Hacked Off

Threat modelling is broader than just security, and DevSecOps is more than just secure code. Application Security Advocate, Alyssa Miller talks passionately about the importance of a collaborative approach to security, where implementing a culture of building efficiently and understand security as you go, can help with getting ahead of the game.

0'22 Alyssa Miller - the Application Security Advocate

2'20 What is threat modelling?

4'32 Where do you begin with threat modelling?

9'45 Continuous improvement - being more secure tomorrow than we are today!

13'39 The user story

19'32 It's not about WHO is hacking you, but WHAT they're hacking

23'04 Monitor, mitigate and protect

27'45 Implementing threat modelling into DevSecOps to make security more efficient

Alyssa's Social Media:

https://twitter.com/AlyssaM_InfoSec

https://www.linkedin.com/in/alyssam-infosec/

https://alyssasec.com/

Listening Time: 38 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

Guest: Alyssa Miller, Application Security Advocate at Snyk

Mobile Device Management increases security, reduces risk and plays an important role in Government certified assurance models. Holly Grace discusses the role of device management for Cyber Essentials, and the challenges that come with employees using their own devices at work.

Key points:

1'08 What is Mobile Device Management (MDM)?

3'05 Device Management for Cyber Essentials

8'27 Bring your own device (BYOD)

11'30 Passwords, pass codes and pin numbers

Listening Time: 14 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

We speak to fellow co-worker and Senior Security Consultant at Secarma, Joe Thorpe, who specialises in app testing. He gives us the low down on hacking mobile apps, how they're similar to web apps, which vulnerabilities are most common and how to choose the right testing for your mobile app.

Key points:

0'43 What is mobile application testing?

3'43 Similarities to web application testing

4'49 Finding vulnerabilities in mobile apps

7'21 Hacking mobile apps with Frida and bypassing root detection

9'33 Choosing the right kind of testing for you mobile app

13'09 The Tinder app vulnerability

14'48 The most common vulnerabilities

Useful links:

Mobile App OWASP Top 10 - https://owasp.org/www-project-mobile-top-10/

Mobile Application Testing - https://www.secarma.com/services/penetration-testing/mobile-application-penetration-testing.html

Listening Time: 17 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

Guest: Joe Thorpe, Senior Security Consultant at Secarma

In September's Month in Review, Holly Grace is delighted to announce that this month's hacks aren't just all about ransomware! From political motivation to notoriety, she discusses the different kind of motives a hacker may have, and the kind of attacks they might use to get what they want.

Key Points:

0'55 Financially Motivated: KuCoin Hack

3'07 Insider Threat: AT&T Hack

7'09 Politically Motivated: Op Payback

12'00 Different types of attacks

Listening Time: 16 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

There's more to firewalls than simply installing them and leaving them to it! WatchGuard's Senior Sales Engineer Martin Lethbridge, joins Holly Grace Williams to discuss common firewall misconceptions, and how to get the most out of your firewall to ensure your organisation is safe.

0'22 Guest introduction

2'10 Firewall misconceptions - they aren't just for your network perimeter

6'52 Protecting your laptop on 'dirty networks' - working from home or remotely

11'59 Security vs convenience

17'43 The importance of VLAN and network segmentation

19'45 Don't just block it, monitor it, review it, maintain it

26'53 Deep packet inspection

38'41 Why you need to update your firewall

41'47 What you need to do when you go back to the office after lockdown

Useful links:

Martin's LinkedIn - https://www.linkedin.com/in/martinlethbridge/

Watchguard - https://www.guardsite.co.uk/

Firewall Configuration Security Review - https://www.secarma.com/services/cybersecurity-assessment/firewall-configuration-security-review.html

Listening Time: 57 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

Guest: Martin Lethbridge, Senior Sales Engineer at Watchguard

Although perimeter breaking vulnerabilities are quite rare they're certainly not unheard of - Firewalls aren't perfect systems and they can have vulnerabilities too. In this week's episode, Holly Grace looks at some previous critical vulnerabilities in firewalls and tries to highlight some key lessons learned.

4'37 The firewall vulnerability 'BEIGNCERTAIN'

7'22 Protecting your organisation against threat actors gaining internal network access

10'47 How to protect firewall interface

Useful link:

Firewall Configuration Security Review - www.secarma.com/services/cybersec…urity-review.html

Listening time: 14 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

Our latest 'Intro' podcast takes a look at Firewall Security. Holly discusses different types of firewalls, the importance of network segmentation and Firewall Configuration Security Reviews, and how firewalls are targeted during a pentest.

1'30 How firewalls are they targeted during a Penetration Test?

8'29 Network segmentation

11'08 How threat actors jump between networks

13'56 Next Generation Firewalls

19'14 Web Application Firewalls

Useful links:

Firewall Configuration Security Review - https://www.secarma.com/services/cybersecurity-assessment/firewall-configuration-security-review.html

Listening time: 24 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

From bribery to bug bounties! In August's Month in Review podcast, Holly Grace discusses the failed social engineering attack on a Tesla employee, and the uproar off the back of Slack's minimal payout to a researcher for a critical security bug.

Key points:

1'20 The failed social engineering attack against Tesla

3'05 How to test your organisation against bribery

8'21 Critical security bug discovered through Slack's bug bounty program

10'06 How much is a bug worth?

Let us know your thoughts on the Slack Bug Bounty over social media:

Twitter - @Secarma

LinkedIn - @Secarma Ltd

Listening time: 15 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

Whilst Secarma perform Penetration Testing which is in-depth approach to security testing, organisations can get additional assurance through ongoing automated security scanning

Nick Blundell, AppCheck's Head of R&D, joins us on our podcast to discuss how vulnerability scanners work, their pros and cons, and how they compliment Penetration Testing to achieve a balance of depth and frequency.

0'20 Nick's background

2'00 How do you map web applications?

4'52 How do scanners work

22'29 Making scanners more intelligent

28'02 Penetration Testing plus Vulnerability Scanning

30'52 Why is automated scanning hard?

53'17 How does a scanner handle authentication?

Useful links:

https://www.secarma.com/services/cybersecurity-assessment/vulnerability-scanning.html

Listening Time: 1 hour

Hosted by: Holly Grace Williams, Managing Director at Secarma

Guest: Nick Blundell, Head of R&D at AppCheck

The OWASP Top 10 is a list of the 10 most common web application vulnerabilities. This podcast provides an introduction to this awareness document, and why it's so beneficial to organisations and their journey to better security.

Key Points:

1'00 Who are the Open Web Application Security Project?

2'18 What is the OWASP Top 10?

7'55 The current OWASP Top 10 list

9'04 Why it's such a useful document

10'19 Other 'Top 10' lists

11'27 The OWASP Top 10 isn't the be all and end all!

Listening time: 17 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma