Risky Business

In this (wholly sponsored) edition of the Snake Oilers podcast, three vendors will drop by to pitch their sweet, sweet snake oil:

Gravwell pitches its “structure on read” approach to SIEM

Plextrac describes its red team/pentest reporting platform

ITProTV’s Don Pezet talks about trends in online training

On this week’s show Patrick and Adam discuss the week’s security news, including:

US DoJ unseals indictments against Sandworm operators

Twitter backtracks on “hacked materials” policy

No consensus on Trickbot c2 status

NSA publishes “most exploited” listicle that’s actually interesting

Much, much more

Cmd Security is this week’s sponsor. Its CEO Jake King and CTO Mike Sample join the show this week to talk though a new remote access tech release from Hashicorp called Boundary and what it might mean for Linux system observability in your environment.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Yep, it was Cyber Command

Also Microsoft, Symantec, Lumen and others

Norwegian parliament hack pinned on Russia

We finally talk about “ethics in OST”

More

Netflix senior security engineer Scott Behrens also joins the show this week. This week’s episode if brought to you by Signal Sciences – which is now a part of Fastly – and they suggested we talk to Scott for their sponsor slot this week. So, Scott joins the show to talk through how Netflix handles appsec.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

In this (wholly sponsored) edition of the Snake Oilers podcast, three vendors will drop by to pitch their sweet, sweet snake oil:

Vaughan Shanks pitches the Cydarm SOC incident management platform

Adrian Kitto introduces Detexian, a platform that audits SaaS accounts

Eric Skinner from Trend Micro talks about XDR

On this week’s show Patrick and Adam discuss the week’s security news, including:

The UHS ransomware attack

Someone is messing with TrickBot: Did the USA release the hounds?

US Treasury issues final warning on sanctioned ransomware crews

Azerbaijan and Armenia going at it

Fancy Bear owns US government department

Nucleus Security co-founder Scott Kuffer joins the show in this week’s sponsor interview to talk about how they have discovered a LOT of enterprises are actually trying to develop in-house vulnerability management software and how that is not going well.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

This edition of the show is brought to you with the assistance the Hewlett Foundation, which awarded us a grant so we could do these policy-focussed podcasts.

Malcolm Bligh Turnbull served as a member of Parliament from 2004 until 2018, and as Prime Minister from September 2015 until August 2018. But he has been a public figure in Australia for decades. He’s an Oxford-educated lawyer who studied there under a Rhodes scholarship, he’s worked as a journalist, as the personal lawyer to Australian media baron Kerry Packer and was a leader of the ultimately unsuccessful campaign to make Australia a republic in the 1990s.

He can also list a number of achievements in the business world. In 1994 he invested half a million dollars into Australian ISP Ozemail, selling his stake to Worldcom in 1999 for $57m.

As you’ll hear, now he’s returned to private life Turnbull is investing in technology again. He joined the show to talk about cybersecurity in government, Huawei, the 2016 hack-and-leak operation against the DNC – which took place while he was PM – and more.

As regular listeners know, these Soap Box podcasts are wholly sponsored. That means everyone you hear in a Soap Box podcast, paid to be here. But that’s ok, because we manage to book very interesting guests into these things, like today’s guest, Sami Laine.

Officially he’s Okta’s director of technology strategy – but informally he describes his role as being more like a principal security architect.

He joins us to talk about identity as the new perimeter and the massive leap we’ve towards a zero trust future through 2020.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Russia, China, Iran having a red hot go at US political orgs

Crowdstrike drops report, telcos having a bad time

MSS owning US government with dumb bugs

DoJ indicts Iranian script kiddie because reasons

Proposed TikTok-Oracle deal barely makes sense

The mother of all Microsoft auth bugs, wow

Much, much more…

This week’s show is brought to you by Senetas. And we’ve got two sponsor guests for you this week: Senetas CTO Julian Fay will join us, as will Peter Farrely of AUCloud. Senetas uses AUCloud as a partner for its Suredrop file sharing and collaboration platform here in Oz, and Pete is joining us this week to talk through the new Cloud Assessment and Authorisation Framework published by the ACSC. If you work in Australian government IT and security, this one’s for you!

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Why integrity and availability are key to developing a COVID vaccine

China closing the “cyber gap” with USA

ASPI publishes research on TikTok, WeChat censorship

Belarusian “news app” was tracking activists

Julian Assange back in court to fight extradition

Much, much more

This week’s show is brought to you by Proofpoint, and this week’s sponsor guest is Proofpoint’s senior director of threat research Sherrod DeGrippo. She’ll be telling us about the emergence of some new mid-tier ransomware crews that are targeting people who speak Russian, which is kind of unusual.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

This is a sponsored podcast.

Today we’re chatting with a very special guest, Haroon Meer.

Haroon is the founder of Thinkst Canary. Some call it a deception company, but he doesn’t, as you’ll hear. He says Canary is a detection company and the distinction is important.

In this interview we talk about where Canary came from and recap the last 20 years of Haroon’s security career. We go all the way back to his Sensepost days in 2001, right through to him working for actual royalty in Doha, with a brief detour through him creating an anonymous whistleblower platform for a major broadcaster. You may have heard of Haroon and not known why.

This podcast explains why.