Hacked Off

In this episode, Holly sits down with Shauni - our Marketing Manager - to discuss how she promotes technical services to a non-technical audience.

Marketers in the security industry have a pretty big task on their hands; as technical people - cybersecurity is our passion (hence last week's 55 minute rant about security policies), but how do you create content that appeals to CEOs and other non-technical decision makers?

Over the course of the conversation, we discuss Shauni's journey from fashion marketing to cybersecurity, what she has in common with a lot of penetration testers, and how much marketing fluff is too much.

1:30 How did you get into cybersecurity?

4:30 What's the goal of a marketer?

6:00 Do you consider yourself to be technical?

12:15 Is cybersecurity an intimidating industry?

14:30 Sharing knowledge

18:45 Are InfoSec marketers and penetration testers that different?

25:50 Making content accessible

30:40 You've gotta start somewhere

Listening time: 32 minutes

Host: Holly Grace Williams, MD at Secarma

Guest: Shauni Adekoya, Marketing Manager at Secarma

Tweet us: www.twitter.com/Secarma

Events: www.eventbrite.co.uk/o/secarma-ltd-31129456455

Blogs: www.secarma.com/blog

News: www.secarma.com/news

In this episode, Holly and Michael have an in-depth discussion - okay, maybe it's a little bit of a rant - about security policies. Many organisations' cybersecurity policies are rarely given the attention they deserve, despite them being such an important part of protecting your business.

Over the course of this conversation, Holly and Michael take a look at policy building and reviewing, common mistakes that organisations tend to make, and why you should be worried if no one on your team has any questions after "reading" through the policy...

0:15 Policy review

3:20 Rethink your security policy

11:00 Exceptions to the rule(s)

14:30 Does everyone in your organisation understand your security policy?

22:30 Are your rules made to be broken?

24:20 Our recommendations

27:00 What counts as a major system change?

31:35 Vulnerabilities and hardening

38:20 What, where, when, and why

43:10 A security policy rant

45:00 Don't restrict your staff

52:50 To be continued...

Listening time: 55 minutes

Host: Holly Grace Williams, MD at Secarma

Guest: Michael Ranaldo, vISM & CSMA Security Consultant at Secarma

Our website: www.secarma.com

Tweet us: www.twitter.com/Secarma

Events: www.eventbrite.co.uk/o/secarma-ltd-31129456455

Security Awareness Training: www.secarma.com/cybersecurity-services/security-training/security-awareness-training

In this episode, Holly and Thomas discuss the MITRE ATT&CK framework and the multi-layered security strategies that organisations need to defend against threat actors.

0:58 What is the MITRE ATT&CK framework?

9:50 A real-world breach progresses in layers

11:50 Using MITRE ATT&CK

15:08 Communication is key

16:50 Vulnerability scan, penetration test, or red team? Yes.

30:23 How to get started

Listening time: 34 minutes

Host: Holly Grace Williams, MD at Secarma

Guest: Thomas Ballin, Testing Team Lead at Secarma

MITRE ATT&CK framework link: www.attack.mitre.org

Our website: www.secarma.com

What are the benefits of gaining skills that are a little more broad to the niche that you do?

In this episode, we have a discussion around certifications, training, and upskilling. We also provide a brief overview of our penetration testing training courses, which are a great resource for businesses that are looking to upskill their security and IT teams, as well as for tech savvy individuals that want to break into pentesting.

0:50 Holly's own experience with recent exams

4:45 Reasons to upskill

8:30 Breaking into the cybersecurity industry

9:40 Our Hacking & Defending training courses

Listening time: 16 minutes

Host: Holly Grace Williams, MD at Secarma

Sign up for our upcoming Hacking & Defending Networks training course, a full day's hands on pentesting experience, hosted by our experts: https://bit.ly/3txOMoF

Our website: www.secarma.com

Our Security Training page: www.secarma.com/cybersecurity-services/security-training/

Find out more here: www.secarma.com/introducing-our-new-security-training-courses/

The Hacked Off podcast is back! In this episode, we sit down with Sarah and Sian from the NCSC's CyberFirst initiative to talk about the CyberFirst Girls competition.

The National Cyber Security Centre is committed to developing the UK's next generation of IT professionals and has a number of fantastic initiatives designed to introduce 11 – 17 year olds to the fast-paced world of cybersecurity.

Because we need the broadest mix of minds to tackle the security threats of tomorrow, and the NCSC’s CyberFirst Girls competition is all about developing that diverse talent pool. The competition is a girls-only event for 12-13 year olds who may be considering a future in cyber, and includes lots of fun activities that will test their problem solving skills to reveal if they have the aptitude required for a career in this exciting industry.

Useful Links:

Our website: www.secarma.com

The latest cybersecurity and tech news: www.secarma.com/news

CyberFirst: www.ncsc.gov.uk/cyberfirst/overview

The CyberFirst Girls Competition: www.ncsc.gov.uk/cyberfirst/girls-competition

Listening time: 37 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

It's the last podcast of the year, so Holly is revisiting some of our key guest interviews from 2020. We also couldn't do a 'A Year in Review' without discussing the impact of the pandemic on business security, and how now is the time to revisit your change management and risk register.

Key points:

0'34 Our new training course

4'00 Lockdown and change management

6'49 Time to review the risk register

8'14 Security Awareness Training

10'52 What kind of attacks do we need to worry about?

15'58 Turning off antivirus

17'42 The future of phishing scams

Useful Links:

Our new training webinars and courses - https://www.eventbrite.co.uk/o/secarma-ltd-31129456455

Jenny Radcliffe's podcast - https://soundcloud.com/hackedoff/044-jenny-radcliffe-hacking-the-human

Kevin Fielder's podcast - https://soundcloud.com/hackedoff/061-kevin-fielder-building-security-teams-and-culture

Mike Koss's podcast - https://soundcloud.com/hackedoff/047-mike-koss-hear-no-evil-see-no-evil

Jame Mckinlay's podcast -

https://soundcloud.com/hackedoff/049-james-mckinley-why-i-turned-antivirus-off

Listening time: 22 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Generally when you think of eCommerce attacks you probably think of theft of personal information and payment cards, when in fact there are many ways a hacker could attack your online store. Holly Grace discusses the most common threats to eCommerce businesses, and a few you may not have considered before!

Key points:

0'47 CIA - Confidentiality, Integrity and Availability

1'38 Denial of Service Attacks

6'43 How to protect your business from Denial of Service Attacks

8'08 Compromising user/administration accounts

11'11 Preventing credential stuffing and horizontal brute force attacks

14'30 Moonpig's breach

Listen Time: 18 minutes

Host: Holly Grace Williams, MD at Secarma

Application Program Interfaces have increasingly become a target for hackers. With 6 of the OWASP Top 10 vulnerabilities being API related, it is no surprise that OWASP released their first list of API Security Top 10, last year.

For those wanting to better understand the process of API penetration testing, Holly Grace takes you through the process, from scoping the job to which vulnerabilities to look out for.

0'16 What is an API?

2'11 Scoping an API test

4'11 Making API testing more efficient

5'54 What vulnerabilities are we looking for?

8'29 Rate limiting

9'52 The Google+ API bug

Useful links:

OWASP API Security Top 10 - https://owasp.org/www-project-api-security/

Listen Time: 12 minutes

Host: Holly Grace Williams, MD at Secarma

Is your online store ready for Black Friday and Christmas shopping? Have you considered how automated bots, fake reviews, plugins and a data breach could wreak havoc over the busiest shopping period of the year? This podcast is a perfect starting point for eCommerce businesses wanting to secure their business ahead of the mad rush!

0'52 Preventing the use of automated bots and buying scripts.

3'33 How to avoid fake reviews

5'45 What we can learn from The British Airways data breach

10'09 Using Sub Resource Integrity(SRI)to prevent malicious scripting attacks

12'12 Be aware of plugins

Listening time: 14 minutes

Host: Holly Grace Williams, MD at Secarma

This month there has been a lot going on in the world of cybersecurity. With major IT firm Sopra Steria getting hit by a cyberattack, Apple paying out over $250,000 to a team of bug hunters for finding 55 vulnerabilities in Apple systems, as well as the USA indicting 6 Russian Intelligence Officers for a range of attacks such as attacks against the Ukrainian Power Grid and the 2017 NotPetya attack.

Key Points:

0'20m Google Project Zero, Zero Days and Chrome Vulns

3'14m Fifty-five Apple Bugs and over $250,000 in bounty pay-outs

6'15m Hackney Council Hit by "Hack Attack"

8'06m Six GRU Officers indicted for major hacks

11'00m Sopra Steria hit by cyberattack

Useful links:

https://chromereleases.googleblog.com/

https://samcurry.net/

Listen Time: 14 minutes

Host: Holly Grace Williams, MD at Secarma