computer Engineering Industry Advisory Board. She is a faculty member for the Digital Director’s Network, and the Educause Leadership Institute.Further Reading: https://cyberriskleaders.com/70-of-australian-organisations-say-cyber-events-impact-business/ Recorded at Cisco Live, Melbourne, Thursday 8 December, 2022

On a recent visit to Australia and New Zealand, Corey Thomas, CEO and Chair of the Board for Rapid7 participated in a number of Executive Cybersecurity Roundtables with CISOs and Heads of Security in Sydney, Melbourne and Auckland, including presenting to a Cyber Risk Meetup in Melbourne.Each session produced a lively and very productive discussion amongst some senior cybersecurity leaders representing banking, financials, property management, telecommunications, healthcare, media, distribution, service delivery and logistics. Some of the key takeaways included the challenges of resources and skill sets, and the current threat landscape with significant breaches causing boards and ELTs to ask questions on respective cybersecurity posture and maturity. Threat intelligence was also an area of interest and all agreed needs to be filtered and directed by the cybersecurity strategy for specific requirements and what can be actioned.Reference was made to the ASX 200 Threat Landscape report provided by Rapid7, available here https://australiancybersecuritymagazine.com.au/reducing-the-attack-surface/