Security Serengeti

In this episode we discuss the Purple Team.  What is it, and why is it David's favorite color?  

Supporting Articles:The Difference Between Red, Blue, and Purple TeamsSANS Purple Team ClassesSCYTHE.io Purple Team Exercise FrameworkPTFM - Purple Team Field Manual

If you found this interesting or useful, please like and subscribe, and follow us @serengetisec for more!

In this episode, we talk .Conf!  David and I attended Splunk .conf remotely and sit down to discuss this years presentations and announcements.  Unfortunately, after we finished recording, we realized we had gone on for an hour, and decided to chop the episode in two.

Here in the second part, we discussed our favorite talks we saw.  Unfortunately there were way too many talks to see all of them, so there are many other worthy talks we don't discuss!

.conf homepage - Hit "Watch" at the top, and select ".conf Online" to watch the talks!

David's Picks:SEC1163A - Proactive Risk Based Alerting for Insider Threats: Matt SnyderSEC1643A - Splunk Security Essentials: An Approach to Industry Threat Detection Engineering - Johan Bjerke, Cynthia Li

Matthew's Picks:SEC1249A - Accenture's Journey to Risk Based Alerting with Splunk Enterprise Security and Beyond: Chip Stearns and Marcus BoydSEC1441A - How We Maintain Our Correlations in Splunk Enterprise Security at Thales UK: Gabriel Vasseur

Honorable Mentions:SEC1162A - Supercharge You Risk Based Alerting Implementation: Teresa ChilaSEC1222A - Security Triage in the Real World.  The Rubber Hits the Road: Trevor Ford, Brendan HigginsSEC1440A - Risk Based Response: Maturing your Security Operations With Risk Awareness and Splunk SOAR: Tom Wise, Hannah Cornford

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we talk .Conf!  David and I attended Splunk .conf remotely and sit down to discuss this years presentations and announcements.  Unfortunately, after we finished recording, we realized we had gone on for an hour, and decided to chop the episode in two.

Here in the first part, we discuss attending remotely, what we love about .conf, and briefly discuss the new announcements.  At least the ones we know something about, unlike the new Dashboard Editor thing.

.conf homepage

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we review what we know about Zero Trust Networking, and the types of products that claim to do it.

 

Original Forrester Report on ZTN  

Google Paper on BeyondCorp

NIST 800-27 - Zero Trust Architecture

Zero Trust, ZTA, and ZTNA: What’s the Difference?

Book I'm currently reading on ZTN - Zero Trust Networks: Building Secure Systems in Untrusted Networks

 

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this week's episode, we discuss Vendor Security Questionnaire's, Ransomware payment disclosure, Why does SIEM still suck, and finally, vulnerability scanning for just ransomware.  

We're trying a slightly new format this week.  Instead of preparing ahead of time, we're doing it ad hoc.  Each of us comes with two articles to discuss, and the other person won't know until right beforehand!

 

Article 1 - What Are Some Red Flags in a Vendor Security Assessment?

 

Article 2 - Ransomware law would require victims to disclose ransom payments within 48 hours

 

Article 3 - Security Correlation Then and Now: A Sad Truth About SIEM

 

Article 4 - Ransomware Risk Assessment Service Aims to Deflect Attacks

 

As always, please subscribe on your favorite podcast app, and rate and review so that other people will come to know and love us as much as our mothers do

In this episode we dive into the 2021 Verizon DBIR at a medium level of depth.  Rather than going through all (100+!) pages in depth, we each reviewed the report and picked out the top 5 most interesting findings.  

 

Report Download (with some information disclosure)

 

As always, the views and opinions shared on the podcast do not reflect the views and opinions of our employers.  

 

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this week's episode, we turn our expert opinion and rapier wit on going password less, subjecting Crypto exchanges to sanctions, and finally the ethics of using stolen data in research.

Article 1 - Microsoft makes a bold move towards a password-less futureSupporting Articles:Microsoft announces passwordless future – available across Microsoft Edge and Microsoft 365 appsModern Authentication vs. Basic Authentication Secure Quick Reliable Login

Article 2 - US cryptocurrency exchange sanctions over ransomware likely not the lastSupporting Articles:Biden Administration Reportedly Plans ‘Sanctions’ to Combat Crypto’s Role in Ransomware Attacks—Whatever That Means

Article 3 - Is it OK to use stolen data? What if it's scientific research in the public interest?Supporting Articles:Estimating the success of re-identifications in incomplete datasets using generative models

As always, please subscribe on your favorite podcast app, and rate and review so that other people will come to know and love us as much as our mothers do

In this episode, we bring Tyler back one more time to discuss AI/ML.  We go back and discuss a previous news story about China stealing all of the info and feeding a ML training algorithm and detections using ML.  

Revisited Article - China's Microsoft Hack May Have Had A Bigger Purpose Than Just Spying

As always, please subscribe on your favorite podcast app, and rate and review so that other people will come to know and love us as much as our mothers do

In this week's episode, we discuss a Defcon talk about using AI to parse open source intel and generate more convincing phishing emails, and how to recruit and retain top cyber talent.

Article 1 - Using AI to Scale Spear PhishingSupporting Articles:Hacking Humans with AI as a Service Presentation

Article 2 - Hacking the Hire: Three Ways to Recruit and Retain Cyber TalentSupporting Articles:Mismanagement Driving Cybersecurity Skills Gap: ResearchCyber Aptitude and Talent Assessment(CATA)

As always, please subscribe on your favorite podcast app, and rate and review so that other people will come to know and love us as much as our mothers do

In this week's episode, we discuss a Defcon talk about using AI to parse open source intel and generate more convincing phishing emails, and how to recruit and retain top cyber talent.

Article 1 - Using AI to Scale Spear PhishingSupporting Articles:Hacking Humans with AI as a Service Presentation

Article 2 - Hacking the Hire: Three Ways to Recruit and Retain Cyber TalentSupporting Articles:Mismanagement Driving Cybersecurity Skills Gap: ResearchCyber Aptitude and Talent Assessment(CATA)

As always, please subscribe on your favorite podcast app, and rate and review so that other people will come to know and love us as much as our mothers do