Hacked Off

Just 27% of businesses in the UK reported that staff had attended internal or external training on cybersecurity in the last 12 months* and more often than not, what is being taught is either incomplete or no longer relevant.

This talk, which our Technical Director Holly Grace Williams presented at InfoSecurity Europe, discusses the miseducation of cybersecurity aspects such as physical security, phishing and malicious websites and why trying to oversimplify security is a part of the problem.

Key points:

2’11 Physical access isn’t just tailgating

10’02 ‘Diffused responsibility’ lowers the chance of a challenge

16’49 Phishing isn’t just emails

19’15 HTTPS doesn’t stop phishing

21’19 Identifying suspicious links

23’00 Cross-site scripting

29’29 Password cracking

*https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/791940/Cyber_Security_Breaches_Survey_2019_-_Main_Report.PDF

Download on iTunes: apple.co/2Ji61Ek

Listening time: 36 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

In 2017 Equifax, one of the largest credit agencies in the world, became the victim of a major breach resulting in over 150 million records being stolen. In this podcast we speak to Graeme Payne, the CIO of Equifax during their breach about the lessons learnt and his personal experience.

0’48 Graeme Payne, guest introduction

3’48 The timeline of the Equifax breach

6’47 How incident planning can help businesses be better prepared for a breach

10’13 Announcing a breach – The lessons learnt from disclosing a major hack

16’04 How do you get the board more interested in security?

19’14 Is there a benefit for organisations to have a CISO?

26’03 How organisations can ensure they are covering all cybersecurity bases

27’33 Personal experience of a breach

37’16 The aftermath

Download on iTunes: apple.co/2Ji61Ek

Listening time: 44 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

Guest: Graeme Payne, Cybersecurity Executive Advisor and former CIO of Equifax

Looking to take the first steps to ensuring your business is secure but not sure where to start? Holly Grace takes a fresh look at some basic, fundamental security steps that every business should be adopting.

Highlights include:

0’53 Software updates

2’08 Passwords

4’06 Network Segmentation

5’40 Manage out of band

6’26 If you don’t need it, disable it!

8’58 Pre-shared keys

10’09 Network access control

11’15 Credential stuffing

12’50 Restrict user input

15’01 Trust but verify!

Download on iTunes: apple.co/2Ji61Ek

Listening time: 19 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

We’ve previously discussed the difference between Penetration Testing and Red Teaming, so in this episode we delve a little deeper into the different stages of PenTesting.

For organisations who are considering this security assessment, it’s is an excellent starting point to better understand the process.

The discussion includes:

2’00 What is a Penetration Test?

3’02 How is it performed?

5’03 An example of a vulnerability: SQL Injection

6’52 What kind of vulnerabilities do we look for? The OWASP top ten*

8’07 What we do when we find a vulnerability

11’50 Reporting after a penetration test

*https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

Download on iTunes: apple.co/2Ji61Ek

Listening time: 15 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

The ‘Internet of Things’ is evolving fast and more and more companies are seeing the value it can bring by increasing business productivity and efficiency. However, adding IOT devices to a company can increase security vulnerabilities in a way that businesses might not have considered.

We take a look at hardware hacking as an aspect of penetration testing and how IoT can affect an organisation's security.

Key points discussed include:

0’28 Hardware hacking as an aspect of penetration testing

2’31 How you perform hardware testing

07’05 Why should your company be concerned about hardware hacking?

8’58 How is this different to traditional testing?

Download on iTunes: apple.co/2Ji61Ek

Listening time: 12 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

Cloud computing offers many benefits, such as scalability and elasticity; but with new technologies and terminologies some companies worry about the security implications. In this week's episode Holly Grace gives us an intro to Cloud Security Testing perspectives.

Here's what she covers:

0’52 Perspectives when looking at Cloud hosted systems

3’15 Where are things the same?

4’41 Where do we start in terms of Cloud security?

6’10 What should we have tested?

6’38 When Cloud has gone wrong!

NCSC Cloud Security Guidance: https://www.ncsc.gov.uk/collection/cloud-security

Download on iTunes: apple.co/2Ji61Ek

Listening time: 11 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

In 2018 it was reported that there had been a 36% increase in total bug bounty payouts*, but does this mean this kind of security testing is best for your business? We take a look at the pros and cons of bug bounty programs and how it compares to penetration testing.

Key points include:

1’13 A brief definition of penetration testing and bug bounties

1’53 How the costing works

3’05 The difference between a penetration test and a bug bounty

6’46 The difficulty with reporting bug bounties

7’42 The negatives and positives of the output of both pen testing and bug bounties

9’36 The time Uber was held to ransom by a bug hunter!

14’32 Summary

* https://www.bugcrowd.com/resource/2018-state-of-bug-bounty-report/

Download on iTunes: apple.co/2Ji61Ek

Listening time: 17 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

Security risks aren’t always found through vulnerability scanning and hacking. Holly Grace talks us through how physical access testing and social engineering can be used to demonstrate security risks in a target organisation. This introduction to social engineering talks about how these assessments are performed and their benefits, through some funny on-the-job stories.

1’43 What is social engineering?

3’25 Three common Phishing attacks

7’00 Training staff to recognise the signs of a social engineering

15’40 What is physical access?

17’13 How physical access assessments are performed

28’18 The time Holly got stopped by a security guard!

Download on iTunes: apple.co/2Ji61Ek

Listening time: 32 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

We’re often asked about the career pathway to becoming an ethical hacker, or penetration tester. So, we thought it would be best to let a current penetration tester share her thoughts on working in the industry.

Whether you’re interested in penetration testing, computer science or security in general, Holly Grace's intro to becoming a penetration tester is packed full of tips you can use when getting started in cybersecurity.

1’00 What is a penetration tester?

1’35 What makes a good candidate?

4’10 Paths into pentesting.

5’00 Practising pentesting

6’36 Do I need programming skills?

7’30 The benefits of attending security conferences

8’36 Exams and certifications

Useful links:

Damn vulnerable web app http://www.dvwa.co.uk/

Download on iTunes: apple.co/2Ji61Ek

Listening time: 12 minutes

For more information, follow us on Twitter @secarma or @secarlabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma

You’ve probably heard of the term ‘penetration testing’ and ‘red teaming’, but are you clear about what they really mean? Our Principal Security Consultant, Holly Grace Williams talks us through the difference between these two security tests, elaborating why you’d choose them, how they work and the benefits of each one.

1’44 What is penetration testing?

3’55 What is a Red Team engagement?

7’42 Summary

Download on iTunes: apple.co/2li61Ek

Listening time: 9 minutes

For more information, follow us on Twitter @secarma or @secarmalabs or email us at [email protected]

Hosted by: Holly Grace Williams, Technical Director at Secarma