Normally these Soap Box podcasts – which are wholly sponsored – feature vendors trying to sell you stuff. But this time we’re doing something different: This podcast is an interview with two senior Facebook staffers:

Pedro Canahuati, VP of Engineering

Chris Bream, Security Engineering Director.

Why is facebook’s security engineering group sponsoring a Soap Box episode of Risky Biz? They figure lifting the veil a bit on how things are done over there will be good for them. They’re always hiring, right?

Enjoy!

(A reminder – there will be no weekly show this week or next. The weekly Risky Biz news podcast returns on July 29.)

On this week’s show Patrick and Adam discuss the week’s security news, including:

The latest on the EncroChat hack-related arrests

Details about the fresh F5 and Citrix bugs

Natanz go boom

Paying Wastedlocker ransoms violates Treasury sanctions

North Korea embraces Magecart (lol)

Much, much more…

This week’s show is brought to you by Cmd Security. They make a very useful Linux security agent. Essentially they add an additional layer of control to your Linux systems: you can restrict user actions, even for root.

Instead of having one of their own staff on to the show this week they’ve nominated a customer. HPE is a Cmd user, they actually heard about it on the podcast and wound up buying it. So HPE ITOC engineering lead Adam Cardillo and his colleague Curtis Simpson – the ITOC CISO – will both join us in this week’s sponsor interview to talk about how they’re using the software.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

This edition of the Soap Box podcast is brought to you by Proofpoint.

Today’s guest is Proofpoint’s EVP of Cybersecurity Strategy, Ryan Kalember, and the topic is business email compromise, or BEC.

BEC is a big deal, generating billions of dollars in losses every year across basically all industry verticals and levels of government. Until recently, there haven’t been many technical controls that help to mitigate it.

Trying to get on top of this issue is very much in Ryan Kalember’s job description. BEC is a diabolical problem, and as a company with a specialty in email security, Proofpoint is really expected to help clients get on top of it. In this conversation you’ll hear us talk a bunch about the problem and Proofpoint’s approach to trying to minimise BEC.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Inside the new American “e2ee busting” bill

Julian Assange hit with (another) superseding indictment

Trustwave uncovers sneaky Chinese accounting software backdoor

Much, much more…

This week’s show is brought to you by Okta. They are, of course, the identity and auth giant and one of the few sponsors we actually approached last year for 2020 because, well, they are very good at what they do. This week Marc will be joining us to talk about a privacy-related topic. The discussion is nuanced, but it’s basically about how the public perception of privacy risks has diverged from the reality/ Further, that the COVID-19 crisis and the advent of digital contact tracing apps have actually brought general concerns around digital privacy to the fore.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Australia “under attack” - a wrap

Microsoft releases more security protections for E5 customers

US to introduce “anti encryption” bill

Shady encrypted phone company owned by the cops

NSA to offer filtered DNS services to defence industry

MORE

This week’s sponsor is Kasada. They offer a service that eliminates synthetic/bot traffic from the web. Former Australian Prime Minister Malcolm Turnbull is an investor and has joined Kasada’s board. Kasada’s CEO Pascal Podvin is this week’s sponsor guest.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

This podcast is brought to you by the Cyber Initiative at the Hewlett Foundation. They gave us a grant so we can do these podcast interviews that have relevance to cyber policy, so big thanks to the Cyber Initiative at the Hewlett Foundation for funding this work.

Today we’re chatting with Citizen Lab Senior Researcher John Scott-Railton about the work they did investigating the Indian hacker-for-hire firm BellTrox.

For those of you who didn’t catch the news, The Citizen Lab, which operates out of the Munk School of Global Affairs at the University of Toronto, dropped a huge report a couple of weeks back that lays Belltrox’s operations bare. As you’ll hear this company attempted to hack tens of thousands of email accounts belonging to everyone from government officials to hedge fund managers and activists.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Facebook commissioned custom 0day to de-cloak child sex predator

IP stack bugs to plague IoT, ICS for years

Sandworm was doxxed by the NSA and hardly anyone noticed

Congress demands answers on 2015 Juniper NetScreen back door investigation

Amazon, Microsoft join moratorium on sale of facial recognition to police

Much, much more

This week’s show is brought to you by Signal Sciences. And instead of having one of their staff on the show, they nominated one of their customers to appear instead. So in this week’s sponsored segment we’re going to hear from Keith Hoodlet. Keith is currently the Senior Manager of Application Experience at Thermo Fisher Scientific, a $137 billion company. He built their appsec program and he’ll be along later on to talk through all of that. It’s a rapid-fire interview about how he was able to get started and make a dent quickly. Keith used to co-host the Application Security Weekly podcast and he’s worked for Bugcrowd and Veracode. He’s a cool guy, it’s a great interview, make sure you stick around for that one.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Full scale of Indian hacker-for-hire firm revealed

IBM exits facial recognition

Contact tracing apps flop

Much, much more

This week’s show is brought to you by AttackIQ.

AttackIQ’s Chris Kennedy will be along in this week’s sponsor interview to talk about how for some organisations threat intelligence has moved from a nice-to-have to being central to blue team efforts. As you’ll hear he says MITRE ATT&CK makes threat intel actionable, and some orgs playing on hard mode are really kicking some goals that way.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

The Soap Box podcasts we run here at Risky.Biz are wholly sponsored affairs – everyone you hear in a soap box podcast, paid to be here.

The idea is vendors get to come on to the show and chat about their products, what their stuff does, the thinking behind it, so on and so on.

Today we’re hearing from Justin McCarthy of strongDM.

Essentially strongDM makes a product that provisions secure access to engineers who need to access various back end services.

You can think of them as an identity aware proxy of sorts, but for engineers. So instead of provisioning regular users with access to web applications like a typical identity aware proxy, a strongDM user will use the product to get access to the production database, or to kubernetes, or other services like SSH.

And since the COVID crisis kicked off, business has gone pretty berserk.

On this week’s show Patrick and Adam discuss the week’s security news, including:

NSA warns of Sandworm Exim exploitation

Huawei CFO extradition process to continue

Google TAG implicates Indian hacker-for-hire outfits in espionage

Black lives matter

F–k police brutality

This week’s sponsor interview is with Marco Slaviero of Thinkst Canary. He’ll be talking through a few of the partnerships Thinkst has entered into over the years. He’ll also talk a bit about some new Canary integrations, such as a new one with HD Moore’s Rumble.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.