In this refused episode of the Exploring Information Security podcast, Michael Kavka joins me to discuss how to handle call for presentation rejections.

Michael (@SiliconShecky) wrote a blog post on his site at the beginning of the year titled, It is CFP season... So what. In the article he hit on rejections and I thought it'd make for a great podcast topic. More recently, he wrote a blog post on the, Anatomy of a Rejected CFP. The article walks through his rejected CFP for DerbyCon.

In this episode we discuss:

• What is Michael's experience in submitting CFPs
• Why a CFP is rejected
• What are the different types of cons?
• How to handle a CFP rejection letter

More resources:

• The Building Blocks of Infosec CFPs by Kat Sweet
• How Do I Make My CFP Stand Out by Nikita
• CFP 101 - Tottenkoph, Guy McDudefella, Security Moey, David Mortman

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this expedition edition of the Exploring Information Security podcast, Chris Maddalena a senior security consultant joins me to discuss how to create a phishing email.

Chris (@cmaddalena) joins me to discuss crafting a phishing email. This is something I've recently explored at work. Having little to no experience actually crafting a phish, I decided I'd go to someone who does this on a regular basis. Check out Chris' ODIN tool for automating intelligence gathering, asset discovery, and reporting.

In this episode we discuss:

• What are the technical steps to creating a phish

• What needs to be consider from a technical standpoint

• What is GoPhish and GoReporter

• How important is timing

Other resources:

• gophish

• goreporter

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this expedition edition of the Exploring Information Security podcast, Chris Maddalena a senior security consultant joins me to discuss how to create a phishing email.

Chris (@cmaddalena) joins me to discuss crafting a phishing email. This is something I've recently explored at work. Having little to no experience actually crafting a phish, I decided I'd go to someone who does this on a regular basis. Check out Chris' ODIN tool for automating intelligence gathering, asset discovery, and reporting.

In this episode we discuss:

• What you need to consider before creating a phish.
• Where to get phishing ideas.
• Where to get phishing templates.
• What happened when accounting sent out an email.

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this battlefield edition of the Exploring Information Security podcast, Micah Hoffman joins me to discuss OSINT ORCS YOGA.

Micah (@WebBreacher), is a SANS Instructor and author of the SEC487 OSINT course. He recently had his second class in Denver, Colorado (more dates here). During that class he found people asking about how to navigate the waters of OSINT resources. His solution was to start the OSINT Resource Classification System (ORCS). It's a call for the OSINT community to standardize on how resources are categorized. YOGA or Your OSINT Graphical Analyzer is meant to be a visual aid for people looking to navigate the streets of OSINT resources.

In this episode we discuss:

• How SANS SEC487 is coming along
• What is YOGA?
• What is ORCS?
• Why is ORCS YOGA important?

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this 2k-like edition of the Exploring Information Security podcast, Stuart Scott AWS Content Lead at Cloud Academy and George Gerchow Chief Security Officer at Sumologic join me to discuss how to implement GDPR.

Stuart (@Stuart_A_Scott) and George (@georgegerchow) both have contributed content to CloudAcademy on GDPR. Stuart has a nine hour course on using AWS Compliance Enabling Services. George has a done a webinar and written an article on the topic. Both are well spoken and highly informed on the topic. They provide a lot of good direction for anyone looking to account for GDPR in their organization (pro tip: everyone should be looking into this).

In this episode we discuss:

• How to implement GDPR in AWS
• What are subject data rights?
• How other regulations are impacted
• What's ahead for GDPR

More resources:

• AWS Security Service
• AWS Access & Key Management
• CloudAcademy Blog
• Stuart's blog on CloudAcademy

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this 2k-like edition of the Exploring Information Security podcast, Stuart Scott AWS Content Lead at Cloud Academy and George Gerchow Chief Security Officer at Sumologic join me to discuss how to implement GDPR.

Stuart (@Stuart_A_Scott) and George (@georgegerchow) both have contributed content to CloudAcademy on GDPR. Stuart has a nine hour course on using AWS Compliance Enabling Services. George has a done a webinar and written an article on the topic. Both are well spoken and highly informed on the topic. They provide a lot of good direction for anyone looking to account for GDPR in their organization (pro tip: everyone should be looking into this).

In this episode we discuss:

• Why am I getting all these privacy update emails?
• What is GDPR?
• How to implement GDPR?
• What are Data Processing Addendum's

More resources:

• AWS Security Service
• AWS Access & Key Management
• CloudAcademy Blog
• Stuart's blog on CloudAcademy

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this crackerjack edition of the Exploring Information Security podcast, Sean Peterson of Parameter Security joins me to discuss password cracking.

Sean (@SeanThePeterson), is one of the most passionate infosec people you don't know. He recently did a talk at ShowMeCon on how to crack passwords. It was his first ever talk and pretty damn good. Sean joined me to give me his insights into password cracking.

In this episode we discuss:

• What type of hardware is needed for password cracking
• What type of attacks are used for password cracking
• How to crack passwords
• What's ahead for password cracking

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this European edition of the Exploring Information Security podcast, Cliff Smith of Parameter Security joins me to discuss General Data Protection Regulation (GDPR).

Cliff (@BismthSalamandr), recently gave a talk at ShowMeCon on GDPR and why everyone should care. It's a really good talk and a great primer if you haven't dug into GDPR, yet (you should). Cliff is a recovering lawyer, so he's providing a different angle than your normal security professional.

In this episode we discuss:

• What is GDPR?

• Why it could change

• Why it's important

• Who it impacts

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

Tanya (@shehackspurple), is a former developer turned security person. She speaks regularly at conferences around the globe. The topics often focus on working with developers to improve security, which is something I believe in. She's a project lead for OWASP DevSlop.

In this episode we discuss:

Why working with the developers is important

How to talk to developers

What are the benefits of working with developers?

What are the top recommendations for talking to developers

In this panelist episode of the Exploring Information Security podcast, the first ever podcast panel at ShowMeCon 2018!

Amanda Berlin (@InfoSystir), Wik (@jaimefilson), David Cybuck (@dpcybuck), April Wright (@aprilwright), and Dave Chronister (@bagomojo) join me on the live EIS panel at ShowMeCon, June 7, 2018. This is the first panel I've ever done for the podcast. It went so well, I hope to do more in the future. We cover a variety of topics and have a few laughs.

YouTube version

In this episode we discuss:

• What's coming back in vogue

• What to do with master ID

• What our thoughts are on new password policies from NIST

• How to handle best practices

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.