In this episode...

• Brandon, Michael and I discuss the challenges of leadership and how leadership is more than just telling people what to do. Brandon gives us some of his back-stories and anecdotes to illustrate his points on leadership along the way.
• I promise you'll love this episode, and I highly encourage you to go donate what you're able to, to Red Circle Foundation (http://redcirclefoundation.org).

Guest

• Brandon Webb ( @BrandonTWebb ) - Brandon is a former Navy SEAL, bestselling author and CEO of Force12 Media. He founded Red Circle Foundation as a way to give back to the families of the Special Ops community in a meaningful way.

Links

• Red Circle Foundation - http://redcirclefoundation.org/ 
• SOFREP - http://sofrep.com
• Brandon's website - http://brandontylerwebb.com/

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode

• Court strikes down Wyndham's challenge to FTC power
  • We have covered this before
  • Wyndham argued due proces and lack of case law - asked for dismissal
  • Court said no dismissal, FTC has standing
  • FTC is arguing that Wyndham made promises it did not keep
  • Should be interesting to watch this go to court (or likely not)
  • http://www.csoonline.com/article/2975915/data-breach/wyndham-vs-ftc-corporate-security-pros-need-to-lawyer-up-about-data-breach-protection-experts-say.html
• Ashley Madison hauled into court by class-action suit
  • Lots of thorny issues here, must separate out moral from legal
  • Shines light on the continued bias for breach prevention
  • Interesting Streisand effect here
  • http://www.csoonline.com/article/2975755/data-breach/ashley-madison-hauled-to-court-in-class-action-suits-over-data-breach.html
• Verizon launches Hum OBD port vehicle monitor and communication tool
  • In light of the stunt-hacking against Chrysler/Jeep is Verizon tone deaf?
  • ..or are they simply that confident in their security?
  • There is no mention, by the way, of security of the device on the web site
  • http://www.macnn.com/articles/15/08/26/service.not.reliant.on.verizons.network.uses.any.ios.or.android.phone.130118/
• The move to EMV cards (chip & sign) in America is changing how fraud happens
  • EMV cards cost a fortune to implement
  • Solving a problem the finance industry did not have
  • http://www.bankinfosecurity.com/interviews/emv-shift-preparing-for-fraud-migration-i-2850#

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this MicroCast, live from HTCIA Conference 2015 in Orlando, FL, Michael and I quickly set the stage for a conversation on conference speaker/attendee engagement. 

[Raf] One of my biggest pet peeves as a speaker is getting a room-full of people who watch (and listen) me speak, wait for me to finish, and leave when I'm done.

[Michael] As an attendee, you need to know what you "do" and what you're looking for from the conference.

--> Here's the link to the article Michael mentions: http://paulsohn.org/how-to-connect-with-anyone-you-just-met-with-5-questions/

We welcome the discussion on this topic, #DtSR on Twitter!

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

• We discuss what life is like as the CISO when you have all the responsibility for, but no administrative access (or hands on keyboard)
• Brandon tells his story about how his IT organization went from in-house, to out-house, and how they got where they are
• Brandon tells us the process and strategy he uses to get a handle on his security
• We discuss why visibility is one of the most important things to outsourced IT (and security)
• Brandon tells a story of an incident where things went very sideways
• We discuss the balance between outsourcer scalability and customer deviations
• Brandon tells us why sometimes it takes 3 months to scan your environment for a vulnerability ( your head will explode )
• …and so much more

Guest

• Brandon Dunlap ( @bsdunlap ) - Brandon is the global Chief Information Security Officer for a an employee-owned, global leader in building critical infrastructure in energy, water, telecommunications and government services currently operating in more than 100 countries through consulting, engineering, construction, operations and program management.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

• Just when you thought America's neutered "chip & sign" was a safe
  
  • http://krebsonsecurity.com/2015/08/chip-card-atm-shimmer-found-in-mexico/
  • Admittedly we put these stories in here just to get Michael all fired up
• Ashley Madison's data and source code and CEO's email spool now released and public
  • http://www.theregister.co.uk/2015/08/20/ashley_madison_email_dump/
  • http://www.csoonline.com/article/2973575/business-continuity/ashley-madison-self-assessments-highlight-security-fears-and-failures.html
  • So much to talk about that's just wrong with this story...
• Uber is hiring people for security
  • http://www.ibtimes.com/uber-boost-security-staff-after-data-privacy-concerns-2055903
  • Does more headcount equal better security?
  • Where will these people come from given the shortage of talent?
• That gadget you attached to your OBD2 port on your car to "save on car insurance" may be used to kill you
  • Seriously
  • The dangers of all these wireless & connected devices is scary
  • Risk assessment anyone?
  • http://www.wired.com/2015/08/hackers-cut-corvettes-brakes-via-common-car-gadget/
  • Someone get Flo on the phone...
• Windows 2003 which is now expired still has 609,000 public servers on the Internet
  • Translates into roughly 175M websites (Netcraft)
  • Why are thse out there?
  • Is there really a risk or is this hype?
  • http://www.zdnet.com/article/windows-server-2003-servers-insecure-unpatched/
• ATC systems go down as they were ... being updated!
  • Common problem of ancient systems going down due to upgrade
  • ATC has ZERO patch window
  • ..also close to ZERO ability to test patches/updates in "lab" environment
  • Complex, ancient systems fail when they're upgraded, sometimes catastrophically
  • http://thehill.com/policy/cybersecurity/251310-software-limits-exposed-in-air-traffic-outage

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

• We discuss the ever-growing need for strong leadership in security
• I ask whether experience and longevity in a position naturally brings leadership qualities
• We talk through how leadership interplays with other competencies
• Michael asks whether the security leader has a place at the executive table (the "big kids table")
• Michael asks if the MBA has value in security leadership
• We discuss the model my team uses for leadership and how we build them
• Michael and Heath discuss various competency models for leadership
• We discuss measuring, KPIs and relative distance
• We discuss how leaders can make better decisions
• Heath leaves us with an Alex Hutton quote

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

• The Belgian government's internal phishing test has "gone off the rails" a bit
  • Used a legitimate entity to test against
  • Panic and hilarity ensued, but mostly panic
  • http://www.networkworld.com/article/2951514/security/belgian-government-phishing-test-goes-offtrack.html
• British ICO makes a 180,000 pound fine
  • Disconnect between policy and reality
  • Was anything lost?
  • 2 big failures lead to a fine
  • https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2015/08/ico-fines-nationwide-money-lender-the-money-shop-180-000/
• McAfee and Black Hat attendee surveys wildly different
  • Answers you get depend on who and how you ask
  • Interesting answert though...
  • Lesson: The more experience you have, the less confidence?
  • http://www.slate.com/blogs/future_tense/2015/07/21/two_surveys_of_cybersecurity_professionals_show_starkly_different_attitudes.html

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode

• Raf asks - Why haven’t we solved the same old software security bugs?
• James asks how a security team gets out of the way and still get better security?
• We discuss threat modeling, and channel a bit of John Steven
• Jeff talks about the OWASP ESAPI and standard security libraries and controls
• Jeff talks about “libraries with known vulnerabilities” and the role of open source components
• Raf brings up the ugly side of enterprise outsourcing - code development by committee
• We discuss static, dynamic and run-time security tools
• Raf asks Jeff what the RIGHT approach to creating a software program looks like

Guest

• Jeff Williams ( @PlanetLevel ) - Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. In 2002, Jeff co-founded and became CEO of Aspect Security, a successful and innovative consulting company focused on application security. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many other widely adopted free and open projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode...

• "Hackers remotely kill a Jeep!"
  • Lots to talk about
  • Basics of segmentation weren't followed, aren't followed
  • Discussion on software 'fitness' and liability
  • http://www.cato.org/blog/hackers-remotely-kill-jeep
• Firefox blocks Flash and FaceBook calls for its death
  • Should it concern you that FireFox can change your config without your permission or an update?
  • How helpful is this? Does the message/pop-up actually DO anything to stop users from clicking YES?
  • http://money.cnn.com/2015/07/14/technology/flash-firefox-facebook/index.html
• Ashley Madison (the cheating website) breached!
  • Check their privacy policy - is it consistent with actions?
  • Did this event delay or possibly end the company's aspirations of going public?
  • The morality of AM's business model shouldn't be an issue here - but it keeps coming up
  • http://www.csmonitor.com/World/Passcode/2015/0722/Ashley-Madison-breach-a-painful-reminder-of-online-data-s-permanence
• British Gas bows to criticism over blocking password managers
  • http://www.scmagazineuk.com/british-gas-bows-to-criticism-over-blocking-password-managers/article/426463/
• US Court says "pocket dialed" called are NOT private
  • http://www.itworld.com/article/2951715/security/us-court-says-pocketdialed-calls-are-not-private.html

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

In this episode

• Talent shortage - is it real, and how bad is it?
• We discuss: what does negative unemployment actually mean?
• Michael asks- ecurity is still relatively new, how do we determined what “qualified” means?
• What skills are necessary to be a good security professional?
• Hiring - we discuss how we get better at screening potentially qualified employees
• We discuss how we can vet out real experience, versus resume skills
• Mark and Michael discuss specialization, automation, and optimizing our workforce
• Mark shares his thoughts on growing and retaining top talent

Guest

• Mark Orlando ( @MarkAOrlando )  - As the Director of Cyber Operations, Mark is responsible for Foreground’s Federal practice as well as the Virtual Security Operations Center (V-SOC) managed service. He leads a national team of analysts, engineers, incident responders, and managers who secure some of the most high profile networks in the Federal, financial, commercial, and power and utilities industries. As the senior operations subject matter expert, he is also responsible for security services strategy and advises on strategic Foreground initiatives such as threat intelligence analysis, custom analytics development. Mark is also a key advisor to the company’s award-winning educational unit, Foreground University. Prior to joining Foreground Security, Mark advanced through the technical ranks as a Security Analyst and Technical Lead in a variety of operations environments. In his 13+ years of experience, he has built and led security operations teams at the White House, the Department of Energy, the Pentagon, and numerous commercial organizations. He has also managed the operations division of a major Managed Security Service Provider supporting hundreds of private and public sector clients. Mark enjoys teaching and learning from others. He has presented on security operations and assessment at the Institute for Applied Network Security Forum and RSA Conference. Mark has earned the CISSP, PMP, CEH, ITIL, and multiple SANS GIAC certifications and holds a B.S. In Advanced Information Technology from George Mason University. Mark served in the US Marine Corp where he was a Marine Artillery NCO.
  
  Foreground Security (http://foregroundsecurity.com/)

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast