Risky Business

This isn’t the normal, weekly Risky Business podcast, Soap Box is the wholly sponsored podcast series we do here at Risky.Biz where vendors pay us money to come on to the show and talk about topics that interest them.

Today we’re speaking with Jesse Rothstein, the co-founder and CTO of ExtraHop Networks. ExtraHop is a network security play, but they started off more in the application monitoring and performance space before gradually moving into security over time.

In this interview Jesse talks about network security monitoring, ExtraHop’s history, and what people are using the ExtraHop tech to do during the COVID-19 crisis.

On this week’s show Patrick and Adam discuss the week’s security news, including:

US takes aim at China over vaccine hax

??? takes aim at Iranian port infrastructure over ???

Iran attacks Gilead pharma

Zoom acquires Keybase

Thunderbolt research discussed

US to drop more DPRK malware

Ransomware targets European hospital group

Australian flu vaccine distribution disrupted by ransomware

More!

CMD’s co-founder and CEO Jake King joins us in this week’s sponsor interview to talk about what happened when he came on to the show a couple of months ago to spruik their new freemium offering. There was a stampede! It’s a hit! So he’ll be along to tell us what shook out of that whole process, and also about what he’s seeing people use the CMD product for since the COVID-19 crisis began.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Salt framework 1Day wreaks havoc

Toll Group hit with ransomware attack. Again.

Germans indict APT28 operator

Ransomware a key word in SEC filings

Much, much more!

This week’s show is brought to you by Remediant. They offer software that lets you get privileged accounts under control very quickly. In this week’s sponsor interview we’re chatting with Remediant’s COO Paul Lanzi and Julie Smith, the executive director of the Identity Defined Security Alliance (IDSA). We’ll be talking about what the IDSA actually is and what its goals are.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Snake Oilers isn’t the regular Risky Business podcast, if you’re looking for that just scroll back to one of the numbered episodes in our podcast feed. Snake Oilers is the wholly sponsored podcast series we do here at Risky.Biz where vendors give us money so they can come on to the show and pitch you their sweet, sweet Snake Oil.

In this edition of snake oilers we’ll hear from:

David Cottingham of Airlock Digital pitches the Crowdstrike/Airlock two piece combo meal deal

Marc Rogers of Okta talks passwordless authentication and pitches modern SSO generally

John Emmitt of Kaseya pops in to pitch the VSA endpoint management agent

Links to the vendors are in the show notes. Enjoy!

On this week’s show Patrick and Adam discuss the week’s security news, including:

Spy companies pitch ridiculously invasive approaches to contact tracing

NSO Group busted running c2 boxes in USA according to WhatsApp lawsuit

Australian government releases contact tracing app, no idea if it works

Chinese telcos to get boot from USA

Much, much more

This week’s show is brought to you by Senetas. This week’s sponsor interview is with listener favourite, Senetas CTO Julian Fay. He’ll be along in this week’s show to talk about an open source project Senetas has put together – oqs-engine.

It’s an OpenSSL engine plugin you can go grab right now if you want to play around with Open Quantum Safe encryption algorithms. Senetas didn’t write the algorithms, but they have squeezed them into this handy OpenSSL engine plugin package. Julian drops in to tell us all about that.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

Czechs claim state-backed healthcare sector attack preparation

Pompeo goes full cyber berserker

New iOS exploit chain targets Uyghur diaspora

Zoom 0day for $500k? Tell him he’s dreamin’.

This week’s show is brought to you by Trail of Bits. Dan Guido is this week’s sponsor guest and he’s talking about the future of secure, app-based voting.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Snake Oilers is a wholly sponsored podcast series we do here at Risky.Biz where vendors come on to the show to pitch their wonderful, wonderful, magical snake oil to you, the listeners.

In today’s podcast you’ll hear from:

Kenn White from MongoDB talking about client-side field level encryption

AlphaSOC’s Chris McNab talking about their latest – they’re not just doing DNS analytics anymore

SecureStack are making developer-friendly cloud security, provisioning and visibility tooling

Enjoy!

On this week’s show Patrick and Adam discuss the week’s security news, including:

Details about Apple and Google’s contact tracing API and OS changes

Alex Stamos joins Zoom as outside consultant

More Zoom news

US government weighs China Telecom ban following BGP hijacking

Travelex paid $2.3m to decrypt files in ransomware attack.

This week’s show is brought to you by AttackIQ. They make a breach and attack simulation platform that you can use to figure out which of your security controls are actually working. Carl Wright of AttackIQ will join the show to talk about the new, free online training they’re offering.

If you’re stuck at home like half the planet right now and you’re interested in operationalising MITRE ATT&CK then you can check out AttackIQ academy.

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

On this week’s show Patrick and Adam discuss the week’s security news, including:

ASD launches offensive action against criminals

Bio-tech firms working on COVID-19 targeted by ransomware

Iran targets WHO

Did you hear there’s a security issue with Zoom? You might not have heard. Don’t worry we’ll tell you about it

Much, much more

This week’s show is brought to you by Yubico, makers of the Yubikey devices.

Yubico’s Chief Solutions Officer Jerrod Chong will be along in this week’s sponsor interview to talk through a few things: what is he seeing out there among users? As you’ll hear, he’s seeing what all of us are seeing, a massive rush to enable remote working. Jerrod also us through some new stuff Yubico is planning, from managed credential services through to biometric Yubikeys. Don’t miss it!

You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here.

You can subscribe to our new YouTube channel here.

Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

This podcast is brought to you by the Hewlett Foundation. They provided us with a grant to support us doing some podcasts about cybersecurity issues that touch on policy. Regular listeners would have heard some of these special podcasts already.

Today’s guest is Jennifer Morrell. She’s a partner with Elections Group and is a recognised expert on election audits.

We were originally scheduled to record this interview just a few short weeks ago, but the COVID-19 crisis really hit and we had to postpone. And it’s a good thing we did, too, because the issues facing elections today are substantially different to the issues facing elections even a few weeks ago. The whole world has just shifted.

So, instead of having the usual conversation about risk limiting audits, voting machine and tally/counting infrastructure security, we had this conversation instead. How on earth do you run an election during a pandemic? There’s a tl;dr here – e-voting is still a pipe dream but internet supported vote-by-mail is where things will land.

I hope you enjoy this podcast.