Cyber Security Weekly Podcast

Futurist Skeeve Stevens provides his technical insights into what he describes as the future of now - or your future. With a technical mindset Skeeve considers not only what criminals or terrorists may plot, with enabling technology, but also lone wolves, the disgruntled or disenfranchised or the student and child. With reference to home-made laser weapons, synthetic drugs and hackable building management systems, Skeeve uses his insights and experience, including as a former hacker, to raise awareness of not just the vulnerabilities of the future but the vulnerabilities of today.

We missed the first of his roadshow tour dates in Australia - starting 15 May in Canberra but check out the Australian Computer Society website for upcoming appearances (https://www.acs.org.au/cpd-education/edxn/are-you-cyber-ready.html). Once you meet or see Skeeve present, you won’t be quick to forget the experience.

Recorded May 1, 2018 at the 2nd Annual Security, Safety & Counter Terrorism Forum, Sydney.

For ACS Roadshow details visit https://www.acs.org.au/cpd-education/edxn/are-you-cyber-ready.html (https://www.acs.org.au/cpd-education/edxn/are-you-cyber-ready.html)

Whilst in Sydney presenting to the 2nd Annual Security, Safety & Counter Terrorism Forum, former NSW Police Deputy Commissioner Nick Kaldas gave insight into his current role as Director of Internal Oversight at the United Nations Relief and Works Agency (UNRWA), covering Lebanon, Syria, Jordan, Gaza and the West Bank. Nick is responsible for audits and investigations on behalf of the agency, as well as ethics, compliance and evaluation programs, all while operating within war and conflict zones.

Nick provides specialised insight into the motivations and methodologies of lone wolves, the link to the use of technology and his observations about the application of technology, such as facial recognition, across the world and Middle East region.

Recorded May 1, 2018 at the 2nd Annual Security, Safety & Counter Terrorism Forum, Sydney.

An insightful discussion with Akamai’s Fernando Serto, Head of Security Technology & Strategy and James Tin, Principal Enterprise Security Architect each working in the Asia Pacific & Japan region. Following Fernando’s Summit presentation – ‘Securing the modern enterprise with a modern approach’, Fernando outlines Akamai's enterprise security solutions, with a focus on secure application access. We also discuss the Akamai 2018 State of the Internet Report, dive into current trends around Web Proxy Auto-Discovery (WPAD), Distributed Denial of Service (DDoS) and enterprise security architecture requirements.

WPAD is a protocol that allows computers in a local network to automatically discover which web proxy they should use. The web proxy is defined through a JavaScript file called proxy auto-config (PAC). The risk posed by the WPAD protocol is that attackers can abuse it to discover the location of the PAC file on a local machine. With this information, attackers can then replace it with an “alternative” PAC file, which specifies a rogue web proxy address under the attacker’s control. When that occurs, all communication from the device can be intercepted and modified (including encrypted HTTPS traffic). In other words, WPAD opens the door for a Man-in-the-Middle attack.

2018 State of the Internet-Security (https://www.asiapacificsecuritymagazine.com/akamais-state-of-the-internet-security-carrier-insight-report-highlights-the-importance-of-information-sharing-in-battle-against-cyber-threats/)Report (https://www.asiapacificsecuritymagazine.com/akamais-state-of-the-internet-security-carrier-insight-report-highlights-the-importance-of-information-sharing-in-battle-against-cyber-threats/) highlights:

* The report analysed data from more than 14 trillion DNS queries collected by Akamai between September 2017 and February 2018 from communications service provider (CSP) networks around the world.

* “Javascript Cryptominers: A Shady Business Model” - Akamai observed two distinct business models for large-scale crypto-mining, one of them that uses code embedded into content sites that make devices that visit the site work for the cryptomine.

* Malware authors are branching out to the collection of social media logins in addition to financial information - Terdot, a branch of the Zeus botnet, creates a local proxy and enables attackers to perform cyber-espionage and promote fake news in the victim’s browser.

* The Lopai botnet is an example of how botnet authors are creating more flexible tools - This mobile malware mainly targets Android devices and uses a modular approach that allows owners to create updates with new capabilities.

Recorded at the Cyber Threat Intelligence Summit 2018, Grace Hotel, Sydney 3 May 2018 #CTI2018

Recorded before a live audience at the Australian Cyber Security Centre Conference (https://acsc2018.com.au/), Canberra, 12 April, 2018 this is an in-depth and highly informative panel discussion on Women in Cyber Security.

Chaired by Amy Roberts (Department of Home Affairs) and discussion with Professor Elanor Huntington (https://acsc2018.com.au/program/speakers/index.html#EH) (Australian National University), Mike Burgess (https://acsc2018.com.au/program/speakers/index-2.html#MBU) (Australian Signals Directorate), Dr Maria Milosavljevic (NSW CISO), Debbie Platz AC (Australian Federal Police) and Stephanie Robertson (US National Security Agency)

Duration 50 minutes

In this interview, Morry Morgan speaks with Mike Bareja, Program Manager - National Network at AustCyber (https://www.austcyber.com/)- The Australian Cyber Security Growth Network Ltd following his presentation at CIVSEC 2018 in Melbourne.

Mike outlines AustCyber’s Cyber Security Sector Competitiveness Plan (https://www.austcyber.com/wp-content/uploads/2017/04/Cyber-Security-SCP-April2017.pdf) and the 5 DARPA (https://www.darpa.mil/) Grand Challenges or Knowledge Priorities (https://www.austcyber.com/cyber-security-sector-competitiveness-plan/appendix-industry-knowledge-priorities/), where resources and attention are focused on:

· Emerging prevention, detection and response technologies;

· Identity, authentication and authorisation in the cyber domain;

· Ensuring security, privacy, trust and ethical use of emerging technologies and services; and

· Approaches to deal with the increasingly ‘shared’ responsibility of cyber security.

Funding of $15M over 4 years is available for industry-led, collaborative projects that address the key issues from the Industry Knowledge Priorities.

Recorded 2 May 2018 at CIVSEC 2018 Cyber Pitch event in Melbourne.

In this interview, Morry Morgan chats with Chris Gatford, Director & Founder of Hacklabs, speaking at the CIVSEC 2018 Congress and Exhibition in Melbourne. Chris gave a presentation titled “How to secure your organisation from people like us”, and we quiz Chris on some of the highlights of his talk, as well as learn more about Hacklabs.

We talk about Mossack Fonseca data breach, also known as the Panama Papers, and how Chris used basic Google crafted queries to show huge holes in this financial services cyber security, both before and well after the cyber attack.

We also discuss Hacklabs and how they conduct Red Team penetration testing, that involves both digital and physical access to sensitive information, and how Australia’s achilles heel is that we are far too trusting.

In this interview, Chris Cubbage talks to Rupert Taylor-Price, Founder and CEO of Vault Systems, an Australian-owned, sovereign cloud provider, for highly protected data, purpose built for the Australian government.

Created to enable multiple departments share cyber security infrastructure, Vault Systems have moved into a mainstream government cloud platform, in part by the 2014 cloud-first initiative. Since then, Vault, which was founded by Rupert, has smashed expectations, and recently secured the biggest cloud deal in the history of the Australian government.

Chris and Rupert discuss the process of securing government contracts, in particular, shedding light on the difference between accreditation, certification, the Information Security Registered Assessors Program, or IRAP, as well as complying to the government security standards.

If you’re looking to win business with the Australian government or want to better understand the intentionally bureaucratic processes then you’ll enjoy this episode with Chris Cubbage and Rupert Taylor-Price.

Recorded at the Australian Cyber Security Centre Conference, Canberra, 11 April 2018.

COURSE HIGHLIGHT & PROMOTION: About the Vault Academy (https://shop.vaultsystems.com.au/collections/all/products/vault-training-101)

The Fundamentals of Operating a Secure Cloud, 17-18 May 2018, Canberra: SPECIAL READER DISCOUNT CODE – ACSMVault (https://shop.vaultsystems.com.au/collections/all/products/vault-training-101)

Established in 2017, the Vault Academy is designed to upskill technology professionals for today’s digital and cloud driven computing environment. The academy incorporates a two-day, intensive lab-experience based programme on cloud computing services. The focus is on experiential hands-on lab activities and solving real-life case studies. By the end of the programme, participants will understand the fundamentals of secure cloud computing and the key operating policies and procedures for secure cloud computing.

In this interview, Chris Cubbage talks to Donald Maxim and David Lord, two students from the Australian National University (ANU) to get their experience participating in the Ribit ‘speed dating for jobs’ event at the Australian Cyber Security Conference, in Canberra.

The three discuss the contrasting skill needs and benefits of employers from government, start-up and corporate organisations, and how Ribit is assisting in bridging the cyber security talent gap.

If you’re curious about Ribit, then this podcast episode is for you.

Recorded 11 April 2018, Canberra as part of the Australian Cyber Security Centre Conference, #2018acsc

Relevant Link - www.ribit.net (http://www.ribit.net)

Also refer to Episode 57 – ‘Speed dating for cybersecurity jobs’ - Interview with Liz Jakubowski, Director & Founder of Ribit.net, a Data61 initiative (https://www.blubrry.com/mysecurity/33418463/episode-57-speed-dating-for-cybersecurity-jobs-interview-with-liz-jakubowski-director-founder-of-ribitnet-a-data61-initiative/)

In this interview, Chris Cubbage talks to Shamane Tan, host and founder of the Cyber Risk Meetup Group (https://www.cyberriskmeetup.com/) in Sydney, Melbourne and soon to be Singapore. A Singapore national now based in Australia, Shamane transitioned from computer engineering and recruitment into cyber security, with a practitioner role, namely as a cyber security adviser with Privasec.

Shamane shares the goals of the Cyber Risk Meetup group, recent events, and how her networking events have helped bring a unique perspective to cyber security, while also complementing other cyber security associations.

If you’d like to know how to to connect with like minded cyber security professionals, then this is the podcast for you.

Recorded at the Australian Cyber Security Centre Conference #2018acsc Canberra, 12 April 2018

MySecurity Media and Cyber Risk Meetup group have entered into a Media Partnership to work on developing an integrated event media platform. For more visit www.cyberriskmeetup.com (https://www.cyberriskmeetup.com)

In this interview, Chris Cubbage talks to Liz Jakubowski, Director and Founder of Ribit.net, a Data61 initiative, within the CSIRO, and working with AustCyber, speaking at a ‘speed dating for jobs’ event at the Australian Cyber Security Centre Conference, in Canberra.

Liz discusses her organisation’s goal for matching talent start-ups, big business, and government, through an algorithm, which takes into consideration students’ hard and soft skills.

If you’re interested in filling the cyber security talent gap, or seeking talent out itself, then you’ll enjoy this interview with Liz Jakubowski.

Recorded 10 April 2018, Canberra as part of the Australian Cyber Security Centre Conference, #2018acsc

Relevant Link - www.ribit.net

See also Part 2 - The Students Perspective - Episode 59 – ‘Speed dating for cybersecurity jobs’ - Part 2 - Interview with ANU students & experience with Ribit.net (https://australiancybersecuritymagazine.com.au/episode-59-speed-dating-for-cybersecurity-jobs-part-2-interview-with-anu-students-experience-with-ribit-net/ )