Cyber Security Weekly Podcast

Following Microsoft’s news about Hafnium, the Australian Cyber Security Centre (ACSC) advises organisations using Microsoft Exchange to urgently patch the following Common Vulnerabilities and Exposures (CVEs):

CVE-2021-26855 – server-side request forgery (SSRF) vulnerability in Exchange.CVE-2021-26857 – insecure deserialization vulnerability in the Unified Messaging service.CVE-2021-26858 – post-authentication arbitrary file write vulnerability in Exchange.CVE-2021-27065 – post-authentication arbitrary file write vulnerability in Exchange.If successfully exploited, these CVEs would allow an unauthenticated attacker to write files and execute code with elevated privileges on the underlying Microsoft Windows operating system.

A large number of Australian organisations are yet to patch vulnerable versions of Microsoft Exchange, leaving them vulnerable to compromise. The ACSC is encouraging these organisations to do so urgently.

We cross to the US and speak with Mat Gangwer, Senior Director, Sophos Managed Threat Response and review the Microsoft Exchange hack and threat hunting advice.

Full article, including updated ESET research: https://australiancybersecuritymagazine.com.au/microsoft-outlook-hack-and-advice-for-threat-hunting/ (https://australiancybersecuritymagazine.com.au/microsoft-outlook-hack-and-advice-for-threat-hunting/)

#Exchangehack (https://www.youtube.com/hashtag/exchangehack)​ #microsoft (https://www.youtube.com/hashtag/microsoft)​ #cybersecurity (https://www.youtube.com/hashtag/cybersecurity)​ #cyberbreach (https://www.youtube.com/hashtag/cyberbreach)​ #exchange (https://www.youtube.com/hashtag/exchange)​ #CVE (https://www.youtube.com/hashtag/cve)​ #Sophos (https://www.youtube.com/hashtag/sophos)

Recorded Friday 12 March 2020 - video version is available here https://mysecuritymarketplace.com/av-media/microsoft-exchange-hack-and-advice-for-threat-hunting/ (https://mysecuritymarketplace.com/av-media/microsoft-exchange-hack-and-advice-for-threat-hunting/)

Interview with Alice White, Security Training Manager, Atlassian

“So I wanted to stand out, I was super keen to be considered for the Security Training Manager role and to work for Atlassian.” THIS IS HER STORY….

Alice’s article link – https://www.linkedin.com/pulse/how-i-navigated-getting-job-atlassian-security-training-alice-white/?trackingId=zcXgTczl3LwOSaw44ZWqIg%3D%3D (https://www.linkedin.com/pulse/how-i-navigated-getting-job-atlassian-security-training-alice-white/?trackingId=zcXgTczl3LwOSaw44ZWqIg%3D%3D)

Link to the video interview is https://mysecuritymarketplace.com/av-media/how-i-navigated-getting-a-job-at-atlassian-as-security-training-manager/ (https://mysecuritymarketplace.com/av-media/how-i-navigated-getting-a-job-at-atlassian-as-security-training-manager/)

We look at Dark web takedowns by cross-border law enforcement operations which can have a significant impact on the availability of opioids, in particular the lethal drug fentanyl, according to a new report from The Australian National University (ANU).

The report, commissioned by the Australian Institute of Criminology’s (AIC) Serious and Organised Crime Research Laboratory, analysed the impact of law enforcement seizures and darknet market closures, including the availability of highly potent synthetic opioids fentanyl and carfentanil.

We speak with Professor Rod Broadhurst of the Department of Regulation and Global Governance, College of Asia and the Pacific, Australian National University.

Access the release and report here https://australiancybersecuritymagazine.com.au/darknet-takedowns-disrupt-drugs-markets/ (https://australiancybersecuritymagazine.com.au/darknet-takedowns-disrupt-drugs-markets/)

Access to Jane Lo’s Chainalysis Podcast – The Big Biz of Crypto-Crime – https://mysecuritymarketplace.com/av-media/episode-249-the-big-biz-of-cryptocrime-pandemic-year-of-2020/ (https://mysecuritymarketplace.com/av-media/episode-249-the-big-biz-of-cryptocrime-pandemic-year-of-2020/)

#darknet (https://www.youtube.com/hashtag/darknet)​ #darkweb (https://www.youtube.com/hashtag/darkweb)​ #darkwebmarkets (https://www.youtube.com/hashtag/darkwebmarkets)​ #drugtrade (https://www.youtube.com/hashtag/drugtrade)​ #ANU (https://www.youtube.com/hashtag/anu)​ #cyberresearch (https://www.youtube.com/hashtag/cyberresearch)

For the video version - visit https://mysecuritymarketplace.com/av-media/darknet-takedowns-disrupt-drugs-markets/ (https://mysecuritymarketplace.com/av-media/darknet-takedowns-disrupt-drugs-markets/)

Kim Grauer is the Head of Research at Chainalysis, where she examines trends in cryptocurrency economics and crime.  Using Chainalysis data and software, she works with government agencies, exchanges, financial institutions, and insurance and cybersecurity companies to help solve some of the world’s most high-profile cyber criminal cases.

Kim was trained in economics at the London School of Economics and in politics at Oxford University. Previously, she explored technological advancements in developing countries as an academic research associate at the London School of Economics and was an economics researcher at the New York City Economic Development Corporation.

In this podcast, Jane Lo, Singapore Correspondent interviews Kim to highlight key findings from the Crypto Crime Report 2021 and the criminal activities that contribute to USD 10 billion of illicit transactions in crypto currency during 2020.

She introduces the approach to identify and map illicit transactions to crypto currency wallet addresses, and the methodology to trace the crypto proceeds from crimes, to their placement into today’s financial system.

She also discusses the outlook for the top crime types transacted in crypto currency – Scams, Darknet Markets, and Ransomware, and the trends observed year-on-year.

Drawing on distinctions in data and information available in the fiat versus the crypto world, she shares some key takeaways for law enforcement and anti-money laundering specialists.

Link to Crypto-Crime Report - https://mysecuritymarketplace.com/av-media/episode-249-the-big-biz-of-cryptocrime-pandemic-year-of-2020/ (https://mysecuritymarketplace.com/av-media/episode-249-the-big-biz-of-cryptocrime-pandemic-year-of-2020/)

Recorded 25th February 2021 (7am Singapore /6pm [-1] New York)

Released on International Women's Day #IWD2021

Jane Lo, Singapore Correspondent speaks with Tommaso Gagliardoni, PhD, an Italian cryptographer, mathematician, and quantum security researcher. Tommaso obtained a degree in Mathematics at the University of Perugia, Italy, and a PhD at the Technical University of Darmstadt, Germany, with a dissertation on the quantum security of cryptographic primitives.

He worked at IBM Research Zurich with famed cryptographer Dr. Jan Camenisch. He then joined Kudelski Security, an innovative, independent provider of tailored cybersecurity solutions to help enterprises and public sector institutions assess risks and vulnerabilities and protect their data and systems. Founded in 2012, Kudelski Security is part of the Kudelski Group, a world leader in digital business enablement technologies. Headquartered in Switzerland and in the USA, with offices in 32 countries around the world, the Group employs around 3,500 people.

Tommaso published many influential peer-reviewed academic papers in the areas of cryptography, quantum computing, security and privacy, and spoke at many international conferences in these fields.

He is known, among other achievements, for his collaborations in solving the longstanding problem of adaptive quantum authentication (EUROCRYPT 2018, TQC 2019) and breaking the security of ISO-standard smart card protocol PLAID (Real World Crypto 2015, SSR 2015).

In this podcast, Tommaso introduces the concept and properties of qubits in quantum technology and what it means for computational advantage.  He explains the implications for the cryptographic protocols underpinning security in today’s computer infrastructure and applications including Bitcoin, and the search for next-gen mathematical problems and cryptographic schemes (“quantum-resistant schemes”) to secure tomorrow’s infrastructure.

The discussion also explores the promises of quantum technology such as quantum money and debunks some of the popular myths such as the potential of teleportation and violation of Einstein’s relativity.

Recorded: 17th February 2021, Singapore 5pm/ Switzerland 10am

The 2021 World Economic Forum's 16th edition of the Global Risks Report 2021, identifies critical global risks facing the world. Among the highest likelihood risks of the next ten years, cyber...

Interview with George Moawad, ANZ Country Manager for Genetec and discussing the 2021 market outlook and trends within the security applications and security operations sector.

Further Reading:

Cyber Threat Landscape (https://www.asiapacificsecuritymagazine.com/cyber-threat-landscape-demands-more-of-the-security-supply-chain-from-the-chip-to-the-camera/) (https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbjBxWmNnd3hTYzBUMktUXzc4MlNDNjZFTy1Qd3xBQ3Jtc0ttV05KS09ZUGpBM3k5Q3pzeHZpQ0kyMkNFaEEwVlltWHRjMzBtS2R5NjBjS2tJUmdFUWU2QXNZeGFrN01iczFlbC1iVmdNYUQ2Z2R4VEM2aElCZnZDWXdvTkpTMlkxMnFYNFpMZzEzdjd4MV9FMDdpbw&q=https%3A%2F%2Fwww.asiapacificsecuritymagazine.com%2Fcyber-threat-landscape-demands-more-of-the-security-supply-chain-from-the-chip-to-the-camera%2F)

Deep Learning in Digital Video Analytics (https://cctvbuyersguide.com/2020/01/deep-learning-enriches-digital-video-analytics/)

WATCH THE FULL INTERVIEW (https://www.youtube.com/watch?v=CFpLz4ecMyM)here (https://www.youtube.com/watch?v=CFpLz4ecMyM)

Recorded 4 February 2021

Following Safer Internet Day 2021 we reached out to Julie Inman Grant, Australia's eSafety Commissioner to speak about online safety, public awareness and international trends.

Julie provides updated details on the extent of online child exploitation, the role of eSafety in public awareness and also enforcement and content takedowns. An important imitative underway with the Office of the eSafety Commissioner is the Safety by Design approach and important public messaging to encourage appropriate design and use of online platforms and content.

eSafety is the official Safety Internet Day committee in Australia and a leader in the global effort, so celebrated as one of the most important events of the year. eSafety runs Safer Internet Day webinars for school students, parents and carers and released new resources that help Australians 'start the chat' about online safety.

Watch instead? Link to MySec.TV Interview - https://www.youtube.com/watch?v=F3Oks53KbNc (https://www.youtube.com/watch?v=F3Oks53KbNc)

Read more https://www.esafety.gov.au/about-us/events/safer-internet-day-2021 (https://www.esafety.gov.au/about-us/events/safer-internet-day-2021)

https://www.esafety.gov.au/key-issues (https://www.esafety.gov.au/key-issues)

#onlinesafety (https://www.youtube.com/hashtag/onlinesafety)​ #SID2021 (https://www.youtube.com/hashtag/sid2021)​ #startthechat (https://www.youtube.com/hashtag/startthechat)​ #cyberbullying (https://www.youtube.com/hashtag/cyberbullying)​ #esafet (https://www.youtube.com/hashtag/esafety)y​

Previous Podcast Interview - https://blubrry.

Interview with Anthony Stevens, Founder and CEO of 6clicks. We speak with Anthony following the recent close of a $5M capital raise and setting out ot be the next Australian unicorn.

With plans for rapid global expansion, 6clicks raised the A$5 million from a consortium of Australian business leaders including Luke Sayers, Founder and Executive Chairman at Sayers and the former CEO of PwC. This funding now brings the total investment in 6clicks to A$7.7 Million since launching mid-2019. This new funding will be directed at global expansion, product development and customer success. Steve Nola, the former CEO of billion-dollar I.T. services giant NTT Limited Australia has been appointed to the 6clicks board of directors.

