InfoSec ICU

By Information Security at the Medical University of South Carolina

The Health Information Security podcast from the Medical University of South Carolina... more

· Technology

Download on the App Store

Download on the App Store

Get it on Google Play

FAQs about InfoSec ICU:

How many episodes does InfoSec ICU have?

The podcast currently has 48 episodes available.

InfoSec ICU episodes:

June 12, 2019 NCHICA, Personal VPNs, and Have I Been Pwned
Steve provides insights from last weeks NCHICA conference he attended. The guys sped time discussing the pros and cons of personal VPNs and what you should consider when selected one. They wrap up discussing the Have I Been Pwned breach database going from home grown to corporate.
As always they end with One Cool Thing.
Show Notes

Resources:
PC Mag review of personal VPNs
https://www.pcmag.com/roundup/296955/the-best-vpn-services
TroyHunt HIBP
https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/
One Cool Thing
Bruins Game 7
https://www.boston.com/sports/boston-bruins/2019/06/11/stanley-cup-final-game-seven

Reimagined Obi-Wan v. Darth Vader light saber fight scene
https://www.fastcompany.com/90347039/this-fan-made-nerd-approved-edit-of-an-iconic-star-wars-scene-took-2-5-years-to-make
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
47min
June 05, 2019 Ransomware Actor Retiring, Phishing Victim Sanctions, and the Vulnerabilities Equities Program
Brandon and Gerry discuss the recent announcement of the premiere Ransomware player in the market retiring, appropriate sanctions organizations should use when addressing victims of phishing, and the US Government vulnerability equities program (VEP).
As always they end with One Cool Thing.
Show Notes

Resources:
GandCrab Crew Retiring
https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/
Terminating Users for Falling for Phishes
https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense/
Vulnerabilities Equities Program
https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF
One Cool Thing

ThreatHunting Project
https://www.threathunting.net/

Innocent Org
https://www.innocentlivesfoundation.org/
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
48min
May 29, 2019 The Blue Episode: BlueKeep Updates, Blue Team Skillsets, Blue Feeling Security Researchers
Steve and Gerry aren’t feeling blue, but happy to share information security with blue-shaded glasses. They follow up on last week’s story of am ransomware event in Baltimore and how the NSA tool EternalBlue has been identified as part of the spreading mechanism. The interview show friend, Brandon Stephens, on his guidance on Blue Teaming as a career choice and where folks can start. The wrap up discussing security research SandBoxEscaper and her release of multiple Windows 10 0-days recently.
As always they end with One Cool Thing.
Show Notes

Resources:

EternalBlue and the NSA on Baltimore Ransomware
https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html

Blue Teaming for New Folks
https://www.amazon.com/Blue-Team-Handbook-condensed-Responder/dp/1500734756
https://twitter.com/BHinfoSecurity
https://twitter.com/taosecurity
SandboxEscaper Releasing 0-days
https://www.computing.co.uk/ctg/news/3076215/windows-10-zero-day-security-flaw-task-scheduler-sandboxescaper
One Cool Thing

Tasty App
https://itunes.apple.com/us/app/tasty/id1217456898?mt=8

Kids Cyber Education
https://www.kickstarter.com/projects/curtbraz/m-is-for-malware
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
44min
May 22, 2019 BlueKeep, Baltimore’s Ransomware Debacle, and Deceitful Decryption Vendors
Steve and Gerry discuss the major Windows vulnerability in the news “BlueKeep” and what you need to know about responding to it. They discuss the city of Baltimores current ransomware debacle and finish with firms that promise to aid you in decrypting your ransomware files but in reality are just brokering with the attackers.
As always they end with One Cool Thing.
Show Notes

