Phillip Wylie Show

By Phillip WylieTechnology

Phillip Wylie Show episodes

October 10, 2024White Knight Labs: Part 2
About the Guests:
Greg Hatcher and John Stigerwalt are co-founders of White Knight Labs, a boutique cybersecurity company specializing in offensive security services and advanced training programs. Greg's background includes a remarkable career as a Green Beret in the U.S. Army, transitioning into cybersecurity with a focus on penetration testing and red teaming. John's journey began with a passion for hacking at 17, which led to a diverse career across IT roles, eventually specializing in penetration testing and red teaming for global companies. Together, they offer unique services aimed at elevating cybersecurity standards through White Knight Labs.

Episode Summary:
Dive into an engaging conversation on The Phillip Wylie Show featuring Greg Hatcher and John Stigerwalt from White Knight Labs. In this episode, the duo returns to discuss their explosive growth in the cybersecurity space, emphasizing their dedication to providing top-tier penetration testing services and innovative training programs. Greg and John highlight their focus on delivering comprehensive security testing, not just ticking compliance boxes but aiming to identify potential threats that could cripple a business financially.
As they delve into their services, Greg and John emphasize their approach to cybersecurity assessments, distinguishing themselves by employing senior engineers for direct, high-impact testing rather than a flat-rate service model. They discuss their various training programs, including offensive development and red teaming operations courses, all tailored to stay hyper-current and relevant in the fast-evolving cybersecurity landscape. The conversation also navigates through intriguing war stories from their physical penetration testing engagements, offering listeners a peek into the challenges and excitement of real-world security assessments.

Key Takeaways:
Comprehensive Cybersecurity Services: White Knight Labs focuses on delivering more than just compliance-driven testing, aiming for substantial security insights to protect businesses.

Advanced Training Programs: The company offers courses on advanced red teaming, Azure penetration testing, and entry-level certifications, ensuring students gain hands-on, up-to-date skills in cybersecurity.

Skillbridge Program: Engaging with transitioning military personnel, White Knight Labs offers internships and training, providing valuable career opportunities in cybersecurity.

Utilizing AI in Cybersecurity: Greg and John discuss leveraging AI tools to streamline coding and development processes, increasing efficiency in their operations.

Real-world Penetration Testing Stories: Sharing intriguing insights, the duo discusses the complexity and adventure involved in physical penetration testing operations.

Key Takeaways:
"Our engineers at WKL will get the domain admin typically in the first hour or two… We're going after the crown jewels." - Greg Hatcher

"We’re not just giving TLS Cert issues. We’re top of the line, going for the RC, the big level bugs." - John Stigerwalt

"We're participating in the Skillbridge program… It's our way of getting back to the community as well." - Greg Hatcher

"If I could cut off the database… that business is gonna shut doors." - John Stigerwalt

"The OSCP made my career, but it wasn't that relevant for what I was doing as a full-time penetration tester." - John Stigerwalt

Chapters
00:00 Introduction to White Knight Labs
02:03 The Growth of White Knight Labs
05:20 SkillBridge Program and Community Support
06:37 Differentiating Factors in Pen Testing Services
11:26 Compliance vs. Security in Pen Testing
15:19 The Impact of Breaches on Security Budgets
16:28 Training Programs and Course Offerings
30:36 Leveraging AI in Offensive Security
34:37 War Stories from the Field
56:18 Upcoming Events and Closing Remarks
57:52 Phillip Wylie Show Outro Video.mp4

Resources:
White Knight Labs Website: White Knight Labs

Greg Hatcher's LinkedIn: Greg Hatcher

John Stigerwalt's LinkedIn: John Stigerwalt

White Knight Labs: **Navigating Advanced Red Team Operations (previous episode) **https://phillipwylieshow.com/episode/white-knight-security-navigating-advanced-red-team-operations
59 min
October 08, 2024Ryan Feder: The Resilience Factor
Summary

In this conversation, Ryan Feder and Phillip Wylie explore the themes of resilience, innovation, and personal growth. They discuss how challenges can be transformed into opportunities and the importance of maintaining a positive mindset in the face of adversity. The dialogue emphasizes the power of innovative thinking and the necessity of embracing change as a pathway to success.

Takeaways
Turning challenges into opportunities is key to success.

Resilience allows us to navigate through tough times.

Innovative thinking can lead to transformative solutions.

Growth often comes from overcoming significant challenges.

Embracing change is essential for personal development.

A positive mindset can alter our perception of adversity.

Learning from failures can pave the way for future success.

Collaboration can enhance innovative ideas and solutions.

Personal growth is a continuous journey, not a destination.

Adapting to change can unlock new possibilities.

Sound Bites
"You took a bad situation and made it good."

"The power of resilience is incredible."

"Innovative thinking can change everything."

Chapters

00:00 Meeting at Defcon
06:30 Finding Passion in the Cybersecurity Industry
12:50 Transitioning to Offensive Security
15:56 The Importance of Networking
18:46 The Supportive Cybersecurity Community
19:30 The Importance of Physical Security
24:34 Admitting Ignorance and Seeking Help
34:54 Networking and Continuous Learning
40:00 Understanding Technology for Effective Pen Testing

Resources
https://www.linkedin.com/in/ryan-feder-sscp/
https://x.com/Ano1X8
44 min
October 01, 2024 Snehal Antani: A New Cybersecurity Paradigm
Takeaways

·
Snehal Antani emphasizes the importance of
product obsession in leadership.
·
The transition from a bull market to a bear
market requires quick strategic shifts.
·
A strong technical foundation is crucial for
success in offensive security roles.
·
Certifications signal a commitment to
self-improvement but are not the sole indicator of skill.
·
Bootcamps can provide a pathway into
cybersecurity but require ongoing learning to retain skills.
·
Autonomous pen testing offers a consistent and
comprehensive approach to security assessments.
·
The integration of offensive and defensive
security communities is essential for overall effectiveness.
·
Understanding the threat actor perspective is
vital for effective cybersecurity strategies.
·
Horizon 3 aims to leverage data advantage to
enhance its product offerings.
·
The future of cybersecurity will involve
algorithms fighting algorithms with human oversight.
Sound Bites

·
"Pen testing can be automated that
much."
·
"I am obsessed with the product."
·
"I took a 99% pay cut to serve."

Chapters

00:00 Introduction to Horizon 3 and Snehal Antani
03:26 Leadership and Company Culture at Horizon 3
06:30 Snehal's Hacker Origin Story
10:37 Transition from Corporate America to JSOC
13:45 Building Horizon 3's Culture and Team
16:28 The Unique Approach of Horizon 3
20:24 The Evolution of Pen Testing
24:34 The Role of Humans in Pen Testing
28:41 The Shift in Cybersecurity Mindset
32:31 Certifications and Bootcamps in Cybersecurity
36:26 The Future of Cybersecurity and Co-Pilots
40:21 The Importance of Data in Cybersecurity
44:22 The Impact of Autonomous Pen Testing
48:22 Conclusion and Future Outlook
58:33 Phillip Wylie Show Outro Video.mp4

Resources
https://www.linkedin.com/in/snehalantani/
https://x.com/snehalantani
https://www.horizon3.ai/
https://www.linkedin.com/company/horizon3ai/

59 min
September 24, 2024 Christophe Foulon: Certifications, Are They Still Necessary?
Summary

In this episode of the Phillip Wylie Show, host Phillip Wylie speaks with Christophe Foulon, a cybersecurity expert and podcaster, about his journey into the cybersecurity field, the importance of self-discovery for aspiring professionals, and the evolving landscape of hiring practices in the industry. They discuss the significance of certifications, the need for internal talent development, and the value of community involvement in cybersecurity education. Christophe shares practical advice for job seekers, emphasizing the importance of networking and curiosity in building a successful career in cybersecurity.

Takeaways

Christophe's journey into cybersecurity began at a young age.
Self-discovery is crucial for those entering the cybersecurity field.
Certifications are often necessary, especially for government roles.
Hiring practices are evolving, with less emphasis on traditional degrees.
Internal training and development can help fill cybersecurity roles.
Apprenticeships can provide valuable hands-on experience.
Community involvement is essential for building a skilled workforce.
Networking is key to finding job opportunities in cybersecurity.
Curiosity and continuous learning are vital for success in cybersecurity.
Understanding the job market and roles can prevent burnout.

Sound Bites

"I was just hooked."
"It all starts on the foundation of self-discovery."
"You need to be eternally curious."

Chapters

00:00 Introduction and Background
06:46 Recommendations for Breaking Into Cybersecurity
10:54 The Role of Certifications in Cybersecurity
16:08 Creating Career Paths and Apprenticeships in Cybersecurity
25:02 The Value of Networking and Building Relationships in Job Hunting
29:40 Staying Informed: Researching Industry Trends in Cybersecurity
32:14 Closing Remarks
32:39 Phillip Wylie Show Outro Video.mp4

Resources
https://www.linkedin.com/in/christophefoulon/
https://x.com/chris_foulon

34 min
September 17, 2024Len Noe: World's First Augmented Hacker
Summary
In this episode, Len Noe, the world's first augmented
ethical hacker, shares his journey into cybersecurity and his experience with body modification. He discusses his hacker origin story, his professional career, and his current work as an evangelist for CyberArk. Len also talks about his book, 'Hacked Human: My Life and Lessons,' which explores the world of augmented humans and the ethical implications of integrating technology into
the human body.

Takeaways
Len Noe shares his hacker origin story and how he got into cybersecurity.

He discusses his professional career and how he transitioned from being a black hat to an ethical hacker.

Len talks about his current work as an evangelist for
CyberArk and his role in educating people about cybersecurity.

He explores the world of augmented humans and the ethical implications of integrating technology into the human body.

Sound Bites
"I came to the ways of cybersecurity via the Black Hat
route."

"I have 10 different microchips that are planted inside
my body."

"I can attack physical access control systems directly
through physical contact."

Chapters
00:00 Introduction and Guest Introduction
03:36 Unconventional Paths into Cybersecurity
10:28 Implantable Technology and the Future of Augmented
Humans
18:41 Redefining Medical Ethics: Risks and Benefits of Body
Modification
25:44 Hacked Human: Insights from the World's First
Augmented Ethical Hacker
37:26 Phillip Wylie Show Outro Video.mp4

Resources
https://x.com/hacker_213
https://www.linkedin.com/in/len-noe/
Human Hacked: My Life and Lessons as the World's First
Augmented Ethical Hacker
https://www.wiley.com/en-mx/Human+Hacked%3A+My+Life+and+Lessons+as+the+World's+First+Augmented+Ethical+Hacker-p-9781394269167
38 min
September 10, 2024 HOU.SEC.CON.
Summary

HOU.SEC.CON is a cybersecurity conference in Texas that aims
to provide opportunities for students and professionals in the industry. The
conference was started in 2010 by Michael Farnum and Sam Van Ryder, who wanted
to create a community for cybersecurity professionals in Houston. They
initially ran the conference under the auspices of the National Information
Security Group, but eventually split off and ran it independently. The
conference has grown over the years, attracting attendees and speakers from all
over the United States and even internationally. They have had to move to
larger venues to accommodate the increasing number of participants. HOU.SEC.CON
has steadily grown from 120 attendees in its first year to almost 1400
attendees last year. The organizers initially planned to cap the conference at
300 or 500 attendees, but the demand kept increasing. The conference aims to
grow the cybersecurity community in Houston and provide a more affordable and
accessible option compared to larger conferences like RSA and Black Hat. HOU.SEC.CON
has added two additional conferences, OT.SEC.CON and EXEC.SEC.CON, to cater to
specific cybersecurity subfields. The organizers also host monthly user group
meetings and provide networking opportunities for the community.

Takeaways

HOU.SEC.CON is a cybersecurity conference in Texas that
provides opportunities for students and professionals in the industry.
The conference was started in 2010 by Michael Farnum and Sam
Van Ryder to create a community for cybersecurity professionals in Houston.
They initially ran the conference under the auspices of the
National Information Security Group before splitting off and running it
independently.
HOU.SEC.CON has grown over the years, attracting attendees
and speakers from all over the United States and internationally. HOU.SEC.CON
has experienced significant growth, from 120 attendees in its first year to
almost 1400 attendees last year.
The conference aims to provide an affordable and accessible
option for the cybersecurity community in Houston.
HOU.SEC.CON has added two additional conferences, OT.SEC.CON
and EXEC.SEC.CON, to cater to specific cybersecurity subfields.
The organizers also host monthly user group meetings and
provide networking opportunities for the community.

Sound Bites

"HOU.SEC.CON is a cybersecurity conference in
Texas"
"The conference was started in 2010 by Michael Farnum
and Sam Van Ryder"
"They initially ran the conference under the auspices
of the National Information Security Group"
"We were close to 1400 last year."
"Let's top out at 300. Let's top out at 500. Let's do
whatever."
"We would have to take up multiple floors if we were
going to stay at the hotel."

Chapters

00:00 Introduction to HOU.SEC.CON and its mission
06:15 The origins of HOU.SEC.CON and its role in the Houston
cybersecurity community
18:33 Differentiating HOU.SEC.CON from other conferences:
Valuable content and community focus
24:15 The growth and recognition of HOU.SEC.CON
26:35 Expanding HOU.SEC.CON
30:51 A More Accessible Alternative
35:46 Building a Strong Cybersecurity Community

Resources
http://houstonseccon.org/
https://www.linkedin.com/company/houseccon/
https://x.com/HouSecCon

https://www.linkedin.com/in/mfarnum/
https://x.com/m1a1vet

https://www.linkedin.com/in/svanryder/
https://x.com/SamVR
45 min
September 06, 2024 Be Fearless Online: In-Browser Email Security
About the Guest:
Jeswin Mathai is the Chief Architect at SquareX. He leads the team responsible for designing and implementing the Infrastructure. Prior to joining SquareX, He was working as the chief architect at INE. He has published his work at DEFCON China, RootCon, Blackhat Arsenal, and Demo Labs (DEFCON). He has also been a co-trainer in-classroom training conducted at Black Hat Asia, HITB, RootCon, and OWASP NZ Day. He has a Bachelor's degree from IIIT Bhubaneswar. He was the team lead at InfoSec Society IIIT Bhubaneswar in association with CDAC and ISEA, which performed security auditing of government portals and conducted awareness workshops for government institutions. His area of interest includes Cloud Security, Container Security, and Web Application Security.
Episode Summary:
In this captivating episode of 'The Philip Wylie Show', host Philip Wylie is joined once again by offensive security aficionado Jeswin Mathai. This talk orbits around the expansive realm of professional hacking, highlighting the persistent curiosity and zealous passion these experts have for overcoming challenges in their line of work. With Jeswin on board, listeners can anticipate an in-depth exploration of Squarex's new and riveting features aimed at staving off online vulnerabilities.
The episode delves into the intricate world of in-browser malicious file detection, a pressing issue in today's digital-heavy climate. Jeswin Mathai meticulously walks listeners through the challenges surrounding the detection of malicious files, expanding upon why conventional antivirus solutions struggle and how attackers exploit naïveté during delivery. Furthermore, he presents a live demonstration of Squarex's monumental browser integration, showcasing its real-time detection capabilities and remediation options, elevating Gmail's native security measures to impressive new heights.
Key Takeaways:

Squarex is revolutionizing online security: The discussion reveals how the product can enhance Gmail security by detecting and alerting users to potential threats before they materialize.
In-browser file analysis: Squarex performs comprehensive checks directly within your browser, maintaining user privacy while offering robust protection against malicious files.
Malicious macros are a key threat vector: Jeswin explains how attackers utilize document macros, often undetected by traditional antivirus software, to compromise user systems.
Real-time alerts and remediation: Squarex provides instantaneous analysis of file attachments, distinguishing malicious intent and providing safer alternatives for download.
Enhanced user-friendly protection: The product is designed for ease of use, offering an intuitive safety net for both tech-savvy individuals and those less accustomed to cybersecurity measures.

Notable Quotes:

"The moment you open it, it's almost instantaneous. And not only is it telling you contains macros, tells you the details."
"This is a macro free version created right there in your browser, in case if you're concerned that something can go wrong."
"Email is like the primary source right now of delivery of malicious payload."
"So we have received the mail. So now as you can notice, this is a macro enabled file, but Gmail didn't say anything."
"It's a full blown file system packaged in just one single file, and how crazy it can be to detect malicious macros."

Resources:
Get your free Chrome plugin: ⁠⁠http://sqrx.io/pw_x⁠⁠
⁠⁠https://www.linkedin.com/company/getsquarex/⁠⁠
⁠⁠https://twitter.com/getsquarex⁠⁠
⁠⁠https://www.instagram.com/getsquarex/
52 min
September 03, 2024Joe Brinkley aka The Blind Hacker
Summary

In this episode, Joe Brinkley, also known as the blind hacker, joins Phillip Wylie to discuss his hacker origin story and offer advice for breaking into offensive security and pen testing. They also explore the commoditization of pen testing, the evolution of the industry, and the challenges of testing complex environments. Joe shares his insights on the different generations of hackers and the role of automation and AI in pen testing. He also talks about his work with the Mentor Village and offers resources for those interested in starting their own cybersecurity brand or company.

Takeaways
Joe Brinkley, also known as the blind hacker, shares his hacker origin story and offers advice for breaking into offensive security and pen testing.

The commoditization of pen testing has led to a shift in the industry, with companies seeking budget-friendly alternatives and rotating vendors frequently.

Automation and AI play a significant role in pen testing, allowing for faster and more efficient testing, but human expertise is still crucial for in-depth analysis and finding vulnerabilities that automated tools may miss.

The industry is currently in the sixth or seventh generation of hackers, with increased access to education and tools, but also more complex environments to test.

Joe Brinkley is actively involved in the Mentor Village, offering mentoring, education, and resources to those interested in cybersecurity.

He encourages individuals to build their own cybersecurity brand and consider starting their own cybersecurity company, emphasizing the importance of branding and networking in the industry.

Sound Bites
"I don't care who you go to, learn something."

"Long-term security is the value we provide"

"People are looking for a budget-friendly alternative because compliance and insurance now require yearly security activities."

Resources
https://www.linkedin.com/in/brinkleyjoseph/
https://x.com/TheBlindHacker
https://x.com/deadpixelsec
https://deadpixelsec.com/

Chapters

00:00 Introduction and Background
06:24 Advice for Breaking into Offensive Security
10:39 The Commoditization of Pentesting
15:53 The Impact of Compliance and Cyber Insurance
22:03 Challenges Faced by Practitioners in Limited Time Windows
25:33 The Evolution of Hackers and Accessibility of Education and Tools
30:36 The Role of Automation, Orchestration, and AI in Modern Pentesting
36:23 Building Cybersecurity Brands and the Mentor Village
41:14 Conclusion
41:52 Phillip Wylie Show Outro Video.mp4
43 min
August 29, 2024Live from BSides Twin Cities 2024
Summary

In this live episode of The Phillip Wylie Show, cybersecurity experts Ira Winkler and Ryan Cloutier discuss their hacker origin stories and the evolution of hacking over the years. They emphasize the importance of basic cyber hygiene and the need to systematize the fundamentals of cybersecurity. They also discuss the risks and benefits of AI, highlighting the potential for manipulation and the need for safe adoption. The conversation touches on the role of policies and procedures, the alignment of cybersecurity with business objectives, and the impact of technology on human experiences.

Takeaways
Basic cyber hygiene is essential in preventing hacking and improving cybersecurity.

AI is ready for prime time, but organizations need to ensure safe adoption and consider the potential risks and impacts.

Systematizing the fundamentals of cybersecurity and aligning it with business objectives is crucial for effective cybersecurity programs.

Technology should be designed with people in mind, considering their experiences and needs.

Understanding the risks and benefits of new technologies, such as AI, is important for making informed decisions and designing resilient systems.

Quotes
"All I did my whole career is primarily take advantage of bad awareness, bad administration, bad configurations."

"We're gonna have an overabundance of tooling and an underabundance of looking at the business processes themselves."

"Your users are a company resource that are gonna be fallible, just like any other resource you have."

Resources
https://www.linkedin.com/in/irawinkler/
https://www.linkedin.com/in/ryan-cloutier/
https://cruisecon.com/

Chapters
00:00 Introduction and Hacker Origin Stories
05:39 The Evolution of Hacking and Basic Cyber Hygiene
08:03 Threat Landscape and Shifting Attack Profiles
10:18 The Impact of Social Media and Bring Your Own Device
18:05 Systematizing the Basics and Enforcing Policies
23:35 Aligning Cybersecurity with the Business and Employee Experience
26:01 AI: Readiness and Safe Adoption
32:13 Understanding AI as Math and the Potential Risks
34:48 Personal Intimate Information and the Weaponization of AI
36 min
August 27, 2024Dahvid Schloss: From JSOC to Offensive Security
Summary

David Schloss shares his hacker origin story, starting with his military background and how he ended up in the field of cybersecurity. He talks about his time in the Joint Special Operations Command (JSOC) and the unique missions he was involved in. He also discusses his transition to the private sector and his current role as a Hive Leader at Covert Swarm. The skills he acquired in JSOC have been highly transferable and valuable in his offensive security career. In this conversation, Dahvid Schloss discusses his experience at Seer, a practice prison camp that taught him transferable skills like lock picking and prison escape. He also talks about the challenges of transitioning from using malware and exploits to using his brain in the civilian world. Dahvid emphasizes the importance of finding your passion within offensive security and recommends exploring different areas to figure out what you enjoy. He also highlights the significance of building a personal brand in the cybersecurity field and encourages professionals to be more public about their skills and expertise.

Takeaways
David Schloss has a military background and served in the Joint Special Operations Command (JSOC), where he was involved in unique and high-value missions.
He transitioned to the private sector and currently works as a Hive Leader at Covert Swarm, focusing on continuous APT emulation.
The skills he acquired in JSOC, such as threat emulation, malware development, and exploit development, have been highly transferable and valuable in his offensive security career.
David emphasizes the importance of privacy and cybersecurity as basic human rights and aims to grow the field by helping individuals with no experience enter the industry and supporting specialization for those already in the field. Seer, a practice prison camp, taught Dahvid Schloss transferable skills like lock picking and prison escape, which he found helpful in the cybersecurity field.
Transitioning from using malware and exploits to using his brain in the civilian world was challenging for Dahvid.
Dahvid recommends exploring different areas within offensive security to find your passion and avoid pigeonholing yourself into a specific role.
Building a personal brand is crucial in the cybersecurity field to showcase your skills and expertise.
Dahvid encourages professionals to be more public about their personal brand and expertise to increase job opportunities and career growth.

Quotes

"I got through this course, I graduated, and I got to do the fun job of being a special operations communicator."
"Seer was amazing. So Seer is like practice prison camp, right? Which sounds why would that be amazing to cyber? And the reason is, is because they teach you some transferable skills, like how to pick locks and how to escape from prisons."
"Having access to really good malware, really good exploits was not at all. It sounds like it would be really helpful, but it was a hard transfer for me, especially because I'm so used to being able to go dot slash execute. And now I'm on a box and now I have to go, Oh, I have to use my brain."
"Offensive security is massive. It's like, there is no way you can be a master of all. Like there is only one and that's John Hammond so far. That's all I've seen. He's, know, he's got, he's got the chops, but we can't all be him. Right. So, um, really like my biggest recommendation."

Resources
https://www.linkedin.com/in/dahvidschloss/
https://x.com/DahvidSchloss

Chapters

00:00 Introduction and Background
02:36 Military to Cybersecurity Transition
08:41 Learning Cybersecurity Skills
17:34 JSOC and Fighting High-Value Targets
26:34 Transferable Skills and Challenges in Offensive Security
29:55 Exploring Different Areas in Offensive Security
39:04 The Importance of Building a Personal Brand
46:41 Opportunities for Growth in Smaller Cybersecurity Startups
49:49 Taking the Time to Find Your Path in Cybersecurity
52 min

About Phillip Wylie Show

From the publisher's feed

The Phillip Wylie Show is a premier cybersecurity podcast and media source for offensive security professionals. Hosted by Phillip Wylie, globally recognized ethical hacking expert, keynote speaker,…