Phillip Wylie Show

About the Guest:

Andy Liverman Anderson is a seasoned professional with a diverse background spanning real estate, Wall Street, and cybersecurity. With nearly a decade dedicated to the field of cybersecurity, Andy brings a wealth of experience and knowledge to the industry. As a history major, he leverages his unique perspective to analyze the intricacies of cybersecurity's geopolitical landscape. Notably, Andy has been pivotal in the development of moving target defense strategies and has pioneered the use of machine learning to estimate cyber risk in the insurance domain. Currently, he serves as a VP of Sales at Uno AI, a company at the forefront of incorporating AI into cybersecurity efforts.

Episode Summary:

This episode of The Phillip Wylie Show delves into the rapidly evolving landscape of cybersecurity, focusing on the integration of automation and AI technologies. Host Phillip Wylie is joined by Andy Liverman Anderson from Uno AI to explore the ways these advancements are transforming the industry. Fascinated by the seismic shift caused by AI tools like Chat GPT, they discuss the implications for cybersecurity professionals, who like superheroes, each have their own origin story.

The conversation begins by highlighting the role of automation in cybersecurity, referencing Jeff Foley's mass reconnaissance script, and moves on to unpack Andy's journey from real estate and Wall Street into the complex world of cybersecurity. The second summary paragraph touches on the significant role AI plays in vulnerability management, acting as a force multiplier for security practitioners, and the potential for Uno AI's copilots to scale and enhance the capabilities of cybersecurity teams. As the episode unfolds, it becomes clear that the integration of AI into cybersecurity is not just a possibility, it's a reality unfolding before us.

Key Takeaways:

Automation and AI are revolutionizing cybersecurity, taking over repetitive and tedious tasks to free up professionals for more complex work.

Andy Liverman Anderson's history in both traditional tech and cybersecurity provides a unique perspective on the use of AI in cybersecurity.

Cyber insurance and understanding post-attack scenarios are critical components in managing cyber risk effectively.

Uno AI's cyber AI copilot assists security professionals by streamlining the process of vulnerability management and producing actionable insights.

As AI democratizes technology, it may lower barriers to entry in cybersecurity and generate better, more creative jobs.

Notable Quotes:

"It's the land of broken toys. You get to look at all these different things."

"Every organization should have cyber insurance. I'm not selling insurance anymore, but I think you're crazy as an organization, even a very small business, it's surprisingly inexpensive."

"What AI is going to do because the very narrow skills that you had are no longer so scarce."

"A bot never gets tired, is always happy to answer them, and as long as they're providing accurate answers."

"When you've seen sort of a democratization of core technologies, that's just the explosive impact it's had across the world."

Resources:

https://www.linkedin.com/in/andyandersoncyber/

https://www.linkedin.com/company/unoai/

https://uno.ai/

About the Guest:

Dakshitaa Babu is a Software Engineer at SquareX, where she is engaged in data engineering and analytics.

She is also the pen behind the engineering blogs written on SquareX's infrastructure and security research. After completing her Bachelor's degree at the National University of Singapore, Dakshitaa joined SquareX, marking her foray into the cybersecurity industry. While new to the field, her enthusiasm for discovering and understanding new concepts has quickly established her as a committed contributor to the evolving sector. Her interests are in Browser Security and consumer education.

Episode Summary:

In this captivating episode of The Phillip Wylie Show, cybersecurity enthusiasts witnessed a deep dive into the cutting-edge realm of in-browser malicious file detection with Dakshitaa Babu. Dakshitaa, showcasing her prowess in the industry, illustrates sophisticated features of her company's flagship cybersecurity product designed to enhance online safety.

Dakshitaa demonstrates the product's ability to detect malicious macros within files, emphasizing the significance of privacy in their detection methods which occur directly within the browser environment. Focusing primarily on Gmail due to its widespread use, she articulates how the product can reveal hidden dangers within office documents and macros. The episode highlights not only the detection of conventional threats but also uncovers tactics like file renaming, VBA purging, and old file format analysis to pinpoint potentially harmful activity.

The conversation shifts towards the efficiency and privacy advantages of in-browser detection. Dakshitaa explains how this approach offers immediate and private threat recognition compared to traditional methods. She confidently positions her company's product as a vital layer of defense, complementing existing antivirus solutions and empowering users with immediate insights into file safety before downloads occur.

Key Takeaways:

In-browser malicious file detection technology offers advanced privacy and fast analysis by scanning files directly within the email client.

Dakshitaa demoed the tech's proficiency in detecting renamed files, large file components, and outdated file formats—all indicative of potential malware.

The product integrates seamlessly with Gmail, providing users with immediate warnings and detailed insights into file contents without downloads.

Unique detection methods allow for identifying suspicious activities such as VBA purging, which can bypass some antivirus solutions.

The browser extension is free and compatible with all chromium-based browsers, encouraging user adoption for an added layer of cybersecurity.

Notable Quotes:

"We are going deeper than what surface level checks do in Gmail, for instance." -Dakshitaa Babu

"We have no idea why you're still using it in 2024." -Dakshitaa Babu

"We are trying to create a product that has never been there before that is truly important for every user." -Dakshitaa Babu

"We can't always take our own sweet time to scan through every single file thoroughly before letting the user use it." -Dakshitaa Babu

"We want to make sure that before you give the file a chance to even penetrate to your local device or to your network… we want to be there first and give you a first line of defense." -Dakshitaa Babu

Resources:

Get your free Chrome plugin: ⁠⁠⁠http://sqrx.io/pw_x⁠⁠⁠

⁠⁠⁠https://www.linkedin.com/company/getsquarex/⁠⁠⁠

⁠⁠⁠https://twitter.com/getsquarex⁠⁠⁠

⁠⁠⁠https://www.instagram.com/getsquarex/

About the Guest:

Michael Jenks, commonly referred to as "Jenks," is an esteemed figure with an extensive background in the Department of Defense (DoD). With a penchant for cybersecurity and a wealth of experience in cyber warfare, Jenks offers a valuable skill set that has been honed in high-stakes environments where precision and accuracy are paramount. Having started his journey in computer science, he quickly developed a fascination with digital code and its impact. Transitioning from dial-up ISPs to L-3 Communications, where he gained clearance for classified work, Jenks eventually founded his own defense contracting company specializing in offensive and defensive cyber operations.

Episode Summary:

In this riveting episode of the Phillip Wylie Show, host Phillip examines the intersection of cybersecurity and defense backgrounds through his conversation with Michael Jenks from Interpris. The dynamic dialogue delves into how professionals from critical sectors, such as the Department of Defense, bring innovative solutions and meaningful perspectives to the cybersecurity industry.

Jenks shares his 'origin story,' which follows a trajectory starting from gaming and IRC administration, leading to a computer science degree and an impressive tenure at various defense-related roles. His story highlights a critical insight: that the best cybersecurity defenses are often forged in the crucible of real-world operations where the cost of failure is immense.

Central to the conversation, Jenks unravels the methodology behind Interpris—a platform designed to contextualize and elevate existing cybersecurity tools through continuous threat exposure management. Leveraging a thorough understanding of threat profiles, Interpris aims to help organizations prioritize potential risks based on industry, operations, and data sensitivity. The platform's philosophy is clear—fortify defenses by optimizing tools that organizations already possess, using informed strategies and continuous monitoring to proactively counter advanced cyber threats.

Key Takeaways:

Cyber professionals with DoD experience bring invaluable expertise to cybersecurity solutions.

Interpris focuses on improving an organization's security posture by providing context and strengthening existing tools.

Assume breach approach and implementing best practices are essential for a robust security posture.

Insider threats are as significant as external threat actors, making holistic security measures necessary.

The emergence of AI in both offensive and defensive cybersecurity tools is rapidly changing the landscape.

Notable Quotes:

"I mean, man, if you have it, background, a clearance, man, there are just a ton of jobs." -Michael Jenks

"From just the digital realm. Gamer growing up. Cut my teeth on hacking back in the day." -Michael Jenks

"You already have enough tools, right. It's really just that optimized configuration, that prioritization, that customization." -Michael Jenks

"It's my job to defend this environment. I have no idea where we're protected, where we're not." -Michael Jenks

"What we're doing is weaving together all of these products, from EDR, from network sensing, to firewall, to your ESM." Michael Jenks

Resources:

https://www.linkedin.com/in/michaeljenks/

https://www.linkedin.com/company/interpres-security/

https://twitter.com/InterpresSec

https://interpressecurity.com/

About the Guest:

Jeswin Mathai is the Chief Architect at SquareX. He leads the team responsible for designing and implementing the Infrastructure. Prior to joining SquareX, He was working as the chief architect at INE. He has published his work at DEFCON China, RootCon, Blackhat Arsenal, and Demo Labs (DEFCON). He has also been a co-trainer in-classroom training conducted at Black Hat Asia, HITB, RootCon, and OWASP NZ Day. He has a Bachelor's degree from IIIT Bhubaneswar. He was the team lead at InfoSec Society IIIT Bhubaneswar in association with CDAC and ISEA, which performed security auditing of government portals and conducted awareness workshops for government institutions. His area of interest includes Cloud Security, Container Security, and Web Application Security.

Episode Summary:

In this riveting episode of the "Philip Wylie Show," listeners are invited to explore the intricate world of cybersecurity with Jeswin Mathai, who returns to discuss the innovative features of Squarex. Designed to bolster online safety, Squarex addresses the challenges individuals face with malicious files, particularly through email and other online communication platforms.

Jeswin demonstrates Squarex's ground-breaking in-browser malicious file detection capability against the backdrop of increasing macro-based cyber threats. These threats often exploit macros within documents to compromise systems, a technique that has persisted in popularity among cybercriminals. Jeswin also touches upon the limitations of traditional antivirus solutions and email client security in detecting such risks.

Key Takeaways:

Squarex's new feature conducts an in-browser analysis of files to promptly detect malicious content, enhancing email client security.

Traditional antivirus programs and email clients often fail to adequately detect or block macros, a common vector for cyber attacks.

Attackers can exploit file type mismatches and employ social engineering tactics to deliver malicious payloads through seemingly benign document files.

Jeswin unveils techniques such as "VBA Stomping" and "VBA Purging" that attackers use to bypass antivirus detection.

Squarex offers solutions to safely convert potential macro-threats into clean or PDF versions within the browser, providing a privacy-centric approach to cybersecurity.

Notable Quotes:

"Anytime you receive a malicious attachment…we are going to do in-browser file analysis." - Jeswin Mathai

"It's kind of interesting because, like going through the OSCP course, one of the payloads they were mentioning during that time, this was back 2012, 2013, was using macros in the payloads." - Phillip Wylie

"Gmail, when it comes to webmail client, has the most amount of market share…72% is just Gmail." - Jeswin Mathai

"So the way mail clients work is, let's say here, we'll consider the example of Gmail…" - Jeswin Mathai

"The sad part about COVID was a lot of things happened that we are not aware of because the sad event of COVID, the deaths…a lot of other attention or other issues were not given that much amount of attention and they never came to the light of the public." - Jeswin Mathai

Resources:

Get your free Chrome plugin: ⁠http://sqrx.io/pw_x⁠

⁠https://www.linkedin.com/company/getsquarex/⁠

⁠https://twitter.com/getsquarex⁠

⁠https://www.instagram.com/getsquarex/

About the Guests:

Kevin Pentecost and Jason Papillon are the dynamic duo behind the engaging podcast Cyber Distortion. They share a strong history of creating content that delves deep into the cybersecurity world, aiming to educate and inform a wide audience about offensive and defensive strategies within the industry. Kevin brings in his expertise in graphic design, while Jason focuses on the content structure and delivery, making them a well-rounded team.

Chris Glanden is the voice behind the Barcode podcast and the newly introduced webcast, Risk Radar. With previous experience in film, Chris steers his podcast to explore the impacts of AI on cybersecurity, aligning with his efforts to create a documentary on the weaponization of AI systems. He recently made strides into entrepreneurship with his company, Barcode Security.

In this episode of the Phillip Wylie Show, we're treated to a rare gathering of cybersecurity enthusiasts who have built a reputation for their captivating content creation. This episode stands out as the first to feature multiple guests, offering a unique blend of perspectives on professional hacking, content creation, and AI's role in cybersecurity.

Episode Summary:

The episode kicks off with a recount of the Lone Star Cyber Circus—a collaboration event that brought together local talent from Dallas and introduced thought-provoking discussions on the ever-evolving Dallas hacker scene and AI's intersection with cybersecurity. The conversation pivots to the art and influence of content creation, as the guests delineate pathways for individuals to kickstart or amplify their cybersecurity careers through effective branding and exposure.

As the dialogue unfolds, it touches upon the individual journeys and collaborative ventures of the guests. Kevin and Jason of Cyber Distortion detail their foray into podcasting, aiming to disseminate cybersecurity knowledge at scale. Chris shares his foray into documentary filmmaking, aiming to shed light on the dark potential of AI if left unchecked. Together, their experiences coalesce into a shared vision that culminates in the announcement of the Cyber Circus Network (CCN)—a unifying initiative set to propel the cybersecurity conversation into new heights.

Key Takeaways:

Notable Quotes:

Resources:

Kevin Pentecost & Jason Popillion: Cyber Distortion Podcast

Chris Glanden: Barcode Podcast

Cyber Circus Network

About the Guest:

Jason Haddix is a seasoned cybersecurity professional with a wealth of experience spanning over two decades in the field. Recognized for his insightful contributions to ethical hacking communities, he's penned informative articles, engaged in content creation, and previously held the title of top hunter at Bugcrowd in 2016. Jason has contributed his expertise to several organizations including HP, where he was part of the Shadow Labs internal pen testing team, and Ubisoft where he served as CISO. He's recently embarked on a new journey with Arcanum Information Security, focusing on red teaming, training, and consulting services.

Episode Summary:

In this episode, host Phillip Wylie sits down with cybersecurity expert Jason Haddix to explore the ever-evolving realm of cybersecurity. As a beacon of knowledge, Jason delves into his career trajectory, from learning the ropes in clandestine online forums to ascending the ranks as a top bug bounty hunter and, ultimately, leading as a CISO. This conversation ventures through the corridors of Jason's illustrious journey, offering vital insights into not just his past accomplishments but his current endeavors in the wide world of cybersecurity.

The discussion pivots to the frontiers of AI's application in security, where Jason unveils his work in leveraging AI for practical defense measures and his innovative teaching methods. They explore the implications of AI on future cybersecurity roles, debunk myths around job displacement, and share resources for those keen on sharpening their hacking prowess. Emphasizing the imperative for continuous learning and adaptation, Jason's narrative is a treasure trove of guidance for professionals navigating the cybersecurity landscape.

Key Takeaways:

Jason Haddix shares how his early involvement in underground web forums sparked his pursuit of cybersecurity, leading to a diverse career in pen testing, bug bounties, and CISO roles.

AI's integration into cybersecurity is highlighted as a pivotal game-changer, with practical use cases ranging from building defensive solutions to enhancing security programs.

Haddix elucidates how his origins in bug bounty hunting enriched his capabilities during his recent tenure in red teaming more than the other way around.

The conversation dives into the emerging skill set of natural language hacking and the importance of prompt engineering for security practitioners.

Jason's new company, Arcanum Information Security, focuses on delivering specialized training and consulting in modern application analysis, reconnaissance, and security leadership.

Notable Quotes:

“It's like having a colleague next to you to ask dumb pen test questions to when you don't know how some technology works and that's how I treat the [AI] bot.” - Jason Haddix

“Who needs DA when you have the entire data lake of a company already downloaded into an app that you broke into because it had a local file include, that feels like 1995 or something like that.” - Jason Haddix

“I think defenders will run with this thing [AI] and be better than ever.” - Jason Haddix

Resources:

Jason Haddix on X(formerly Twitter): @Jhaddix

Jason Haddix on LinkedIn: https://www.linkedin.com/in/jhaddix/

Arcanum Information Security: https://arcanum-sec.com/

About the Guest:

Bryson Bort is a recognized information security expert, founder, and entrepreneur with extensive experience in the cybersecurity field. Bryson is the founder and CEO of Scythe, a cybersecurity company known for creating a platform that enables security teams to build and emulate real-world adversarial campaigns in a safe manner. He has a rich background, having grown up in Germany and the Soviet Union, and served at West Point and as an officer in the Army and Signal Corps. Bryson is also known for his work in defense and intelligence, and he's a prominent figure for his contributions to the information security community. Additionally, he co-founded a nonprofit called the ICS Village dedicated to education and advocacy for critical infrastructure security.

In this thought-provoking episode of "The Philip Wylie Show," the host Phillip Wylie dives into an in-depth conversation with cybersecurity maven Bryson Bort. The audience is welcomed into Bryson's world of entrepreneurship and cybersecurity innovation, with particular emphasis on his journey from military service to founding cutting-edge cybersecurity ventures.

Bryson's impactful narrative charts his transition from his startup Scythe's initial product offering—a platform for creating custom, scalable cyberattack simulations—to driving the cybersecurity industry forward with accessible automated defenses. Bryson shares insights into the psychological barriers in information security, the evolution of cyber threats, and the critical role of post-access attack strategies. Furthermore, the episode shines a light on the operational technology (OT) space, underscoring the pressing need for robust cybersecurity measures amidst crucial infrastructures and the inherent risks of physical harm.

Socials and Resources:

https://www.linkedin.com/in/brysonbort/
https://www.linkedin.com/company/scythe_io/
https://www.linkedin.com/company/icsvillage/
https://twitter.com/brysonbort
https://twitter.com/scythe_io
https://twitter.com/ICS_Village
https://scythe.io/

About the Guest:

Phillip Wylie is a seasoned professional in the cybersecurity field, recognized for his expertise in offensive security and personal branding. With a career marked by actively sharing his insights at conferences like DEF CON, Phillip engages deeply with the community to foster networking and personal growth. As a speaker and advocate, he guides others in diversifying their connections and professional presence, promoting an integrated approach to in-person and online networking.

In this insightful episode featuring Phillip Wylie, listeners gain essential advice on networking and personal branding sculpted from Wylie's rich experience in the cybersecurity industry. Known for his practical guidance and successful engagement strategies with the community, Wylie unpacks the synergistic relationship between virtual and real-world interactions, offering a valuable roadmap for career growth and visibility.

Philip emphasizes the power of diversification in networking efforts, both online and offline. Encouraging professionals to attend various conferences and engage with individuals outside their usual circles, Wylie's approach is about expanding personal networks and opportunities in unexpected places. With a focus on cybersecurity events and how to leverage them for greater impact, he offers unique tips that promise to enrich one's personal brand and career path.

Resources:

Episode Summary:Key Takeaways:Notable Quotes:Resources:

About The Guest:

Andy Thompson, also known as Rainmaker, is a cybersecurity professional and a research evangelist at CyberArk. With over 20 years of experience in the industry, Andy has a background in systems administration and website design. He is an active member of the cybersecurity community and is heavily involved in the Dallas Hackers Association (DHA), where he serves as the MC and co-organizer of the monthly meetups. Andy is passionate about mentoring and helping others get started in the industry.

Summary:

In this episode, Phillip Wylie interviews Andy Thompson, a cybersecurity professional and research evangelist at CyberArk. They discuss Andy's journey into the industry, the importance of community, and the role of public speaking in cybersecurity. Andy shares his experience with Dallas Hackers Association (DHA) and how it has helped launch many speaking careers in the cybersecurity field. He also provides valuable advice for those looking to get started in cybersecurity and emphasizes the significance of networking and being part of a community.

Key Takeaways:

Quotes:

Socials and Resources:

https://twitter.com/Andy_Thompson

https://www.linkedin.com/in/andythompsoninfosec/