Security Stories

Today we chat to Chris Leach, senior CISO Advisor at Cisco. From his background as an accountant (which he hated!) to venturing into cybersecurity ("I had to learn to speak in bits and bytes, after only speaking in 1s and 0s"), he has a fascinating story to share. 

Chris also has some brilliant insights into how to be a great leader and role model for your team, and he has some really poignant thoughts on resiliency, bouncing back, and dealing with the fear of failure.

Also in today's episode, Ben shares the highlights of his just-published research on threat landscape trends. The idea behind this work is to shed light on areas where you can quickly have an impact defending your assets, especially if you're dealing with limited security resources. You can read more about this in Ben's blog post.

And finally our 'On this Day' feature takes us back to the movies! In honor of the 25th anniversary of the film Hackers, the team sits down to talk about what that movie got right, and perhaps, not so right, with some surprising reveals.  

We also discuss what our own movies on cybersecurity would look like, if we were each in charge of screenwriting. Personally, we hope Noureen's idea does genuinely get greenlit!

In October, we're doubling our production schedule to release episodes on topics that mean a lot to us, including careers and diversity in cybersecurity, and how to protect your loved ones from disinformation campaigns (or "fake news) online. It would be brilliant if you could subscribe to your podcast feed of choice so that you don't miss any of these exciting episodes.

We almost called this episode "Robocop 4: The future of security law enforcement", but we actually hope that movie happens so we didn't want to jinx it...

But security law is our prime directive today, as on this episode we have an interview with Tanya Forsheit, partner at Frankfurt Kurnit Klein & Selz and co-chair of the firm's privacy & data security group. Tanya is considered one of the world's leading data privacy and security counselors and litigators.

During our chat, we talk about why the United States needs a privacy law at the federal level, similar to what the European Union has done with GDPR. We also talk about what the future holds for data privacy in the next 12-24 months, within the context of COVID-19 and an increasing amount of IoT devices.

Tanya is also highly experienced in data breach incidents, and is often involved in data rescue operations for her clients. So she has some great views on response planning and business continuity.

Before that, Noureen brings us some fascinating stories from her recent mentor and mentee workshop sessions, including how people who were made redundant back in March at the start of lockdown have been able to find new jobs in the cybersecurity industry. We also have a chat about careers and job descriptions, and why perhaps more thought needs to go into some of those descriptions in order to attract more people who are passionate about the industry.

For our "Emerging Threats" section Ben has been doing some very in depth research into the ransomware variant "WastedLocker". He talks about the nuances of this attack and how the bad actors spread across the network to further compromise additional systems until all the key systems are under their control.  You can read more in his blog here.

And finally for "On this Day" our time travel machine takes us back to 2003, and the story of the Blaster worm. For Ben, this was a trial by fire as he had just started work in a threat intelligence company and this was his first project. Hear him relive some not so fond memories!

In a break from our usual format, today I wanted to bring you highlights of some of my favorite interviews with security leaders so far. 

There's a definite theme to the clips I've chosen - it's all about what we can do to help each other. There are ideas here about some of the things that we can do to make sure the cybersecurity industry becomes more accessible in the future, in terms of attracting talent from more places. And there are important discussions on the role of an ally; those who can give up their privilege in order to give others a boost.

In the intro I mention a competition that we're running to give away free copies of Theresa Payton's book 'Manipulated: Inside the Cyber War to hijack elections and distort the truth'. Listen to the question, and send in your answers as a direct message to us on either of the below social networks, by the closing date of 31st August for a chance to win a free copy. Terms and conditions apply.

Link to Cisco Secure on Facebook
Link to Cisco Secure on Twitter

Election security is right up there as one of the most important discussions of our lifetime. To quote fictional president Dr Josiah Bartlet, "Decisions are made by those who show up" and so protecting people's right to show up and be heard, is fundamental. That's what this episode is all about.

We have Matt Olney, Director of Talos Threat intelligence and Interdiction joining us today, to talk about his paper, ‘What to expect when you’re electing’. After the Washington Post first reported in the summer of 2016  on how adversaries had breached servers for one of America’s two major national political parties, Talos initiated what would become a long-running and hands on investigation into election security issues.  This included watching one state plan an election in real-time.

We were able to talk to Matt for about an hour (and we could have talked to him for far longer) and it truly is a fascinating story with many lessons learned, and it’s an important reflection on where America stands now on election security leading into the General Election in only 3 months time.  

Also joining us for the discussion, is Steve Caimi from the Cisco US public sector cybersecurity marketing team. Steve has over 20 years experience in cybersecurity and has an in depth knowledge of industry best practices including the NIST Cybersecurity Framework, the NIST Risk Management Framework, and the MITRE ATTACK framework. During the interview Steve provides many recommendations for security practitioners in the context of election security.

Back in the virtual studio, Ben, Noureen and Hazel discuss their own personal experiences of voting in elections from their different corners of the world.

This is just the start of our election coverage in the run up to November, but in the meantime, here are some resources you may find useful:

• What to expect when you're electing: https://blog.talosintelligence.com/2020/07/what-to-expect-when-youre-electing.html 
• Cybersecurity Solutions for Government: https://www.cisco.com/go/cybergo
• MITRE Election Integrity: https://www.mitre.org/news/focal-points/election-integrity
• CISA #Protect2020: https://www.cisa.gov/protect2020
• NIST Cybersecurity Framework: https://nist/gov/cyberframework 
• Adjusting to Extraordinary Times: Tips from Cybersecurity Leaders Around the World https://www.cisco.com/c/en/us/products/security/extraordinary-times-ebook.html

We're joined this week by Quentyn Taylor, CISO for Canon Europe. Odds are that you might have had your hands on a Canon camera or printer at one point in your life, and if you’ve ever had a security related query about their products in Europe, it’s Quentyn’s team who you would have spoken to. That's because as well as protecting Canon, the cybersecurity team are also customer centric, which is a really interesting story.

Quentyn also talks to Hazel about missing those "in person" meetings and how he's trying to overcome the virtual hurdle. Plus we discuss the skills and qualities that he looks for in his team members, and why firing the CISO immediately after a data breach is rarely the best course of action. We then end our interview as all interviews should: with a spot of cybersecurity cocktail making.

Check out Quentyn's Security Insights video series here: https://www.youtube.com/results?search_query=security+insights

In the non studio studio, Ben and Noureen fill us in on the last couple of weeks of hacker news, including what Cozy Bear have allegedly been up to.

And for 'On this Day' we take the DeLorean back to 2016, to explore the story behind the Mirai botnet. We discuss the chaos that was caused when certain networked devices running Linux were turned into remotely controlled bots that were then used in large-scale network attacks. 

Don't miss our next episode, which is an election special! We'll be welcoming several special guests, to help us discuss where America stands with election security heading into November's general election. 

In this episode we chat to Andy Ellis, who, on the very day we interviewed him, was celebrating his 20th anniversary as the Chief Security Officer for Akamai. We cover many topics - from taking down the "booth babe" culture at RSA, to fighting for more representation and diversity on cyber panels, to how he eliminated the password at his organization and built a Zero Trust network, before that became a thing.  

Andy also shares one of the most interesting Star Wars theories we've ever heard, and has a fascinating take on heroes vs villains, and how the two overlap depending on who's telling the story. He then talks about why he hires librarians and journalists in his security team, and also, exactly how hard it is to train lizards. (The last two topics aren't related, btw!)

You can read Akamai's "State of the Internet" report here: https://www.akamai.com/uk/en/resources/our-thinking/state-of-the-internet-report/

In the studio, Hazel and Ben are joined (virtually) again by Noureen Njoroge. Following the interview with Andy, Noureen talks incredibly passionately about her advocacy roles for women and minorities in cybersecurity, and some of the mentoring work that she does. For anyone who wants to know more about what they can do to give more opportunities for others - don't miss this section.

For our 'Emerging Threats' feature, we cover Ripple20: a set of 19 critical vulnerabilities impacting a TCP/IP software stack, used by wide variety of vendors and installed on millions of systems: enterprise network, consumer devices, but also IIoT. More details can be read about this in our blog: https://blogs.cisco.com/security/ripple20-critical-vulnerabilities-might-be-putting-your-iot-ot-devices-at-risk 

And finally we have our 'On this Day' feature, which is when we jump into the DeLorean and head back in time to explore a significant security event. This time we’re travelling back to 2001 to talk about Sircam, which was a notable worm that spread by email. The series of unfortunate events often started with a couple of lines of text that began ‘I send you this file in order to have your advice’.

If you'd like to know more about the advocacy roles for women and minorites that Noureen is involved in, as well as access a wealth of cybersecurity resources, you can check them out at https://cybersecmentorship.org

This episode of Security Stories is a little different from usual, but for good reason! With the help of some very special guests, we take a comprehensive look back at the Not Petya cyber attack, the Sandworm hackers, and the context behind this act of cyber warfare. 

First to join us is Noureen Njoroge, a senior cybersecurity engineer and threat intelligence analyst at Cisco. Noureen is a passionate advocate for women and minorities in the IT industry, and is the founder of Cisco's global mentoring program, as well as the president of North Carolina Women in Cybersecurity (WiCyS) Affiliate chapter. We learn about Noureen's passion for mentoring, as well as her thoughts on the threat landscape.

Then we're joined by Andy Greenberg, senior cybersecurity investigative journalist for Wired Magazine, and author of the book "Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers". The book tells the true story of the desperate hunt to identify and track an elite team of Russian agents who are bent on digital sabotage. It starts out as a detective story but it soon turns into a disaster story as the truth starts to come to the fore.

Andy also talks to Hazel about how he spent time in Russia and Ukraine, gathering sources, and learning about this new emergence and type of cyber criminal. And he has a fascinating take on how the hacker culture has evolved in recent years.

Finally, we're joined by senior threat analysts from the Cisco Talos team, including Craig Williams, Matt Olny and Mitch Neff.  We chat to them about what happened on the day of the attack (June 27th 2017), the process the investigative team used to find out what was really happening, and what impact the attack has left on the threat landscape and the world at large.

This really is a fascinating episode with some  incredible guests, who each share their insights, experience and advice for the benefit of the wider cybersecurity community.

In this episode we meet Marene Allison, Vice President and Chief Information Security Officer at Johnson & Johnson.  We talk about her life journey, from graduating from West Point Military Academy in the first class to include women, to then becoming a special agent in the FBI in undercover drug and counterterrorism operations, to how she’s built a diverse  cybersecurity team and program at J & J. It's one of Hazel's favourite interviews to record yet. Stand by for the Hollywood script she's writing off the back of it!

For our Threat of the Month, Ben reveals some interesting stats about remote working, and he talks about how cyber criminals' patterns have shifted to pandemic related activities across spam and malicious domains. You can find more details about this at Cisco.com/go/threatofthemonth

And finally for our 'On this Day' feature the DeLorean takes us back to 2004, where we discuss the Cabir worm, said to be the first ever worm to infect mobile phones.

On today's show we have a brilliant interview with a famous, altruistic Irishman who wears cool glasses and has a nice variety of white hats.  

Nope, it's not Bono, but are lucky enough to have Brian Honan as our guest on this episode. We cover a wide variety of topics including the genesis of the Irish Emergency Response Team, his thoughts on why companies get such a bad hounding when they suffer a data breach, running a company and managing a team, and why the cybersecurity industry needs more accountability. 

And finally for our "On This Day" feature, which is when Ben and I jump in the Delorean and visit a significant cybersecurity event in the pasto, we go all romantic, sort of. Because  this month is the 20 year anniversary of a certain worm called "I love you" or the "Love Bug", or indeed the "Love letter for you" - a cyber attack which ended up infecting over 10 million personal Windows computers.   Discover the unique story behind this attack, and the additional part of the story from only a few days ago.

In this episode we meet Masha Sedova, co-founder of Elevate Security, a company which uses data and behavioral analytics to help organizations build a strong security culture.  Masha was recently announced as finalist for the 2020 Innovation Sandbox Award at RSA, which tells you something about how unique and interesting her solution is.  

We also chat about certain challenges that she faced setting her company up, and also what it's like to be a female entrepreneur setting up a business in the cybersecurity industry...let's just say Hazel nearly fell off her chair when Masha told her what happened during one particular investor meeting!

Also in this episode, Ben talks about the resurgence of digital extortion scams, what they tend to include, and what to do about them.

And finally for our "On this Day" feature we’re only going back 3 years this time, but it’s a biggie.  It’s been three years WannaCry, so we revisit the timeline of the attack, how it all unfolded, and the significance the WannaCry attack still has today.

Links to further resources mentioned in the episode: 

Digital extortion scams: https://blogs.cisco.com/security/your-money-or-your-life-digital-extortion-scams

Talos ransomware discussion: https://blog.talosintelligence.com/2019/07/ransomware-extortion-roundtable-government-payments.html

Registration for Cisco Live June 2-3 https://www.ciscolive.com