Send the hosts a message - try it now!

Quick note from Michael about the Straight Talk Framework -- >

• I’ve separated the framework from the programs; the framework is free and available for download from my website. More on the way!
• To support both the framework and the programs, I’ve just finished a video that introduces the 5 questions; I have an optional workbook available and make a special offer at the end of the video
• I’m about to launch an online offering… stay tuned for details

 

$2.7 Million HIPAA Penalty For Two Smaller Breaches

• http://www.healthcareinfosecurity.com/27-million-hipaa-penalty-for-two-smaller-breaches-a-9270?rf=2016-07-18-eh&mkt_tok=eyJpIjoiWW1GaE5ERmtNR05oTldRMiIsInQiOiJ5YWd6dDg4cW84TXVCR0NCVkJ0KytQTnVwOHQ2UHBON0FMeWVZRDVleE82d3Zpdyt2S1RwNWFmZEs0aVRyQ3lMTlk3YWdaa0VmbnV4djVIOVVxczFUYkdsTHBKRGpld3h5bXU3aHRoNnhUaz0ifQ%3D%3D
• Interesting the info about the use of Google and lack of contract. How many other health companies are using Google or Microsoft to store some data?  Do they have the contracts in place?

Is the GOP seriously considering endorsing vigilante hacking?!

• The wording here is dangerous, and could encourage vigilante justice
• So much could go wrong here, so much collateral damage
• You’ll likely hear a re-start of the hack back debate
• http://www.inforisktoday.com/blogs/gop-platform-suggests-hack-back-suitable-cyber-defense-p-2186
• What if we just called it “forward looking research in a kinetic state?”

NIST declares the age of SMS based 2-factor authentication over

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

This week, Chris Romeo joins Michael, James and I to talk about changing the security posture of an organization by changing culture. This episode talks through tough issues like incentives, measurements and success factors. This episode with Chris is of particular interest for leaders and those who are working hard to change companies at their core, for the long term.

 

Chris Romeo's bio:

Chris Romeo is CEO and co-founder of Security Journey. His passion is to bring application security awareness to all organizations, large and small. He was the Chief Security Advocate at Cisco Systems for five years, where he guided Cisco’s Secure Development Life Cycle program, empowering engineers to "build security in" to all products at Cisco. He led the creation of Cisco’s internal, end-to-end application security awareness program launched in 2012. Chris has twenty years of experience in security, holding positions in application security, penetration testing, and incident response. Chris holds the CISSP and CSSLP certifications, and is a frequent conference speaker at RSA and AppSec.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

Ransomware that's 100% pure JavaScript? Sort of...

• Slightly misleading article
• Generally a Windows-based attack (go where the users are)
• https://nakedsecurity.sophos.com/2016/06/20/ransomware-thats-100-pure-javascript-no-download-required/

Researchers have come up with a 'cure' for ransomware

• Based on some interesting things like file-type changes, similarity measurements and entropy
• Interesting but not perfect ... do we even think perfect is reachable?
• Average of 10 files before an identification was made
• http://www.scmagazineuk.com/florida-researchers-claim-to-discover-cure-for-the-common-ransomware/article/509147/

The government has officially issued a 'fact sheet' on randomware

• Yes, it's a reportable breach
• Lots of interesting misconceptions (or half-truths) in this guidance
• Good for them for asking us to 'do better' but it's not enough
• Go read for yourself! http://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf

Pokemon Go! - a neat idea with big issues potentially

• First there are the privacy and security implications
• Then there is the app that wants every permission known to man
• Physical security and well-being issues?
• http://abcnews.go.com/Business/hit-app-pokemon-raises-security-concerns-google-account/story?id=40524454

FDIC hacked but covered it up, didn't report

• Perfect example of "the cobbler's children have no shoes"
• The FDIC is consistently terrible, and does little to close the gaps
• Obviously, it was China
• http://thehill.com/policy/cybersecurity/287561-chinese-government-likely-hacked-fdic-report

The Fiat/Chrysler bug bounty program

• They will only pay you $1,500
• Lots of uproar about how the pay-out isn't enough but there is so much more her
• Lots to unpack, including issues with complexity on enterprise side
• https://www.wired.com/2016/07/chrysler-launches-detroits-first-bug-bounty-hackers/

 

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

This week on the Down the Security Rabbithole podcast, Brandon Dunlap is back for his second show. Following up on Episode 158 where we discussed outsourced security, this time around we talk through the next iteration of what "Managed Security" and outsourcing means to security.

You're not going to want to miss this episode!

As always, hit up our hashtag on Twitter at #DtSR and you can find Brandon on Twitter as well at @bsdunlap if you want to talk to him directly.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

** Our 200th numbered episode! **

 

A note from Raf:

 Thanks to everyone who has been listening to us, tweeting us, and sharing the links to our podcast. We are absolutely floored with the support and listenership we've received. The average show now gets just under 2,500 downloads when released in the first week, and that number goes up every week. So from the bottom of my heart, I humbly thank you and hope you'll continue to listen, share, and comment.

This week's episode is titled "Privacy, Security, Risk and Law Collide" as we host Dr. Chris Pierson and our recurring legal eagle from the great state of Texas, Shawn Tuma. If you don't have Shawn added on Twitter, you should go follow him right now.

In this week's episode we discuss the increasingly overlapping world of what was once "IT security" which has now started coming together with privacy, risk and law. Chris is uniquely poised to talk on the subject, as you will hear his credentials speak for themselves. You'll want to get comfortable, pay attention, and give this episode a careful listen as we take you down the security rabbithole for the 200th time.

 

Guest:

• Dr. Chris Pierson, CSO and General Counsel, Viewpost
  

  Dr. Chris Pierson is the EVP, Chief Security Officer & General Counsel for Viewpost. Dr. Pierson serves on the Department of Homeland Security’s Data Privacy and Integrity Advisory Committee and Cybersecurity Subcommittee and is a Distinguished Fellow of the Ponemon Institute.  Previously, Chris was the first Chief Privacy Officer, SVP for the Royal Bank of Scotland’s U.S. banking operations leading its privacy and data protection program.  Chris was also a corporate attorney for Lewis and Roca where he established it’s Cybersecurity Practice representing companies on security and data breach matters. Chris is a graduate of Boston College (B.A., M.A.) and The University of Iowa (Ph.D., J.D.) and gives keynotes/speaks at national events and is frequently quoted on cybersecurity.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

In this episode..

 

The "Nuclear Bomb" analogy isn't working, stop using it"

• http://thebulletin.org/flawed-analogy-between-nuclear-and-cyber-deterrence9179
• This is important with respect to how security people talk to real-life issues
• Here is another example: http://insight.kellogg.northwestern.edu/article/is-reading-someones-emails-like-entering-their-home/

 

iOS apps will require secure https connections by 2017

• http://www.cnet.com/news/ios-apps-will-require-secure-https-connections-by-2017/
• We have seen this push on the web before
• • Michael wrote about this topic back in March 2015 (https://www.developsec.com/2015/03/17/is-http-being-left-behind-for-https/)
  • Saw the government push this for all public facing websites (https://https.cio.gov/)

 

Inside Sierra: How apple watch “auto unlock” will let you jump straight into MacOS

• http://appleinsider.com/articles/16/06/16/inside-sierra-how-apple-watch-auto-unlock-will-let-you-jump-straight-into-macos
• Interesting idea here..  Thoughts?

 

FICO to Offer 'Enterprise Security Scores'

• http://www.fico.com/en/fraud-security/cyber-security
• http://www.fico.com/en/products/fico-enterprise-security-scoring
• Is this something you’d do?
• Do you trust it?
• Breakthrough we’ve been waiting for?

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

On this episode of the Down the Security Rabbithole podcast, Dawn-Marie Hutchinson, currently an Executive Director within the Optiv Office of the CISO joins us and we talk about the things that she's learned over her career working with legal counsel, CISOs and solving problems. A fantastic episode with lessons learned, and executive leadership crammed into less than an hour. Give it a listen!

 

Find Rie on Twitter at @CISO_Advantage

 

UPDATE: Thanks to Sean Jackson (@74rku5) who has hand-transcribed the show. I haven't read this, personally, so if there if he slipped any humor I can't be held accountable!

http://pastebin.com/JMk0rpFQ

 

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

In this episode...

 

 

Are people "going offline" as a result of increasing dangers of the Internet?

• This article makes the case for yes: http://www.techspot.com/news/64839-increasing-number-internet-dangers-driving-millions-americans-offline.html
• But ... "millions"? We collectively call BS
• As the world moves more to mobile and digital, who thinks they have 'control' of their own data anyway?

 

"Sandjacking" allows attackers to install evil iOS apps

• IF that attacker is physically holding your device
• AND your device is unlocked
• AND it takes a while because you have to backup, and restore a phone ... one app at a time
• SO this isn't something you do to infiltrate someone's phone while they walk away for a few minutes to the restroom
• Cool trick bro, but where on the spectrum of critical things does this fall?
• The technique is called "Su-A-Cyder" ... awful name, lose points
• http://www.securityweek.com/sandjacking-attack-allows-hackers-install-evil-ios-apps

 

Dropbox takes heat for a breach, that wasn't their breach

• So what happens when you get blamed for a breach that you don't have anything to do with?
• http://krebsonsecurity.com/2016/06/dropbox-smeared-in-week-of-megabreaches/
• What would YOUR company do if you were Dropbox?

 

Lenovo's asking people to uninstall it's bloatware "Accelerator" app

• ...because it's a massive security breach waiting to happen
• Of all the bloatware vendors install, I'm willing to be this isn't unique
• [Michael] Hey, at least they're admitting defeat here, right?
• http://www.zdnet.com/article/lenovo-begs-users-to-uninstall-accelerator-app-in-the-name-of-security/
• [Raf] Does no one sense the delicious irony of a Chinese PC maker riddled with security issues in their product?

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

On this episode of the Down the Security Rabbithole podcast, I get the pleasure of sitting down with one of my all-time favorite Chief Security Executives, Mr. Jason Witty. He's had a long career of successful security leadership, and in this podcast he sits down with us to talk about risk, threats and words we often confuse.

You're not going to want to miss this episode.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Send the hosts a message - try it now!

This week the gang's all here to talk about some news happenings. Michael, James and I talk through some of the stories we've been tracking.

Have something you've been reading and want to talk about? Hit us on Twitter with hashtag #DtSR and suggest a topic/story for the next NewsCast!

 

Tennessee Amends Breach Notification Statute

• http://www.natlawreview.com/article/tennessee-amends-breach-notification-statute
• Removes the exception for encrypted data.
• Will this raise the costs to companies?  
• • Encrypted or not, will credit monitoring be the norm?
  • More lawsuits (even if the data is encrypted)
• Do we run the risk of notification overload?
• • What do people do with these notifications anyway?

FFIEC’s New Mobile Security Guidance: An Assessment

• http://www.bankinfosecurity.com/ffiecs-new-mobile-security-guidance-assessment-a-9104
• Interesting how they discuss some of the risks (SMS, mobile enabled website) but also talk about ways to mitigate the risk.

Software “glitch” kills Formula1 car mid-race

• Does not take a rocket surgeon to figure out the real-world applications here
  • Sure this time it was a 'glitch' but could just as well have been a security bug, exploited by an attacker?
• Many vehicles are now ‘smart’ and phone home, make decision and drive for you
• http://news.filehippo.com/2016/05/software-glitch-kills-formula-1-car-mid-race/

Linked

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast