Hacked Off

This podcast provides an excellent introduction to vulnerability scanning, covering how it works and what it tests. It discusses the benefits of vulnerabilities scanning and how alongside penetration testing, can provide an organisation with a more continuous testing model.

Key points:

1’34 What is vulnerability scanning?

2’16 What does vulnerability scanning test

9’09 How a scanner grades a vulnerability

11’47 Pentesting v vulnerabilty scanning

14’40 The benefits of vulnerability scanning

24’09 Overview

Listening time: 26 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

In July it was revealed that travel company CWT paid $4.5 million in ransom to cyber criminals. Whilst shocking, ransomware is unfortunately not new and not uncommon. Secarma’s MD, Holly Grace Williams, discusses why ransomware is such a popular option for cyber criminals and how companies can prepare for potential attacks with incident response training.

Key Points:

1’05 Paying ransoms

2’00 Why is it always ransomware?

2’40 CWT’s ransom negotiation conversation

5’15 Incident response training for ransomware

10’22 The TikTok ban in the US

12’07 Technically, how would you ban TikTok?

15’09 Coming soon - Secarma Webinars!

What content would you like to see in our webinars? Let us know on social or email us at [email protected].

https://www.linkedin.com/company/secarma-uk/

https://twitter.com/Secarma

Listening time: 18 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

After a brief break, the Hacked Off Podcast is back! If you missed our MD’s Trusted Tech Talks webinar last week, Holly Grace Williams summarises the key points of her presentation, Encryption isn’t Magic: Hackers Can Break It. She discusses why encryption is a little more complex than being on or off and the importance of configuring it correctly.

Key points:

0’33 Introduction

4’20 Cyptography lasts a long time

7’44 Grading cryptographic weaknesses

11’30 How quickly can you crack passwords and how much does it cost?

17’45 What other hashes might we commonly come across?

22’45 The problem with password strength meters

24’30 Summary

Listening time: 19 minutes

Hosted by: Holly Grace Williams, Managing Director at Secarma

In today's episode we talk about penetration testing realism versus efficiency, and why sometimes aiming for a security test that exactly matches the options available to criminals isn't always possible and why sometimes it isn't always desirable. It's all about the context.

Key points:

1'05 The motiviation behind an assessment is key

2'10 When realism is key

3'45 when total realism isn't possible

8'40 Technique-orientated vs goal-orientated

14'40 Fix the fundamentals first

Listening time: 19 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Privacy is a right and it is important to protect that right, but operational security it hard. Mike Jones joins us again to talk all things OpSec and we cover some things to check to make sure your privacy is protected.

Key Points:

1'30 Why is Privacy important?

4'20 Photos, GPS and Geotagging

10'15 Social Media settings

12'15 Removable Media

14'15 Communications security and Leaks

18'00 Privacy and Adult Entertainment

24'30 Balancing operational security and convinience

29'00 Cleaning up Data footprints

34'23 Situational Awareness

38'30 Burner Accounts

Links:

Operation Robin Sage - https://en.wikipedia.org/wiki/Robin_Sage

Listening Time: 46 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Guest: Mike Jones, Security Researcher

In today's episode we talk about incentivising your Security Team and making sure that the defensive team are getting praise for a job well done. As well as noting that the red team's job isn't over when they find a high impact vulnerability.

Key Points:

0'49 There's more to staff retention than bonuses

1'40 The problem of the romanticisation of the red team

3'30 Measuring progress in security improvement

4'25 Purple Teaming may help reduce the gap

11'00 Empowering the defensive team

15'15 Measuring offensive teams

Links:

https://soundcloud.com/hackedoff/009-an-intro-penetration-testing-vs-red-teaming

https://soundcloud.com/hackedoff/an-intro-cybersecurity-maturity-assessments

Listening Time: 18 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Adam Louca joins us today to talk about how to get the most out of security products, and how to cut through the marketing to find out what works for you!

Key Points:

0'30 What is a technologist?

2'05 Why do we have to cut through vendor noise?

4'21 How you can determine the truth of products

9'25 Planning for the unknown

12'00 How to know products are working

19'50 Network segmentation, antivirus, and other specifics

22'40 Gaining internal visibility

31'00 Blame: Users vs Products

34'00 The Security People vs Products

Links:

Mitre Att&ck Framework: https://attack.mitre.org/

Listening Time: 42 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Kevin Fielder joins us today discussing building security and building security teams. We talk risk appetite, balancing likelihood and impact, and team culture!

1'20 Where to start

4'00 Risk Appetite and moving quickly

11'13 Balancing appetite, likelihood and impact

15'15 Keeping the security team happy

18'45 Team Culture

25'45 Team Development and building Careers

38'25 How DevOps affects building security

48'12 Handling staff retention

Listening Time: 54 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Guest: Kevin Fielder, CISO at JUST EAT

Today we have a Marc Avery, Kevin Fielder, and Sean Atkinson discussing how to build a business security strategy. We talk about cyber insurance, operational security, and building security in companies. As well as detours to talk about Equifax getting hit by Hurricane Irma, the problems of working from home, and company culture.

Key Points:

01'00 Guest Introductions

05'10 The security risk of the new baseline

15'00 Real-world attacks vs Click-bait News

18'22 Security Awareness Training for the Home

23'00 Pandemics and Business Continuity Plans

27'00 Risk Lifecycles - Revisiting Risk Exceptions

34'36 Cyber Insurance Benefits and Woes

48'05 Will cybersecurity be a priority in the near future?

52'15 Zero Trust: Marketing and Reality

Links:

"88% Working from Home" - https://www.gartner.com/en/newsroom/press-releases/2020-03-19-gartner-hr-survey-reveals-88--of-organizations-have-e

Munich Massacre - https://www.nytimes.com/2017/08/30/sports/olympics/munich-olympic-massacre-1972-memorial-israeli-athletes.html

Equifax Hit by Hurricane Irma - https://gracefulsecurity.com/equifax-breach-timeline/

NCSC Attribution Example - https://www.ncsc.gov.uk/news/russian-military-almost-certainly-responsible-destructive-2017-cyber-attack

Listening Time: 60 minutes

Host: Holly Grace Williams, Technical Director at Secarma

Mike Jones is a former member of anonymous, a former confidential informant, and is here to talk about building better security. We talk about everything from Cyber Prevent programmes to help people avoid becoming cyber criminals to becoming a better penetration tester.

01'12 Working with Anonymous

03'25 Meeting with the Suits

04'18 Working as a Confidential Informant

16'50 A hacker's impression of the legal system

20'40 Cyber Prevent Programme

25'50 Developing PenTesting Skills

32'20 Covering up breaches and vulnerabilities

Listening Time: 44 minutes

Hosted by: Holly Grace Williams, Technical Director at Secarma

Guest: Mike Jones, Security Researcher