Resources:
BlueKeep
https://blog.qualys.com/laws-of-vulnerabilities/2019/05/15/windows-rdp-remote-code-execution-vulnerability-bluekeep-how-to-detect-and-patch
Baltimore Ransomware Issues
https://arstechnica.com/information-technology/2019/05/baltimore-ransomware-nightmare-could-last-weeks-more-with-big-consequences/
https://www.npr.org/2019/05/21/725118702/ransomware-cyberattacks-on-baltimore-put-city-services-offline
Ransomware Recovery vendors were really just paying the ransom and taking the credit. Are they funding terrorism?
https://arstechnica.com/information-technology/2019/05/these-firms-promise-high-tech-ransomware-solutions-but-typically-just-pay-hackers/
One Cool Thing

MythGard
https://www.mythgardgame.com/

Smartphone Ear Checker
https://www.npr.org/sections/health-shots/2019/05/15/723595540/a-smartphone-app-and-a-paper-funnel-could-help-parents-diagnose-kids-ear-infecti
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
39min
May 15, 2019 Advertisers Abusing Access to App Data, Annual Verizon DBIR, and State of SC Privacy Conference
Steve and Gerry discuss an interesting angle on the capitalization of user data by online gambling sites targeting individuals that take medication with side effects of increase impulsive behaviors. They laud the annual Verizon data breach incident report and highlight their favorite findings. They wrap up the main segment discussing the recent State of South Carolina privacy conference that Steve participated as a panelist.
As always they end with One Cool Thing.
Show Notes

Resources:
Just because an advertiser doesn’t have direct access to your private information doesn’t mean they can’t abuse it.
https://www.michaeljfox.org/foundation/news-detail.php?new-study-examines-impulse-control-disorders-and-parkinson-drugs
Verizon releases their latest Data Breach Investigations Report.
https://enterprise.verizon.com/resources/reports/dbir/
Privacy in Action Discussion Series
https://admin.sc.gov/technology/enterprise-privacy
One Cool Thing

OSINT Framework
https://osintframework.com/
Fairchild Tropical Botanical Gardens
https://www.fairchildgarden.org/

Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
48min
May 08, 2019 TMI OCR Settlement, Gerry’s Healthcare Research Revealed, Mirrorthief Supply Chain Risks
Steve and Gerry discuss a recent $3M OCR settlement with Touchstone Medical Imaging (TMI) and how foundational security controls are commonly missed. Gerry finally shares his Ph.D. research with the show and digs into the main issues facing small healthcare practices. Finally, the guys discuss Supply Chain risk using the recent MirrorThief card skimming attacks to illustrate.
As always they end with One Cool Thing.
Show Notes

Resources:
TMI OCR Settlement
https://www.hhs.gov/sites/default/files/tennessee-diagnostic-medical-imaging-services-ra-cap.pdf

Flashlight in a Dark Room Theory – Dr Gerald Auger research dissertation
https://scholar.dsu.edu/theses/329/

Mirrorthief Credit Card Skimming Attack
https://www.scmagazine.com/home/security-news/mirrorthief-card-skimming-attack-steals-card-data-from-online-college-stores/

One Cool Thing
Google adding privacy tools to Chrome
https://www.wsj.com/articles/googles-new-privacy-tools-to-make-cookies-crumble-competitors-stumble-11557151913

15th Academic Medical Center Security and Privacy Conference, June 3-4, 2019
https://nchica.org/conferences/amc2019/
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
48min
May 01, 2019 Mental Health Apps Deceptively Selling Data, Human-Centered Computing Expert, Dr. Kelly Caine, Interview and Reflections
Steve and Gerry discuss recent research discovering mental health applications that are sharing personal data without informing the user, and the implications this practice has for individuals. Clemson’s Dr. Kelly Caine is interviewed on her work around her paper “Privacy is Health” and the bioethical implications of technology diagnosing individuals that are not seeking treatment.
As always they end with One Cool Thing.
Show Notes

Resources:
Mental Health Apps Selling Data
https://www.theverge.com/2019/4/20/18508382/apps-mental-health-smoking-cessation-data-sharing-privacy-facebook-google-advertising
Privacy is Health
https://kellycaine.files.wordpress.com/2010/11/2016-ieee-pervasive-column-privacy-is-healthy-caine.pdf
Dr. Kelly Caine: twitter: @kellycaine

Clemson Human Technology Lab:
www.hatlab.org

Wearable Platforms for mHealth Research
https://auracle-project.org/
https://amulet-project.org/

HomeSHARE initiative is a geographically distributed test-bed to design, develop, and evaluate pervasive home-based technologies for aging-in-place.
https://crihomeshare.wordpress.com/

Kellie Caine’s book:
https://www.amazon.com/Understanding-Your-Users-Requirements-Technologies/dp/1558609350
One Cool Thing
20 year anniversary of laser mouse
https://gizmodo.com/20-years-ago-microsoft-changed-how-we-mouse-forever-1834274151
CISO Desk Reference Guide
https://cisodrg.com/
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
47min
April 24, 2019 Weaponizing DICOM and Dr. Charlie Frank, Mirai Botnet Expert, Interview
Steve and Gerry discuss recent research around embedding malware in DICOM image files, and they interview Dr. Charlie Frank, Mirai Botnet expert.
As always they end with One Cool Thing.
Show Notes

Resources:
Malware Embedded DICOM Files
https://threatpost.com/hipaa-protected-malware-medical-images/143890/
One Cool Thing
The Internet Arcade
https://archive.org/details/internetarcade
Louie, Louie – whoa, whoa
https://www.digitaltrends.com/cool-tech/nasa-robot-king-louie
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
42min
April 17, 2019 Microsoft Email Breaches, API Security Concerns, and Irresponsible Vulnerability Disclosure
The guys discuss a recent privileged account compromise at Microsoft corporate that resulted in an email breach. They speak high-level of API security concerns and what to expect in the future. Finally they cover a recent example of vulnerability disclosure done poorly that left potentially 160,000 WordPress websites being exploited.
As always they end with One Cool Thing.
Show Notes

Resources:
Microsoft admits email hack
https://www.darkreading.com/attacks-breaches/microsoft-downplays-scope-of-email-attack-/d/d-id/1334423
API Security Concerns
https://www.scmagazine.com/home/opinion/5-things-you-need-to-know-about-api-protection/
Security researcher dropping 0-days
https://arstechnica.com/information-technology/2019/04/a-security-researcher-with-a-grudge-is-dropping-web-0days-on-innocent-users/
One Cool Thing
The Data Map: https://thedatamap.org/
Monitor Darkly: https://www.youtube.com/watch?v=zvP2FEfOSsk
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
43min
April 10, 2019 Amazon Echo in Healthcare, College Admissions Hacked, and Healthcare Integrity and Availability Security Needs
Steve and Gerry discuss the nuances of the Amazon Echo device receiving HIPAA compliance branding. They provide a look at the college admission process leveraging cloud platforms and how they were successfully hacked for fun and profit. Finally the guys discuss the cybersecurity elephant in the healthcare room that providers are not talking about.
As always they end with One Cool Thing.
Show Notes

Resources:
Amazon gets HIPAA-Compliance added to their list of things Alexa can be:
https://developer.amazon.com/blogs/alexa/post/ff33dbc7-6cf5-4db8-b203-99144a251a21/introducing-new-alexa-healthcare-skills
A high schooler notifies universities that their admissions portal is hackable. Not that anyone would want to subvert college admissions.
https://d4stiny.github.io/Hacking-College-Admissions/
Cybersecurity Healthcare Challenges
https://www.theverge.com/2019/4/4/18293817/cybersecurity-hospitals-health-care-scan-simulation
One Cool Thing
Breach Help: https://www.breachclarity.com/
Spy Gear: https://www.detective-store.com/
Contact
Email [email protected]
Twitter:

* Gerry Auger (@Gerald_Auger)
* Steven Cardinal (@sgcardinal)

...more
42min

FAQs about InfoSec ICU:

How many episodes does InfoSec ICU have?

The podcast currently has 48 episodes available.