Exploring Information Security - Exploring Information Security

In this inagural stream of the Exploring Information Security podcast, Daniel Ebbutt and Kyle Andrus join me to talk about Emotet.

Daniel (@notdanielebbutt) and Kyle (@chaoticflaws) are the two guys I go to for clicking on suspicious links. Recently, I’ve been seeing more Emotet. So, I wanted to have the guys on to talk about the malware that is making a comeback.

The CFP is open for Converge Conference. The conference is May 16 and 17. They’ll have one day for blue team topics and one day for red team topics. Make sure to submit your malware related talk topics. Also make sure to check out MiSec if you’re in Michigan.

In this episode we discuss:

• How is Emotet being constructed

• What are some of the indicators of Emotet?

• How Emotet is being mitigated

• What does Emotet do?

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this end of the year podcast, I discuss the state of the podcast for 2018 and what’s ahead for 2019.

2018 was a good year. I made some format changes that I’m really happy with. I picked up some new audio equipment. I resolved my recording process (I think). I’m not a big statistics guy. I don’t really care if two people or 200 people listen. I’m just happy to have some really great conversations with people and contribute back to the community.

Here’s a really interesting graph of my RSS Subscribers.

No, I don’t have 40,000 listeners. Some of that is inflated by other podcast directories ripping my feed. What I look for is a steady increase in subscribers, which did happen by the end of the year. Albeit with a weird dip in November (broken feed, maybe).

This is from iTunes Connect (Beta).

I can’t do a yearly review of podcast stats. Instead here’s the peek month of October for my iTunes listening habits. Looking through all the months, I can make some inferences about my audience. The hacking/red team content is the most popular. With a 25-28% consumption rate, the conference podcasts are turned off by most people before the end.

I’ve got a new recording setup that will hopefully make producing a podcast much easier. I’ve setup a Twitch channel for gaming and potentially recording EIS episodes on. Follow for notifications on when I go live. I’ll be trying my first EIS episode Monday, January 7, 2019, at 8:30 p.m. CT. I’ve also turned what was my attempt at a GamerSec Discord channel into the Exploring Information Security channel. Here you can interact with us while record (or on Twitch). Join other people interesting in the podcast. Game with other infosec professionals.

Thank you for being a listener of the podcast. I am refreshed from my month off and energized for what’s ahead in 2019.

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this Hyatt recorded edition of the Exploring Information Security podcast, Micah Hoffman, Josh Huff, and Justin Nordine.

Micah (@WebBreacher), Josh (@baywolf88), and Justin (@jnordine) join me to go over a variety of topics at DerbyCon 2018. The Hyatt was kind enough to provide space near the bar (shout to the amazing Lauren).

In this episode we discuss:

• Why other industries don’t use OSINT

• Where to find your niche

• What are some frustrations of mentorship

• How apps are impacting our lives

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this Hyatt recorded edition of the Exploring Information Security podcast, Micah Hoffman, Josh Huff, and Justin Nordine join me at DerbyCon 2018.

Micah (@WebBreacher), Josh (@baywolf88), and Justin (@jnordine) join me to go over a variety of topics at DerbyCon 2018. The Hyatt was kind enough to provide space near the bar (shout to the amazing Lauren).

In this episode we discuss:

• What OSINT classes and projects everyone is working on

• Why contributing is important

• What value conferences like DerbyCon provide

• Why hotels hate accountant conferences

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this whiskey fueled edition of the Exploring Information Security podcast, Ryan MacDougall and Colin Hadnagy of Social Engineer join me to discuss advanced OSINT.

This past DerbyCon, I had the opportunity to take the Advanced OSINT with Ryan (@joemontmania) and Colin (@UnmaskedSE). The course was great! It was different from some of the other OSINT courses I’ve taken. They covered very specific techniques and tools. After presenting on those techniques and tools we were given the opportunity to dive in from a free-form standpoint.

If you’d like to take the training, signup for their April 23-24, 2019, training in Denver Colorado.

Also, you can catch Ryan at the First Pacific Hackers Conference, November 9-11, 2018.

In this episode we discuss:

• What is advanced OSINT

• What is the mindset needed for OSINT

• What are some of the tools used for OSINT

• How to phish an organizationa

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

In this authenticated edition of the Exploring Information Security podcast, I talk about when passwords will finally die!

This is a solo episode. I had the idea after sitting in a vendor pitch today (and because I’m slacking on my editing) where one of the sales guy mentioned that passwords WILL die. I disagree. I think passwords have been around for a long time and will continue to be around. They’re easily replaceable and is stored in the most secure location. Unless there are mind readers, then we’re all just screwed anyway.

I would love some thoughts and feedback on this one.

[RSS Feed] [iTunes]

Sign up with your email address to receive news and updates.

We respect your privacy.

Stu (@cybersecstu) is a Co-Founder of The Many Hats Club, which is a massive Discord community and podcast. Earlier this year, Stu started sharing Unusual Journeys. I love this series because it highlights that there is no true path into infosec. He’s had 18 series so far and each story is fascinating.

In this episode we discuss:

Why failure is good

What sticks out from theses stories

What are some of the backgrounds people come from

Stu (@cybersecstu) is a Co-Founder of The Many Hats Club, which is a massive Discord community and podcast. Earlier this year, Stu started sharing Unusual Journeys. I love this series because it highlights that there is no true path into infosec. He’s had 18 series so far and each story is fascinating.

In this episode we discuss:

What started Unusual Journeys

How Stu got into infosec

What we can learn from these stories

Claire (@ClaireTills) doesn’t have your typical roll in infosec. She sits between the security teams and marketing team. It’s a fascinating roll and something that gives her a lot of insight into multiple parts of the business. What works and what doesn’t work in communicating security to the different areas. Check her blog out.

In this episode we discuss:

How important is it for the company to take security seriously

How would someone get started improving communication?

Why we have a communication problem in infosec

Where should people start

More resources:

Networking with Humans to Create a Culture of Security by Tracy Maleeff - BSides NoVa 2017

Courtney K BsidesLV 2018, Implementing the Three Cs of Courtesy, Clarity, and Comprehension to Optimize End User Engagement (video not available yet)

BSidesWLG 2017 - Katie Ledoux - Communication: An underrated tool in the infosec revolution

Jeff Man, The Art of the Jedi Mind Trick

The Thing Explainer: Complicated Stuff in Simple Words

Chris Roberts, Communication Across Ranges