Joe Slowik, ATT&CK CTI Lead at MITRE, joins the latest episode of the mnemonic security podcast to share his insights on the complexities of securing critical infrastructure. With a background in cyber threat intelligence, incident response, and detection engineering, Joe discusses with Robby the challenge of defining and prioritising what's truly "critical" in a landscape where every sector claims importance.

They explore the difficulty in distributing security investments across industries and the growing need for organisations of all sizes to adopt a mindset of self-defence. Joe also addresses the potential consequences of large-scale cyberattacks, such as those by Volt Typhoon, emphasising the need for coordinated incident response and leadership during crisis scenarios. He concludes with a strong call for resilience and highlights the vital role CEOs play in ensuring organisational preparedness.

Send us Fan Mail

KraftCERT trusselvurdering 2024 | In Norwegian only

In this episode, Robby is joined by Espen Endal and Bjørn Tore Hellesøy from KraftCERT/InfraCERT - the Norwegian CERT for the energy and petroleum sectors. 

The trio discuss the Threat Assessment report recently published by KraftCERT/InfraCERT, and the unique challenges the Norwegian energy sectors are facing. They touch into topics such as threat evaluation, insider threats, countermeasures, and the importance of maintaining robust security practices despite evolving digital landscapes. 

The conversation emphasises the contextualization of national threat assessments to be practical for energy production companies, stressing the balance between emerging technologies like AI and Digital Twins and their associated risks.

The Threat Assessment 2024 report is available at: https://www.kraftcert.no/filer/KraftCERT-ThreatAssessment2024.pdf

Send us Fan Mail

In this episode, Robby speaks with Jens Christian Vedersø, Head of Cyber Risk Management at Vestas, one of the world’s largest wind turbine manufacturers.

Jens is a former Navy and intelligence officer and recovering regulator. Before managing cyber risk in the renewable energy sector, Jens helped develop energy sector legislation and cyber preparedness at the Danish Energy Agency, and served as a subject matter expert for SCADA, OT, ICS and IoT at the Danish Center for Cyber Security.

In the discussion Jens shares his unique perspective on how security acts as both an enabler and a potential barrier in the transition towards renewable energy transition, and how the industry needs to move from a reactive, compliance-driven approach towards a more proactive, risk-based model. Jens also shares insights into the threat landscape, potential motivations of state actors, and how Vestas is working to quantify cyber risk and empower customers to better understand and control their own cyber risks.

Send us Fan Mail

In this episode of the mnemonic security podcast, Robby is joined by Matt Cooke from Proofpoint. 

They discuss the evolving landscape of email security, emphasising the need for a multi-layered approach beyond traditional prevention methods, as well as the importance of pre-delivery, post-delivery, and click-time protection to combat phishing and business email compromise (BEC) attacks. 

Matt notes that 76% of data breaches involve human error, and stresses the significance of threat intelligence and machine learning in detecting and mitigating threats. The conversation also touches on the role of AI in enhancing email security, the importance of DMARC for email authentication, and the concept of "very attacked people" (VAPs) to prioritise security efforts.

Send us Fan Mail

In this special, celebratory 100th episode of the mnemonic security podcast, Robby speaks with author and industry legend - Jon DiMaggio.

Jon is the Chief Security Strategist at Analyst1 and has over 15 years of experience hunting, researching, and writing about advanced cyber threats. As a specialist in enterprise ransomware attacks and nation-state intrusions, Jon authored several investigative reports, including Robby´s favourite, “The Ransomware Diaries”, and also wrote the award-winning book “The Art of Cyberwarfare.” 

Jon has gone as far as to go develop relationships with some of the world’s most notorious ransomware gangs, for example LockBit, and exposed the interworkings of cartels behind major ransomware attacks. Their conversation explores the operational models of ransomware groups, which often function through a web of partnerships, specialised roles, and profit-sharing structures. DiMaggio provides his unique perspective on building relationships with cybercriminals to gather intelligence while navigating the ethical dilemmas and personal risks. 

Most importantly, he answers Robby´s burning question: “What’s your opinion of the bad guys?”

Send us Fan Mail

In this week's episode, Robby talks with his friend Keven Hendricks, a law enforcement veteran with extensive experience in dark web and cryptocurrency investigations. They explore topics like dark web forums, cryptocurrency's role in illegal activities, and the difficulties law enforcement encounters when monitoring these areas, especially with privacy coins like Monero.

Keven emphasizes the need for companies to take a ‘boots on the ground’ approach to monitoring dark web activities, rather than depending only on third-party tools. «Keep your friends close, but your enemies closer,» right? Keven also touches on the potential value of having a ‘Chief Intelligence Officer’ (CINO) to actively investigate emerging threats.

Send us Fan Mail

Many are familiar with cybersecurity penetration testing – ethical hacking to uncover digital weaknesses. But what about the real-world threats to your company's physical security? How confident are you in your locks, cameras, and physical security measures to protect your sensitive data or equipment?

In this episode, Robby speaks with Brian Harris, a leading expert in physical penetration testing as a part of Black Teaming. Black Teaming is a type of security assessment that simulates an attack on an organisation, including tactics such as physical intrusion and social engineering. Brian, Chief Instructor for the Covert Access Team, has conducted hundreds of these physical pen tests, helping organisations identify and fix vulnerabilities that could lead to corporate espionage and other threats. 

They provide real-world examples, discuss the limitations of common security measures, and touch on methods for improvement. These methods can include gamifying security by incentivizing employees to take an active role in physical security, for instance by keeping an eye on suspicious activity in the office.

Send us Fan Mail

Have you ever worked alongside a machine learning engineer? Or wondered how their world will overlap with ours in the "AI" era?

In this episode of the podcast, Robby is joined by seasoned expert Kyle Gallatin from Handshake to enlighten us on his perspective on how collaboration between security professionals and ML practitioners should look in the future. They discuss the typical workflow of an ML engineer, the risks associated with open-source models and machine learning experimentation, and the potential role of "security champions" within ML teams. Kyle provides insight into what has worked best for him and his teams over the years, and provides practical advice for companies aiming to enhance their AI security practices.

Looking back at our experience with "DevSecOps" - what can we learn from and improve for the next iteration of development in the AI era?

Send us Fan Mail

Operationalising threat intelligence is back on topic for the mnemonic security podcast!

Making a return to the podcast is Joe Slowik from MITRE Corporation, where he is the CTI Lead for MITRE ATT&CK and also Principal Engineer for Critical Infrastructure Threat Intelligence. Also joining is Jeff Schiemann, an industry veteran and CISO at one of the world's first crypto banks.

The conversation ventures across how security teams are currently using threat intelligence, the importance of frameworks and standardisation, and the role AI and automation may play for defenders and adversaries. The trio also share their thoughts on a future where threat intelligence decisions can be automated in real-time, and what might take to get us there.

Send us Fan Mail

When we talk about securing an organisation’s assets, we most often mean its data, devices, servers, or accounts, but are we doing enough to secure the group of people leading the company? Or the ones doing high risk work on behalf of the organisation?

To discuss the importance of securing high-risk individuals, like journalists, politicians and executives, Robby is joined by an expert in this field, Runa Sandvik, journalist, security researcher and founder of Granitt. At Granitt, Runa works with digital security for journalists and other at-risk people, building on her experiences working at The New York Times, Freedom of the Press Foundation and The Tor Project.

During the conversation, they talk about how to secure devices when travelling to high-risk countries, what tools to use and at what time, and how threat actors usually target individuals. Runa also shares how she works to secure accounts and devices for her clients.

Send us Fan Mail