On The Wire

It’s been a while since we’ve seen the kind of drama surrounding a Microsoft zero-day bug that we saw this week with the Word vulnerability. Details of the flaw began emerging last week and attackers have been targeting it for several months, but Microsoft didn’t saw a thing about it publicly until it patched the bug on Tuesday. This is a reversal from the way the company used to handle these things, and to help make sense of what’s going on Dennis Fisher talked with Mike Mimoso of Threatpost about the vulnerability and why Microsoft has apparently gone backwards on its security response process.

Music by Chris Gonsalves and Ken Montigny

Katie Moussouris has pretty much seen it all in her nearly two decades in the security industry as a pen tester, consultant, Microsoft employee, and many other roles. Now she’s putting that experience and knowledge to work helping governments and enterprises work out the problem of vulnerability disclosure and response with her company Luta Security. Dennis Fisher sat down with Katie at the Security Analyst Summit to talk about her work on the Wassenaar Arrangement on software export controls, bug bounties, and how companies know when they’re ready for a bounty program.

Bug bounty programs are nature enough and lucrative enough that there are some researchers making a very comfortable living from them. But not every technology company has one, and not every researcher is looking to make money for themselves on these projects. David Jacoby of Kaspersky Lab and Frans Rosen of Detectify recently decided to take a different tack on bug bounties and see how much money they could raise for some good causes with a weekend of hacking. Dennis Fisher spoke with Jacoby and Rosen at the Security Analyst Summit about their project and what other researchers could do to follow suit.

Threat intelligence and business risk intelligence have become key ingredients in enterprise security programs as companies try to make sense out of the ever-changing threat landscape. To help wade through all of the information and figure out what’s important, Dennis Fisher talks with Chris Camacho, chief strategy officer at Flashpoint, and a former VP of information security at Bank of America.

There probably isn’t anyone more closely associated with the field of software security than Gary McGraw. He’s been thinking, writing, speaking, and studying the practice for more than two decades and has helped some of the world’s largest organizations develop and improve software security programs. In this episode, Dennis Fisher talks with Gary about his new stealth project, IoT software security, government intervention, and Gary’s latest musical projects.

Music by Chris Gonsalves and Ken Montigny

Cloudflare is one of those companies that most normal Internet users may never have heard of, but rely on every day. The company’s infrastructure protects a large fraction of the global Internet’s sites and so when a bug emerges in its systems, it’s a Big Deal. The memory leak vulnerability that Cloudflare disclosed this week fits into that category. It resulted from a weird confluence of events and the main effect was that private data from some Cloudflare customers was leaked on the web over the last few months. Dennis Fisher spoke with Nick Sullivan, head of crypto at Cloudflare, about the vulnerability, the response process, and what the company learned from all of it.

Music by Chris Gonsalves and Ken Montigny

As the RSA Conference was winding down this week in San Francisco, we gathered a few reporters and other friends to talk about all the security news from the conference, what we liked, things we didn’t like so much, and a lot of other topics. Guests this year include Brian Donohue from Cyber4Sight, Chris Brook from Threatpost, Jennifer Leggio from Flashpoint, and Jessy Irwin.

Music by Chris Gonsalves and Ken Montigny

It’s been 16 years since the first time I went to the RSA Conference and a whole lot of things have changed since then. For one, there are about 30 times as many people now. And the conference has morphed from being a crypto-heavy gathering to a sales feeding frenzy. So I called up my old friend Mike Mimoso of Threatpost to talk about what’s changed over the years and what we’re expecting this year at the show.

Music by Chris Gonsalves and Ken Montigny

Last year, we talked to Roger Anderson about his Jolly Roger Telephone company bot, a system he designed to frustrate and annoy telemarketers by sending them through an infinite loop of robot responses. Now, Anderson is taking aim at the Windows support scammers who try to scare victims into calling them and paying for fake support for their PCs. We talked to Roger about how he’s trying to disrupt their operations.

Music by Chris Gonsalves and Ken Montigny.

Image: Adam Carter, CC By-nd license. 

Jeremiah Grossman is one of the more well-respected and accomplished members of the security community and after more than a decade building WhiteHat Security, he recently joined SentinelOne as chief of security strategy. He’s been working on and thinking about the ransomware problem and trying to come up with answers for why it’s turned into an epidemic. Dennis Fisher talked with Jeremiah about how we got to this point, what we can do about it, and how cyber insurance and liability play a part.

Music by Chris Gonsalves and Ken Montigny.