Following recent expansions into the U.K. and the U.S. and with partnerships secured with leading advisory firms globally, 6clicks is trusted by a range of private, government, listed and global customers.

Software-as-a-Service platform 6clicks streamlines risk and compliance for businesses of all sizes. It includes the ‘full-stack’ of governance, risk and compliance (GRC) functionality, baked-in regulations, control sets, risk libraries and assessment templates, a mobile app for team risk reviews, and 6clicks Pulse® for risk-related news, events and employee sharing. 6clicks is also white-labelled by advisory firms to drive efficiency with their service delivery and provide innovation to delight their clients.

What makes 6clicks a leader is its unique integration of content, functionality and world-first artificial intelligence engine called Hailey™, which follows PhD-led research over 18 months. Right now, Hailey automates compliance mapping between regulations delivering gains of up to 14x in time-saving over manual alternatives.

6clicks CEO Anthony Stevens commented, "We are looking at a global market of over U$31 billion expected to reach U$88 billion by 2027. Some of the leading brands globally have trusted our software, and we are rapidly expanding. Our investment in artificial intelligence, new functionality and integrated content will continue throughout 2021 accelerating the value customers realise using 6clicks."6clicks chairman, Ian Buddery commented, "This has been a remarkable period of achievement for 6clicks, with not only rapid subscriber growth but also an oversubscribed investment round and the appointment of one of Australia’s most experienced and highly regarded technology executives to our board."New 6clicks non-executive director, Steve Nola, said, "I’m delighted to join the board of 6clicks and see 6clicks as a company that can redefine markets with a platform that delivers better risk and compliance outcomes for businesses and advisors."

For the full interview (https://mysecuritymarketplace.com/av-media/mysec-tv-live-founder-of-6clicks-then-cross-to-appsec-market-insights/) and including a cross to the US for discussion on Application-led Security and an AppSec Market Update -visit https://mysecuritymarketplace.com/av-media/mysec-tv-live-founder-of-6clicks-then-cross-to-appsec-market-insights/ (https://mysecuritymarketplace.com/av-media/mysec-tv-live-founder-of-6clicks-then-cross-to-appsec-market-insights/).

Additional guests are Gregg Ostrowski, Regional CTO at AppDynamics, part of Cisco and Stephen Elliot, Program Vice President, Management Software and DevOps with IDC Research.

Interview with Craig Searle, Director, Consulting & Professional Services (Pacific) at Trustwave discussing the new SolarWinds vulnerabilities discovered - PLUS its Safer Internet Day 2021 #SID2021

Craig has been in the cyber security industry for nearly two decades. He has built cyber security ventures from the ground up most recently seeing Hivint, a new kind of professional services business, exit to Trustwave, an Optus Company in 2018. He now runs Trustwave (Pacific) consulting and professional services. At Trustwave, Craig continues to build on his extensive experience in the development, management & execution of IT security advice and assurance activities within large organisations, including banking and finance, critical infrastructure, ASX200 organisations and government (both state and federal).

Two security vulnerabilities in SolarWinds Orion Platform (CVE-2021-25275 and CVE-2021-25274) and one vulnerability in SolarWinds Serv-U FTP for Windows (CVE-2021-25276). All three vulnerabilities are severe bugs, with the most critical one in SolarWinds Orion Platform (CVE-2021-25274) allowing remote code execution with high privileges.

Trustwave - SpiderLabs Blog: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/ (https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/full-system-control-with-new-solarwinds-orion-based-and-serv-u-ftp-vulnerabilities/)

#MySecurityTV takeaway - Feb 9, 2021 - full episode, with an interview with Mark Lukie, Engineer Manager, Barracuda and a walk through how scammers have turned to Bots and automation to avoid detection - available here: https://mysecuritymarketplace.com/av-media/mysec-tv-live-today-joined-by-craig-searle-of-trustwave-and-mark-lukie-of-barracuda/ (https://mysecuritymarketplace.com/av-media/mysec-tv-live-today-joined-by-craig-searle-of-trustwave-and-mark-lukie-of-barracuda/)