Risky Business

On this week’s show Patrick Gray, Adam Boileau and Dmitri Alperovitch discuss the week’s security news, including:

Ukraine foils Russian ICS hack

US Government burns someone’s ICS toolkit

China gets all up in India’s energy gridz

The Heroku/Hithub/Travis CI story is very confusing

US DOJ removes GRU malware from Watchguard boxes under Rule 41

North Korea behind $540m crypto hack

Much, much more

This week’s sponsor interview is with Scott Kuffer, co-founder of Nucleus Security, and Jared Semrau of Mandiant. They’ll be joining us to talk about how you can now plug Mandiant data into the Nucleus vulnerability scan aggregator.

Links to everything that we discussed are below and you can follow Patrick, Dmitri or Adam on Twitter if that’s your thing.

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here.

We’ll hear from three vendors in this edition of Snake Oilers:

Kevin Kennedy from Vectra talks about the company’s cloud native detection – it crunches stuff like CloudTrail and AzureAD logs and correlates it with network event information

Paul McCarty from SecureStack on its software composition analysis and “SBOM plus” tool

Google Cloud’s Anton Chuvakin talks about cloud-based SIEMs like Chronicle

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Why Spring4Shell isn’t all hype

How Viasat actually got owned

Russian war crimes likely extend to coercing sysadmis

Why lighter fluid and a box of matches is more effective than cyber in Belarus

Much, much more

This week’s sponsor interview is with Bernard Brantley, Corelight’s Chief Information Security Officer.

Corelight makes a network sensor you can use to plug in to your SIEM, among other things. It’s based on Zeek, the open source network sensor that Corelight maintains. Corelight is absolutely the industry standard for this sort of thing.

And they’ve just become the standard for something else, too: Microsoft Defender for IoT can now accept Corelight feeds. Bernard fills us in on that.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Snake Oilers isn’t our regular weekly podcast, it’s a wholly sponsored series we do at Risky.Biz where vendors come on to the show to pitch their products to you, the Risky Business listener. To be clear – everyone you hear in one of these editions, paid to be here.

We’ll hear from three vendors in this edition of Snake Oilers:

Upskill your testers and developers with PentesterLab for US$20 a month

Manage penetration tests and reporting with AttackForge

How Sysdig can help herd your container cats (vuln management and detection for container environments)

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Some arrests of suspected Lapsus$ members in the UK

Why the Okta incident is probably a fizzer

Four FSB officers indicted over Triton/Trisis malware

Kim Zetter interviewed Intrusion Truth

Australian government to upsize ASD

Wave bye bye to Finfisher

Much, much more

This week’s sponsor interview is with Mike Wiacek from Stairwell.

Stairwell makes a product that catalogues the files in your environment and lets you slice and dice that data. That makes threat hunting pretty easy and Mike is joining the show this week to talk about why organisations of all stripes should be doing threat hunting.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Airlock Digital co-founders Daniel Schell and Dave Cottingham join host Patrick Gray to talk about:

What an effective allowlisting program looks like

Why the third party allowlisting industry failed the first time

What you can achieve with Microsoft tooling versus specialist tools

How much effort is involved to do this right

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Okta’s somewhat awful comms around its LAPSUS$ incident

Inside Microsoft’s brush with the same group

How Elon Musk’s Starlink service is being used to drop bombs on Russian tanks

US, UK governments warn of impending Russian cyberdoom

Much, much more…

This week’s sponsor interview is with Paul Lanzi, co-founder of Remediant. Paul joins the show this week to talk about cyber insurance. It’s a topic that has come up a lot for us lately – ransomware has borderline sunk the current cyber insurance model as payments ballooned and payouts made a lot of insurers adjust premiums to the. But all is not lost – Paul says this blowup means the insurance industry is actually adapting and could wind up being a driver of better security practices.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

Germany issues stark warning to Kaspersky users

Ukraine SATCOM hack keeps getting more interesting

Russia to spin up its own CA, but it’s not what it seems

Why the ransomware threat could get worse, then better

Much, much more

This week’s show is brought to you by Fastly. Kelly Shortridge, Fastly’s Senior Principal Product Technologist, joins the show this week to tell us what modern security actually looks like. Kelly is always fascinating so we were thrilled she was in the sponsor chair this week.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick Gray, Brian Krebs and Adam Boileau discuss the week’s security news, including:

The Contileaks latest

Belarus targeted refugee data. Was it behind the ICRC hack?

How APT41 hacked America’s livestock

SATCOM hack in Ukraine may bode ill for Musk

Much, much more

Material Security’s co-founder Ryan Noon is this week’s sponsor guest. He joins the show to talk about a few things, how the building blocks for a whole new generation of security tooling – like large-scale data crunching tech – is now just available off the shelf. He also talks us through an integration Material has done with a groovy new SOAR platform called Tines.

Links to everything we discussed – and a YouTube demo of Material’s technology – are below.

On this week’s show Patrick Gray, Dmitri Alperovitch and Adam Boileau discuss the week’s security news, including:

We expected a cyberwar but got an information war

People with SDR kits are doing SIGINT in Ukraine

Conti has imploded and it’s hilarious

Much, much more

This week’s show is brought to you by Proofpoint. Sherrod DeGrippo, Proofpoint’s Vice President of Threat Research and Detection is this week’s sponsor guest. She joins us to talk about how there isn’t really any magic advice she can dispense to protect customers from Russian attacks.

There are some show notes below, but they’re not exhaustive.