This week the gang's all here to talk about some news happenings. Michael, James and I talk through some of the stories we've been tracking.

Have something you've been reading and want to talk about? Hit us on Twitter with hashtag #DtSR and suggest a topic/story for the next NewsCast!

Tennessee Amends Breach Notification Statute

• http://www.natlawreview.com/article/tennessee-amends-breach-notification-statute
• Removes the exception for encrypted data.
• Will this raise the costs to companies?  
• • Encrypted or not, will credit monitoring be the norm?
  • More lawsuits (even if the data is encrypted)
• Do we run the risk of notification overload?
• • What do people do with these notifications anyway?

FFIEC’s New Mobile Security Guidance: An Assessment

• http://www.bankinfosecurity.com/ffiecs-new-mobile-security-guidance-assessment-a-9104
• Interesting how they discuss some of the risks (SMS, mobile enabled website) but also talk about ways to mitigate the risk.

Software “glitch” kills Formula1 car mid-race

• Does not take a rocket surgeon to figure out the real-world applications here
  • Sure this time it was a 'glitch' but could just as well have been a security bug, exploited by an attacker?
• Many vehicles are now ‘smart’ and phone home, make decision and drive for you
• http://news.filehippo.com/2016/05/software-glitch-kills-formula-1-car-mid-race/

Lin

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

Michael and I welcome back Shawn Tuma, our resident Cyber Law Expert from the great state of Texas. We discuss some of the recent cases (unlocking an iPhone!) and some of the tough issues facing the court systems today. Shawn provides insights into the use of the finger (not joking) and some amusing and frustrating aspects of cyber law as the courts continue to evolve. Join us!

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode..

ImageTragick - major flaw in open source image processing toolkit

• ImageTragick is CVE-2016-3714
• Logo & Website: https://imagetragick.com
• Has a logo, so it must be yuge
• Is this really that big of a deal? How many are impacted potentially?
• https://blog.sucuri.net/2016/05/imagemagick-remote-command-execution-vulnerability.html
• Remote code execution, with minor caveats - likely darn near everywhere

Detroit company loses $495k to wire fraud

• Source was a faked email to make a wire transfer
• Why didn’t someone verify this?!
• http://www.detroitnews.com/story/news/local/oakland-county/2016/05/03/troy-investment-company-hacked/83879240/
• Will insurance pay out?
• Is the policy change too little too late? How can other companies learn from this?

The Ransomware Epidemic (Optiv blog)

• Is there an epidemic at play here?
• Why the switch to ransoming people’s data
• Is this a viable business model for cyber criminals?
• https://www.optiv.com/blog/ransomware-part-1-is-this-an-epidemic

Undetectable flaw in Qualcomm-powered Android phones is a huge deal

• Input sanitization flaw (again?!)
• At risk is 34% users running Android 4.3 and earlier
• Text messages and call histories accessible in plain text
• An "undetectable" software flaw in Qualcomm Snapdragon-powered Android smartphones could lay bare users' text messages and call histories to hackers

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

Join our guest Larry Whiteside, Michael and I as werecord live from InfoSec World 2016 in sunnyOrlando, Florida! We talk through the life of a CISO, and thechallenges of being in the Healthcare and Critical Infrastructurespaces and the similarities and differences. Larry has had a verydiverse and successful career leading some of the most challengingorganizations, so we dig into some of the things he's faced, howhe's addressed some of those bigger leadership-level challenges,and just the mess that healthcare and critical infrastructure arein right now.

Don't miss this episode!

Guest

• Larry Whiteside Jr. ( @LarryWhiteside ) - Larry is the VP ofHealthcare and Critical Infrastructure at Optiv, and he's taskedwith creating innovative solutions to some of the industry's mostchallenging problems. More info here: https://www.optiv.com/about-us/press-releases/optiv-security-increases-focus-on-holistic-cyber-security-solutions-for-healthcare-and-critical-infrastructure-industries

Note: I'm blessed with being able to work withLarry on a daily basis at Optiv. I highly encourage you to listento this podcast and share with your friends and colleagues in thehealthcare and critical infrastructure space.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

Only about a third of companies know how many vendors accesstheir systems

• nearly every company is at risk for a third party breach
• it's almost impossible to vet every third party
• developing a strategy and being consistent, scaling is key
• http://www.csoonline.com/article/3055012/techology-business/only-a-third-of-companies-know-how-many-vendors-access-their-systems.html

No firewall, second-hand $10 routers are to blame for Bengladeshbank heist

• we talked about this initially in episode 185(Link: DtSREpisode 185 - NewsCast for March 15th 2016)
• it's almost unfathomable that this happened
• SWIFT attacked, now the suspected malware is identified

Jim McKelvey's Launchcode is helping unconventional techtalent

• internal mentorships could be the key
• who out there is doing this, talk back to us using hashtag#DtSR on Twitter

The Simpson's math secret is the key to better security ...?

• http://www.csoonline.com/article/3054566/leadership-management/the-simpsons-math-secret-is-the-key-to-better-security.html

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode, James, Michael and I are live from InfoSec World 2016 and we get the pleasure of interviewing Lance James fresh off the keynote stage. In this intimate, fast-paced and bold interview we talk through some of the challenges InfoSec is facing today, and where Lance believes we should be going.

If you haven't been to InfoSec World, we highly recommend going next year. The content team continues to provide a solid mix of technical, managerial and transitioning information security speakers. Make sure you have this one on your calendar for next year, and being the family!

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

Pros examine mossack-fonseca breach: Wordpress plugin, Drupal likely suspects

• Plug-ins seem to be a universal weakness
• Many companies have this type of 3rd party security issue
• The broader enterprise implications - how do you find these sites?
• http://www.scmagazine.com/pros-examine-mossack-fonseca-breach-wordpress-plugin-drupal-likely-suspects/article/488697/

WordPress pushes free https encryption for all hosted sites

• What's the problem we're trying to solve?
• 2 separate issues, trust vs. authentication - know which you're solving
• http://www.securityweek.com/wordpresscom-pushes-free-https-all-hosted-sites

If you can't break crypto, break the client

• Bishop-Fox researcher finds webkit bug in iMessage
• JavaScript in iMessage, sure, why not
• Same-Origin-Policy (SOP) not enforced since it's a desktop app
• http://www.bishopfox.com/blog/2016/04/if-you-cant-break-crypto-break-the-client-recovery-of-plaintext-imessage-data/

Executives - "We're not responsible for cyber security"

• Raf: This is squarely the fault of security professionals failing to make the security discussion a part of the enterprise vernacular
• Michael & James: What does this mean, and what do we do not? If anything.
• http://www.cnbc.com/2016/04/01/many-executives-say-theyre-not-responsible-for-cybersecurity-survey.html

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

Intro song: "Josh Gabriel - Deep Down"; Intro/Outro v/o courtesy of @ToddHaverkos

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

• BadLock bug (which now has a website, a graphic, and more hype than Bieber) is out there
  • Is the bug really worth all this hype?
  • Is this anything more than a PR stunt, and a big marketing opportunity?
  • Everyone has an opinion, but one thing is for certain, this bug is making big waves
  • http://www.wired.com/2016/03/hype-around-mysterious-badlock-bug-raises-criticism/
• Your wireless mouse is probably a security risk... seriously.
  • RF-based mice typically don't use encryption or mutual authentication
  • Some do (all of my Microsoft & Logitech mice tell me they mutually authenticate & encrypt... I think)
  • How far up, or down, your risk register is this one; and how much should it matter to enterprise?
  • http://www.thefiscaltimes.com/2016/03/23/Your-Wireless-Mouse-May-Be-Exposing-You-Cyber-Hackers
• Your Node.js package manager could be an entry point for worms?
  • Now that everything has functionality over our endpoints...
  • Dependencies seem to be (at least partially) to blame here (who's surprised?)
  • http://news.softpedia.com/news/node-js-package-manager-vulnerable-to-malicious-worm-packages-502216.shtml
• Ransomware is getting nastier (and more effective)
  • Remember it's just a business model, so they actually are pretty good at unlocking, support, etc once you pay up
  • What happens when a hospital system gets locked/encrypted -- real lives are at stake here!
  • Enterprise advice? Backup, test, and take it all offline regularly so you can recover
  • This is only going to get worse. Much, much worse.
  • http://www.itsecurityplanet.com/experts-corner/hospital-hit-with-ransomware-contagion-declares-internal-emergency
  • http://www.healthitoutcomes.com/doc/backup-recovery-system-control-ransomware-attack-0001
  • http://www.healthcareitnews.com/news/ransomware-wreak-havoc-2016-icit-study-says

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode

I posed some questions to Joey, an InfoSec professional who had recently moved into a CISO role in a midwest retail company:

• Let's talk a little bit about the background you had before walking into your first day as a CISO...
• How long have you been in your role, and what do you think "so far"?
• What do you think were the biggest lessons you've learned in your time as a new CISO?
• What do you make of all the talk about CISO burn-out rates, and the average tenure of a CISO being less than 2 years?
• What do you see as the role of the CISO in today's business climate?
• How do you work with other IT leadership, and executive leadership to make your mark and do your job?
• From your experience, what do you think someone who is taking a new CISO role, or thinking about doing so, should know?

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast