Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

Big announcement inside!

Stories covered:

http://www.mercurynews.com/business/ci_25369262/jesse-jackson-take-techs-lack-diversity

https://securosis.com/blog/jennifer-minella-is-now-a-contributing-analyst

http://seclists.org/dailydave/2014/q1/74

http://www.hollywoodreporter.com/news/man-who-exposed-target-security-689782

http://www.cnet.com/news/symantec-fires-ceo-steve-bennett/

 

Advice from Bob; The problems with qualitative risk assessments; Defending like an attacker; Secunia's vulnerability review; Watching for data breaches by looking for anomalies; The NSA targets sysadmins, expect criminals to follow suit; Insurers are finding energy firms controls are not up to snuff; 4 lessons CIOs can learn from the Target breach; A court approved a damages settlement for victims of a data breach who did not suffer any damages; Trustwave, Target's QSA, gets sued as a result of the breach.

Advice for the criminals from Bob; Pwn2Own results are in; Target ignored it's FireEye alerts; Integrating threat intelligence into your operations; The problem with threat intelligence; Advanced endpoint protection advice; Workers are apathetic about lost mobile devices and company data; Lessons to learn from the hack of some Navy servers; How the Syrian Electronic Army compromised Forbes; a discussion about what to do when you see criminal activity.

Some security advice from Bob; Target's CIO resigns, should the QSA bear some responsibility? Rogue ads overtake porn as top source for mobile malware; Five things to know about malware before driving it out; Why you need to segment your network; SecurePay in denial about breach; Sally Beauty apparently breached.

Security recommendations from Bob; Meetup.com rides out a DDOS attack rather than pay a ransom; How to test the security savvy of your employees; Why companies need to think about this insider threat; 6 lessons learned from advanced attacks; How IT can establish better cloud control; Council on Cyber Security releases version 5 of critical security controls.

Tip from Bob; US Cyber Security Framework; Challenges with deploying insecure technology; Target vendor compromised through email and some discussions on vendor risks; Healthcare organizations are UNDER SIEGE by cyber attacks; The DSD's ranking of security controls; 6 tips to combat APT; The importance of not running with administrator rights; Neiman Marcus breach details begin to emerge, 60,000 events went uninvestigated.

A small bit of advice from Bob; A lengthy discussion on communicating risk to management.

More advice from Bob; Verizon's report on PCI compliance; Target hacked through HVAC contractor; Reporting fail on hacking the Winter Olympics; Optimizing the use of security budgets in larger organizations.

More advice from Bob; Follow up on Coke's lost laptops; Honey Encryption to frustrate attackers; What the Target breach shows us about vendor risk; Managing the response to a data breach; More POS malware, this time with TOR goodness.

Coke loses 55 laptops and 56000 records over 7 years; Private cyber espionage network in India; Review of the Shell_Crew hack using Adobe Cold Fusion exploit; Should we punish employees who fall for phishing emails?; Assuming your network has been hacked; more details on the Target breach are emerging.