Security Unlocked

Do you have a data science or engineering background? If so, you're in luck. If not, you're also in luck because today's guest found a way to make a few complex subjects understandable for everyone. The first of many topics... Fuzzy hashing. It might sound like an adorable, adventurous Muppet character, but I promise you the reason behind it is not cute at all. The short explanation is "fighting crime with math," and honestly, the short version is all I've got for you. So, sit back and pay attention to an episode even the hosts plan on listening to twice. 

In this episode of Security Unlocked, hosts Nic Fillingham and Natalia Godyla are joined by Edir Garcia Lazo, a data scientist currently working for the Microsoft Defender Cybersecurity Artificial Intelligence Team. Edir specializes in writing cloud machine learning models for the Malware Classification sub-team, working with threat hunters, reverse engineers, or security researchers. Edir talks us through character changes in malicious payloads, polymorphic malware, and the difference between fuzzing and fuzzy hashing.   

Questions we ask: 

• What inspired the team to look at fuzzy hashing and deep learning as techniques for detection instead of some of the more traditional methods? 
• Is there a limit to how much change the fuzzy hashing methodology can recognize? 
• What are some of the major differences between fuzzing and fuzzy hashing? 

What you’ll learn: 

• Why fuzzy hashes aren't a cure-all and continue to have problems with radically new malware. 
• Differences between perceptron and a multilayer perceptron. 
• The compatibility between deep learning and fuzzy hashing. 

Resources:  

Combing through the fuzz: Using fuzzy hashing and deep learning to counter malware detection evasion techniques 

View Edir on LinkedIn

View Nic’s LinkedIn

View Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Juan Hardoy leads an international team of investigators, analysts, and lawyers inside the Digital Crimes Unit who share a joint mission to protect customers and promote trust in Microsoft technologies. Hearing that might take your imagination to a place where Juan is deputized to fight crime in digital space, and you wouldn't be completely wrong. Still, unfortunately, he's not sitting at his desk with a sheriff's badge and a cowboy hat. It's not as simple as the days in the west, where you can challenge someone to a duel because of a simple "Pop Up" and claim victory with a glass of whiskey, moving on to the next town with problems. Because in every organization, there's at least one person that will click on anything. These issues will continue to grow and evolve in a world where international and national law enforcement are needed, along with a team of investigators creating what some would call the "secret sauce" for tackling cybercrime.  

In this episode of Security Unlocked, hosts Natalia Godyla and Nic Fillingham are joined by Juan Hardoy, an assistant general counsel with the DCU, to discuss his partnership with governments, elected officials, and policymakers. Juan explains the proactive action against cybercriminals trying to hurt our customers, why people aren't going to use our technology or the internet if they don't trust it, and how they bring them to justice in the form of criminal referrals with civil actions.  

In this episode you will learn: 

• How Juan earned the role of assistant general counsel 
• What new services and technology criminals are using  
• Why education is the best defense against cybercrime and tech scams 

Some questions we ask: 

• Are there any tactics that Microsoft tried in the past that didn't successfully stop the tech support scammers? 
• What is the mission of the digital crimes unit and how do they partner with government and elected officials?  
• Why do tech support scammers seem to target consumers and individuals instead of enterprises and organizations? 

Resources: 

Visit Juan Hardoy on LinkedIn 

Visit Natalia on LinkedIn 

Visit Nic on LinkedIn 

Visit Microsoft Security Blog 

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Have you ever thought about a career in threat intelligence or cyber security? Possibly finishing school with a degree in computer programming and feel overwhelmed with what to do next? Don't worry; we've all experienced this. Maybe not specifically with computer programming, but the figuring it out aspect. You could be ending active military service and working in cyber operations, helping offensive and defensive cyberspace operations, wondering about the next step. The thought of making the transition from military to private industry can be exciting but also nerve-racking. The good news is that there are many different roads to travel, and with the experience and education you've obtained, you'll most likely have more options than you could have ever imagined.

In this episode of Security Unlocked, host Natalia Godyla is joined by Senior Threat Intelligence Analyst Justin Underwood, an army veteran with the personality and charm to calm your nerves. Currently working for a group known as OPTIC, the Operational Threat Intelligence Center at Microsoft, Justin and Natalia discuss his time at Bank of America and Xbox. He explains how it gave him a better understanding of cybersecurity, how he obtained the title of Human Intelligence Collector, and what helped him transition from the army into the world of threat intelligence and cyber security. 

In This Episode You Will Learn:   

• How to find your place in the world of cybersecurity 
• The challenges faced when making the transition from military to private industry
• What the role of a Human Intelligence Collector is

Some Questions We Ask:   

• How does military experience help you succeed in the private industry?   
• What military tools are used and overlap in the private sector?  
• What are some big projects currently being worked on?  

Resources:  

View Justin Underwood on LinkedIn

View Nic on LinkedIn 

View Natalia on LinkedIn 

Visit Microsoft Security Blog 

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

It's finally Friday. You successfully made it through another week and the weekend is so close you can taste it. You pour yourself a bowl of your favorite cereal, but before you can get that first bite your phone rings. It's a random number, but for some reason you're feeling chatty and decide to answer. Unfortunately, it's a robot that somehow knows your name and is asking for your social security number, home address, and password from that first AOL account you made in 1998!  It’s easy to recognize classic scams like these, but some of the newer, creative scams can be more challenging to identify.  One of these is called BazaCall, and they don’t call you – oh, no.  BazaCall will have YOU calling THEM! 

In this episode of Security Unlocked, host Natalia Godyla is re-joined by Microsoft Threat Analysts Emily Hacker and Justin Carroll to talk about a relatively new delivery method for malware and ransomware called BazaCall campaigns. They discuss the different delivery methods used, how attackers evade detection, and where the attack chain begins.     

In This Episode You Will Learn:   

• What makes BazaCall campaigns unique from other email/phone scams 
• How the delivery system works 
• About a new technique called “double extorsion”  

Some Questions We Ask:   

• What is the flow of the attack chain? 
• What are some new tactics used by BazaCall centers? 
• How can organizations mitigate attacks? 

Resources:  

BazaCall: Phony call centers lead to exfiltration and ransomware 

View Emily on LinkedIn 

View Justin on LinkedIn 

View Natalia on LinkedIn 

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Picture this: you’re working on a new software that will revolutionize your industry. You’ve got your work cut out for you, from design to programming to integration. But what about security? Keeping your software secure should be in the conversation from day one, but not all developers are well-versed in application security. The good news is that you’re not alone, and even if this picture that we’ve painted isn’t of you, there are still very accessible ways to learn about application security and information security. One of these ways is We Hack Purple, created by a Microsoft alumnus.  

In this episode of Security Unlocked, hosts Natalia Godyla and Nic Fillingham are joined by the founder of We Hack Purple and former Microsoft Senior Cloud Advocate, Tanya Janca, to discuss her company, trainings, and why it’s so important to keep up with the newest movements in the world of security. Before founding her company, Tanya found herself red-teaming and blue-teaming, and declared herself in the world of Purple. She brings us into that world, breaks down app-sec framework, and even gives a few sci-fi book recommendations.  

In This Episode You Will Learn:   

• How to keep up with new practices for security professionals 
• The frame work for application security 
• How to work with and communicate effectively with software developers 

Some Questions We Ask:   

• How do we bridge the gap between developers and the security world? 
• What are the pros and cons of threat modeling? 
• Who should get involved in application security?  

Resources:  

We Hack Purple 

View Tanya on LinkedIn 

View Natalia on LinkedIn 

View Nic on LinkedIn 

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Electricity is all around us. In fact, you’re using it to read this right now. It powers (no pun intended) our everyday lives, and it works without us having to think about it. It’s kind of like breathing. I mean, you don’t have to tell your lungs “Hey! Start breathing right now!” But just like with breathing, the problems that can follow an interruption of electricity can be deadly. It shouldn’t be shocking (pun intended) that keeping power grids secure is an international priority.

In this episode of Security Unlocked, hosts Natalia Godyla and Nic Fillingham are joined by Microsoft’s Chief Security Advisor, Hafid Elabdellaoui, to talk about making our power grids safe and stable. So much relies on the stability of our power grids, it’s easy to forget how dependent we are. Hafid discusses the growing concerns with supply chain attacks and explains the importance of cyber hygiene at all levels of an organization.

In This Episode You Will Learn: 

• The challenges of bringing new security practices to the old field of utilities
• Where cybersecurity meets physical security when utilities companies are under threats
• Why keeping a software inventory is crucial to your security

Some Questions We Ask: 

• How do current power grid risks and threats compare to concerns 20 years ago?
• How do utilities companies work with the government to prevent large-scale power grid failures?
• How does Microsoft prepare for potential threats, and practice their responses?

Resources:

Defending the power grid against supply chain attacks—Part 1: The risk defined

Defending the power grid against supply chain attacks—Part 2: Securing hardware and software

Defending the power grid against supply chain attacks—Part 3: Risk management strategies for the utilities industry

View Hafid Elabdellaoui on LinkedIn

View Nic on LinkedIn

View Natalia on LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

8 trillion. It’s kind of a big number, right? That’s how many signals are collected, processed, and analyzed by Microsoft’s security team every single day. Those signals are travelling from the cloud, coming through endpoints, coming through Bing, coming through Xbox. All of these signals are turned into intelligence, and if you’re a cloud user, that intelligence is an asset to your security. By making the leap to the cloud, the power, size, and flexibility of Microsoft’s threat intelligence becomes your resource.   

In this episode of Security Unlocked, hosts Nic Fillingham and Natalia Godyla are re-joined by Microsoft’s Chief Security Advisor, Sarah Armstrong-Smith, to dive deeper into the back half of her four-part series on Becoming Resilient. We explore different cloud models, the shared responsibility of your cloud service provider, and the growing risks of insider threats.  

In This Episode You Will Learn:  

• Best practices on switching to the cloud and ensuring utmost security 
• Why you need to adapt to stay ahead of threats 
• How to build security cleanly into your foundation and keep from it being a messy afterthought 

Some Questions We Ask:  

• What do new users gain by moving to the cloud?  
• What errors are organizations making when moving to the cloud? 
• How do we effectively communicate with our security team about business decisions? 

 Resources: 

Becoming resilient by understanding cybersecurity risks: Part 1

Becoming resilient by understanding cybersecurity risks: Part 2

Becoming resilient by understanding cybersecurity risks: Part 3—a security pro’s perspective

Becoming resilient by understanding cybersecurity risks: Part 4—navigating current threats

Cloud Adoption Framework 

View Sarah Armstrong-Smith on LinkedIn

View Natalia on LinkedIn 

View Nic on LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

How likely are you to fall for a scam? Survey Says… depends on your demographic. Scammers are evolving, from cold calls on the phone, to computer desktop pop-ups with nagging alarm sounds, to buying out search terms like “email support.” Tech support scams have become an ever-present threat in our online world with 3 out of 5 people globally experiencing them and 1 out of 6 people actually giving their money or personal information to the scammers. Even though there are some honorable people who do what they can to help prevent others from being scammed, the prevalence of these frauds shows they aren’t going away anytime soon.

On this episode of Security Unlocked, hosts Nic Fillingham and Natalia Godyla chat with Mary Jo Schrade, the Asia Regional Lead for Microsoft’s Digital Crimes Unit, about the most recent Global Tech Support Scam Research. The survey covers over 16,000 people in 16 countries and reveals some insights that will leave some feeling hopeful, and some feeling... a little concerned. It’s a relief to know that scam awareness is on the rise globally; however, the groups most susceptible to giving money to scammers may shock you.

In This Episode You Will Learn:  

• Which regions are being targeted most
• How to help those you think are susceptible
• How to recover your money after you’ve been scammed

Some Questions We Ask:  

• Who is falling for these scams?
• How has the public’s awareness shifted over the past few years?
• Is it ok to pretend to fall for a scam in order to waste a scammer’s time?

Resources:

Global Tech Support Scam Research

Report a scam

Mary Jo Schrade’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Every occupation has its unique jargon that allows professionals to speak their own language and understand each other’s shorthand.  Those of us in the world of cybersecurity are no exception as we frequently toss around acronyms and abbreviations, but how can we cybersecurity professionals communicate all of this crucial ingrained knowledge to people who haven’t the faintest idea about technology, security, or what our conversational shorthand even means?  

In this episode of Security Unlocked, hosts Nic Fillingham and Natalia Godyla speak with Microsoft’s Chief Security Advisor, Sarah Armstrong-Smith, about the most effective ways to communicate high-level security topics with non-security professionals. In order to create a more secure world, it’s paramount that the non-tech savvy are equally informed and protected, and Sarah has some excellent tips in achieving that goal. 

In This Episode You Will Learn: 

• How important it is to define ‘risk’  
• Why it's a mistake to think of cyber protections as a necessary evil in a corporation
• The value of introducing topics by asking questions rather than lecturing 

Some Questions We Ask: 

• Who should be driving security conversations in an organization? 
• How should we introduce cybersecurity concepts non-cybersecurity professionals? 
• What are some tips for complex organizations introducing their teams to cybersecurity concepts? 

Resources: 

Sarah Armstrong-Smith's Blog post part 1

Sarah Armstrong-Smith's Blog post part 2

Sarah Armstrong-Smith's Blog post part 3

Sarah Armstrong-Smith's Blog post part 4

Sarah Armstrong-Smith's LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Ready for a riddle? What do 40 hypothetical high school students and our guest on this episode have in common? Why they can help you understand complex cyber-attack methodology, of course! 

In this episode of Security Unlocked, hosts Nic Fillingham and Natalia Godyla are brought back to school by Principal Security Researcher, Jonathan Bar Or who discusses vulnerabilities in NETGEAR Firmware. During the conversation Jonathan walks through how his team recognized the vulnerabilities and worked with NETGEAR to secure the issue, and helps us understand exactly how the attack worked using an ingenious metaphor.  

In This Episode You Will Learn: 

• How a side-channel attack works 
• Why attackers are moving away from operating systems and towards network equipment 
• Why routers are an easy access point for attacks 

Some Questions We Ask: 

• How do you distinguish an anomaly from an attack? 
• What are the differences between a side-channel attack and an authentication bypass? 
• What can regular users do to protect themselves from similar attacks? 

Resources: 

Jonathan Bar Or’s Blog Post

Jonathan Bar Or’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.