O'Reilly Security Podcast - O'Reilly Media Podcast

O'Reilly Security Podcast - O'Reilly Media Podcast episodes:

• 12.06.2017

  Rich Smith on redefining success for security teams and managing security culture

  In this episode of the Security Podcast, I talk with Rich Smith, director of labs at Duo Labs, the research arm of Duo Security. We discuss the goals of agile application security, how to reframe success for security teams, and...

  
• 11.22.2017

  Christie Terrill on building a high-caliber security program in 90 days

  In this episode of the Security Podcast, I talk with Christie Terrill, partner at Bishop Fox. We discuss the importance of educating businesses on the complexities of “being secure,” how to approach building a strong security program, and aligning security...

  
• 11.08.2017

  Susan Sons on building security from first principles

  In this episode of the Security Podcast, O’Reilly’s Mac Slocum talks with Susan Sons, senior systems analyst for the Center for Applied Cybersecurity Research (CACR) at Indiana University. They discuss how she initially got involved with fixing the open source...

  
• 10.25.2017

  Charles Givre on the impetus for training all security teams in basic data science

  In this episode of the Security Podcast, I talk with Charles Givre, senior lead data scientist at Orbital Insight. We discuss how data science skills are increasingly important for security professionals, the critical role of data scientists in making the...

  
• 10.12.2017

  Andrea Limbago on the effects of security’s branding problem

  In this episode of the Security Podcast, I talk with Andrea Limbago, chief social scientist at Endgame. We discuss how the misperception of security as a computer science skillset ultimately restricts innovation, the need to make security easier and accessible...

  
• 09.28.2017

  Window Snyder on the indispensable human element in securing your environment

  In this episode of the Security Podcast, I talk with Window Snyder, chief security officer at Fastly. We discuss the fact that many core security best practices aren’t easy to achieve with tools, the importance of not discounting user fatigue...

  
• 09.13.2017

  Chris Wysopal on a shared responsibility model for developers and defenders

  In this episode of the Security Podcast, I talk with Chris Wysopal, co-founder and CTO of Veracode. We discuss the increasing role of developers in building secure software, maintaining development speed while injecting security testing, and helping developers identify when...

  
• 08.30.2017

  Scott Roberts on intelligence-driven incident response

  In this episode of the Security Podcast, I talk with Scott Roberts, security operations manager at GitHub. We discuss threat intelligence, incident response, and how they interrelate.

  
• 08.17.2017

  Jack Daniel on building community and historical context in InfoSec

  In this episode of the Security Podcast, I talk with Jack Daniel, co-founder of Security Bsides. We discuss how each of us (and the industry as a whole) benefits from community building, the importance of historical context, and the inimitable...

  
• 08.02.2017

  Jay Jacobs on data analytics and security

  In this episode of the Security Podcast, Courtney Nash, former chair of O’Reilly Security conference, talks with Jay Jacobs, senior data scientist at BitSight. We discuss the constraints of convenient data, the simple first steps toward building a basic security...

  
• 07.19.2017

  Katie Moussouris on how organizations should and shouldn’t respond to reported vulnerabilities

  In this episode, O’Reilly’s Courtney Nash talks with Katie Moussouris, founder and CEO of Luta Security. They discuss why many organizations have a knee-jerk legal response to a bug report (and why your organization shouldn’t), the first steps organizations should...

  
• 07.05.2017

  Alex Pinto on the intersection of threat hunting and automation

  In this episode, I talk with Alex Pinto, chief data scientist at Niddel. We discuss the role of threat hunting in security, the necessity for well-defined process and documentation in threat hunting and other activities, and the potential for automating...

  
• 06.21.2017

  Amanda Berlin on defensive security fundamentals

  In this episode, I talk with Amanda Berlin, security architect at Hurricane Labs. We discuss how to assess and develop defensive security policies when you’re new to the task, how to approach core security fundamentals like asset management, and generally...

  
• 06.07.2017

  Kimber Dowsett on developing and maturing a vulnerability disclosure program

  In this episode, I talk with Kimber Dowsett, security architect at 18F. We discuss how to prepare your organization for a vulnerability disclosure policy, the benefits of starting small, and how to apply lessons learned to build better defenses.

  
• 05.24.2017

  Kelly Shortridge on overcoming common missteps affecting security decision-making

  In this episode, I talk with Kelly Shortridge, detection product manager at BAE Systems Applied Intelligence. We talk about how common cognitive biases apply to security roles, how decision trees can help security practitioners overcome assumptions and build more dynamic...

  
• 05.10.2017

  Dave Lewis on the tenacity of solvable security problems

  In this episode, I talk with Dave Lewis, global security advocate at Akamai. We talk about how technical sprawl and employee churn compounds security debt, the tenacity of solvable security problems, and how the speed of innovation reintroduces vulnerabilities.

  
• 04.26.2017

  Parvez Ahammad on applying machine learning to security

  In this special episode of the Security Podcast, O’Reilly’s Ben Lorica talks with Parvez Ahammad, who leads the data science and machine learning efforts at Instart Logic. He has applied machine learning in a variety of domains, most recently to...

  
• 04.12.2017

  Katie Moussouris on procuring and processing bug reports

  In this episode, I talk with Katie Moussouris, founder and CEO of Luta Security. We discuss the five stages of vulnerability disclosure grief, hacking the government, and the pros and cons of bug bounty programs.

  
• 03.29.2017

  Allison Miller on making security better and easier for everyone

  In this episode, I talk with Allison Miller, product manager for secure browsing at Google and my co-host of the O’Reilly Security conference, which is returning to New York City this fall. We discuss the importance of having an event...

  
• 03.15.2017

  Scout Brody on crafting usable and secure technologies

  In this episode, O’Reilly Media’s Mac Slocum talks with Scout Brody, executive director of Simply Secure. They discuss building systems that help humans, designing better tools through user studies, and balancing the demands of shipping software with security.

  
• 03.01.2017

  Jessy Irwin on making security understandable for everyone

  In this episode, I talk with Jessy Irwin, VP of security and privacy at Mercury Public Affairs. We discuss how to communicate security to non-technical people, what security might look like for small businesses, and moving beyond shame. We also...

  
• 02.15.2017

  Doug Barth and Evan Gilman on Zero Trust networks

  In this episode, I talk with Doug Barth, site reliability engineer at Stripe, and Evan Gilman, Doug’s former colleague from PagerDuty who is now working independently on Zero Trust networking. They are also co-authoring a book for O’Reilly on Zero...

  
• 02.01.2017

  Susan Sons on maintaining and securing the internet’s infrastructure

  In this episode, O’Reilly’s Mac Slocum talks with Susan Sons, senior systems analyst for the Center for Applied Cybersecurity Research (CACR) at Indiana University. They discuss how she initially got involved with fixing the open source Network Time Protocol (NTP)...

  
• 01.18.2017

  Steven Shorrock on the myth of human error

  In this episode, I talk with Steven Shorrock, a human factors and safety science specialist. We discuss the dangers of blaming human error, studying success along with failure, and how humans are critical to making our systems resilient.

  
• 01.04.2017

  Fang Yu on machine learning and the evolving nature of fraud

  In this episode, O’Reilly’s Jenn Webb talks with Fang Yu, cofounder and CTO of DataVisor. They discuss sniffing out fraudulent sleeper cells, incubation in money transfer fraud, and adopting a more proactive stance against fraud.

  
• 12.21.2016

  Cory Doctorow on the real-life dangers of DRM

  In this best of 2016 episode, I revisit a conversation from earlier this year with Cory Doctorow, a journalist, activist, and science fiction writer. We discuss the unexpected places where digital rights management (DRM) pops up, how it hinders artistic...

  
• 12.07.2016

  Ame Elliot on designing for usable security and privacy

  In this episode, O’Reilly’s Mary Treseler talks with Ame Elliot, design director at Simply Secure. They discuss designing for security and privacy, noteworthy tools, and the real-world consequences of design.

  
• 11.23.2016

  Richard Moulds on harnessing entropy for a more secure world

  In this episode, I talk with Richard Moulds, vice president of strategy and business development at Whitewood Encryption. We discuss whether random number generation is as random as some might think and the implications that has on securing systems with...

  
• 11.23.2016

  Gilad Rosner on privacy in the age of the Internet of Things

  In this episode of the O’Reilly Hardware Podcast, Jeff Bleiel and I speak with Gilad Rosner, a privacy and information policy researcher, and the founder of the Internet of Things Privacy Forum.  Rosner is also the author of the recently-published...

  
• 11.09.2016

  Efrain Ortiz on digital disease control

  In this episode, I talk with security architect Efrain Ortiz. We discuss how epidemiology can be applied to infosec, the parallels between using data and patterns to diagnose disease and find endpoint problems, and how to think like an epidemiologist...

  
• 10.26.2016

  Brendan O’Connor on security as a monoculture

  In this episode, I talk with Brendan O’Connor, a security researcher, lawyer (but not your lawyer) and owner of security consulting firm Malice Afterthought. We discuss creating a culture that celebrates collaborative teamwork over harried heroes, how monitoring and checklists...

  
• 10.12.2016

  Dan Kaminsky on creating an NIH for the security industry

  In this episode, I talk with Dan Kaminsky, founder and chief scientist at White Ops. We discuss what a National Institutes of Health (NIH) for security would look like, the pros and cons of Docker and ephemeral solutions, and how...

  
• 09.28.2016

  Josh Corman on the challenges of securing safety-critical health care systems

  In this episode, I talk with Josh Corman, co-founder of I Am the Cavalry and director of the Cyber Statecraft Initiative for the non-profit organization Atlantic Council. We discuss his recent work advising the White House and Congress on the...

  
• 09.14.2016

  Kyle Rankin on modern server hardening for the cloud

  In this episode, I talk with Kyle Rankin, vice president of engineering operations at Final, a credit card startup. We discuss old versus new approaches to server hardening in light of the cloud, how institutional inertia thwarts change, and the...

  
• 08.31.2016

  Meredith Patterson on using language to build trustworthy systems

  In this episode, I talk with Meredith Patterson, a software engineer and leader of the Langsec Conspiracy. We discuss the origins of LangSec, rigidity versus robustness, and game theory as it applies to organizational approaches to security.

  
• 08.17.2016

  Cory Doctorow on legally disabling DRM (for good)

  In this episode, I talk with Cory Doctorow, a journalist, activist, and science fiction writer. We discuss the EFF lawsuit against the U.S. government, the prospect for a whole new industry of pro-security businesses, and the new W3C DRM specification.

  
• 08.03.2016

  Chris Eng on the challenges of improved application security

  In this episode, I talk with Chris Eng, vice president of research at Veracode, a software security-as-a-service business. We discuss Veracode’s research on application security across a broad spectrum of industries, the challenges of securing modern “assembled” software, and making it...

  
• 07.20.2016

  Guy Podjarny on making open source more secure

  In this episode, I talk with Guy Podjarny, founder of Snyk, a developer tooling company focused on securing open source alongside building a business. We discuss the parallel paths between the transformation from Ops teams to DevOps and where security teams...

  
• 07.06.2016

  Eleanor Saitta on security as a product of shared human outcomes

  In this episode, I talk with Eleanor Saitta, a security architect at Etsy. We talk about how security isn’t really about what happens to computers—it’s about what happens to the people using those systems; the relationship between design and security;...

  
• 06.22.2016

  Jay Jacobs on the importance of statistical literacy in security

  In this episode of the Security Podcast, I talk with Jay Jacobs, senior data scientist at BitSight. We discuss the disparity between intuition and analytics in data science, the limitations of unsupervised machine learning, and the challenges of creating effective...

  
• 06.08.2016

  Jack Whitsitt on the need to band together to make security better for everyone

  In this episode, I talk with Jack Whitsitt, senior strategist at EnergySec. We discuss the ways in which language can either divide or unite people and organizations, the illusion of control when it comes to security, and how any model...

  
• 05.26.2016

  Allison Miller on the need for defenders to step out of the shadows and share their stories

  In this inaugural episode of the O’Reilly Security Podcast, I talk with Allison Miller, a product manager at Google and my co-chair for the new O’Reilly Security Conference. We discuss her evolving understanding of the nature of risk and fraud...

  
• 12.03.2015

  Ari Gesher and Kipp Bradford on security and the Internet of Things

  In this episode of our newly renamed Hardware Podcast, I talk with Ari Gesher, engineering ambassador at Palantir Technologies, and Kipp Bradford, research scientist at the MIT Media Lab.