How does that old saying go? Keep your friends close and keep your understanding of a threat actor’s underlying behavior and functionality of tradecraft closer? As new tools are developed and implemented for individuals and businesses to protect themselves, wouldn’t it be great to see how they hold up against different attacks without actually having to wait for an attack to happen? Microsoft’s new open-source tool, Simuland, allows users to simulate attacks on their own infrastructure to see where their own weaknesses lie.  

In this episode of Security Unlocked, hosts Natalia Godyla and Nic Fillingham sit down with Roberto Rodriguez, Principle Threat Researcher for the Microsoft Threat Intelligence Center (MSTIC) and Simuland’s developer, to understand how the project came to life, and what users can expect as they use it.  

In This Episode You Will Learn:  

• How community involvement will help Simuland grow 
• How individuals can use Simuland to see examples of actions threat actors can take against their infrastructure 
• What other projects and libraries went into Simuland’s development 

Some Questions We Ask:  

• What exactly is being simulated in Simuland? 
• What do does Roberto hope for users to take away from Simuland? 
• What is next for the Simuland project? 

Resources:  

Roberto Rodriguez’s LinkedIn

Roberto’s blog post, SimuLand: Understand adversary tradecraft and improve detection strategies

Roberto’s Twitter: Cyb3rWard0g

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

We’ve all had a family dinner, Netflix binge, or otherwise relaxing moment ruined by a telemarketer trying to sell you something you didn't need – a magazine subscription, insurance, you name it! But recently, people have been getting calls that are much more sinister in nature; people claiming to be employees of Microsoft, or Apple, or Amazon, have been calling unsuspecting victims and urging them to pay the caller in exchange for cleaning their computer of viruses. Viruses that don’t exist. None of these people work for the companies they claim to, but rather are a small cog in a larger machine working to defraud the public. 

On this episode of Security Unlocked, hosts Natalia Godyla and Nic Fillingham kick off a three-episode arc discussing tech support scams. To get started, they speak with Anup B Kumar, Microsoft’s Digital Crime Unit’s Asia lead of investigation and analytics, to get a better sense of who is behind these scams, what their motivations are, and some ideas on how to stop them.  

In This Episode You Will Learn:  

• Who these scammers target and why 
• How the scammers trick victims into trusting them.  
• Why working with law enforcement is crucial to stopping the problem 

Some Questions We Ask:  

• Do the scammers know that they are scamming?  
• How pervasive is this scam? 
• Can we stop the scam by helping to facilitate legitimate employment? 

Resources:  

Anup Kumar’s LinkedIn

Microsoft Report a Scam

Microsoft Security Services

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network.  

Hosted on Acast. See acast.com/privacy for more information.

We’re formally sending out a petition to change the phrase “Jack of all trades” to “Hyrum of all trades” in honor of this episode’s guest, Hyrum Anderson. In this episode, hosts Natalia Godyla and Nic Fillingham sit down with Hyrum Anderson who, when he’s not fulfilling his duties as the Principal Architect of the Azure Trustworthy ML group, spends his time playing accordions, making cheese, and founding impressive technology conferences. He does it all!  

Rather than chatting with Hyrum about a specific capability that he’s helped to develop, or a blog post that he co-authored – because, believe us, the episode would last for hours – we decided to have a chat with him about his life, how he first got into the world of technology, and his thoughts on the current state of cyber security.  

In This Episode You Will Learn:  

• The differences between a risk and a threat 
• Why it’s easier to attack than defend 
• What a Principal Architect of the Azure Trustworthy ML group does in his spare time 

Some Questions We Ask:  

• How does Hyrum think about adversarial machine learning and protecting A.I. systems? 
• What is it like for Hyrum to oversee both the red teaming and defensive side of operations? 
• Why are we better at finding holes in security than we are at making sure they don’t exist in the first place? 

Resources:  

Hyrum Anderson’s LinkedIn

Hyrum Anderson’s Twitter

Conference on Applied Machine Learning in Information Security (CAMLIS)

Machine Learning Security Evasion Competition

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

It’s an all out offensive on today’s episode while we talk about how the best defense is a good offense. But before we plan our attack, we need to know our vulnerabilities, and that’s where our guest comes in.  

On this episode, hosts Nic Fillingham and Natalia Godyla are joined by Will Pearce, who discusses his role as AI Red Team Lead from the Azure Trustworthy ML Group and how he works to find weaknesses in security infrastructure to better develop ways to prevent against attacks.  

In This Episode You Will Learn:  

• The three main functions of counterfeit  
• Why the best defense is a good offense 
• Why Will and his team aren’t worried about showing their hand by releasing this software as open source  

Some Questions We Ask:  

• What previously developed infrastructure was the counterfeit tool built upon? 
• How AI red teaming differs from traditional specops red teaming 
• How did the counterfeit project evolve from conception to release? 

Resources:  

Will Pearce’s LinkedIn

AI security risk assessment using Counterfit 

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

It’s our 30th episode! And in keeping with the traditional anniversary gift guide, the 30th anniversary means a gift of pearls. So from us to you, dear listener, we’ve got an episode with some pearls of wisdom!  

On today’s episode, hosts Nic Fillingham and Natalia Godyla bring back returning champion, Nazmus Sakib, to take us through the new Security Signals Report. Sakib walks us through why the report was done and then helps us understand the findings and what they mean for security.  

In This Episode You Will Learn: 

• How pervasive firmware is in our everyday lives 
• Why many people were vulnerable to firmware attacks 
• How companies are spending the money they allocate towards digital protection 

Some Questions We Ask: 

• What was the hypothesis going into the Security Signals Report? 
• How do we protect ourselves from vulnerabilities that don’t exist yet? 
• Were any of the findings from the report unexpected? 

Resources 

Nazmus Sakib’s LinkedIn

Security Signals Report

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

On this week’s Security Unlocked we’re featuring for the second and final time, a special crossover episode of our sister-podcast, Security Unlocked: CISO Series with Bret Arsenault.  

Lululemon has been on the forefront of athleisure wear since its founding in 1998, but while many of its customers look at it exclusively as a fashion brand,  at a deeper level this fashion empire is bolstered by a well thought out and maintained digital infrastructure that relies on a hard working team to run it.  

On today’s episode, Microsoft CISO Bret Arsenault sits down with Venki Krishnababu, SVP of Global Technology Services at Lululemon. They discuss the ways in which technology plays into the brand, how Venki lead a seamless transition into the remote work caused by the pandemic, and how he’s using the experiences of the past year to influence future growth in the company. 

In This Episode You Will Learn: 

• Why Venki feels so passionately about leading with empathy 
• Why Venki saw moving to remote work as only the tip of the iceberg; and how he handled what laid below. 
• Specific tools and practices that have lead to Venki’s success 

Some Questions We Ask: 

• What is the biggest lesson learned during the pandemic? 
• How does one facilitate effective management during this time? 
• How does Lululemon view the future of in-person versus remote work? 

Resources: 

Venki Krishnababu’s LinkedIn

Brett Arsenault’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

Threat actors are pesky and, once again, they’re up to no good. A new methodology has schemers compromising online forms where users submit their information like their names, email addresses, and, depending on the type of site, some queries relating to their life. This new method indicates that the attackers have figured out a way around the CAPTCHA’s that have been making us all prove we’re not robots by identifying fire hydrants since 1997. And what’s more, we’re not quite sure how they’ve done it.  

In this episode, hosts Natalia Godyla and Nic Fillingham sit down with Microsoft threat analyst, Emily Hacker, to discuss what’s going on behind the scenes as Microsoft begins to dig into this new threat and sort through how best to stop it.  

In This Episode You Will Learn: 

• Why this attack seems to be more effective against specific professionals. 
• Why this new method of attack has a high rate of success. 
• How to better prepare yourself for this method of attack 

Some Questions We Ask: 

• What is the endgame for these attacks?  
• What are we doing to protect against IceID in these attacks? 
• Are we in need of a more advanced replacement for CAPTCHA? 

Resources: 

Emily Hacker

Investigating a Unique ‘Form’ of Email Delivery for IcedID Malware

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

On this week’s Security Unlocked, we’re pulling a bait and switch! Instead of our regularly scheduled programming, we’re going to be featuring the first episode of our new podcast, Security Unlocked: CISO Series with Bret Arsenault. Each episode is going to feature Microsoft’s CISO Bret Arsenault sitting down with other top techies in Microsoft and other companies in the industry.  

In its inaugural episode – which we’re featuring on this episode – Bret sits down with Mark Russinovich, Chief Technology Officer of Microsoft’s Azure. Mark has a unique perspective on cloud technologies and offers insight into the changes that have occurred over the past few years due to advancing technology and the unique challenges brought about during the coronavirus pandemic. Enjoy this first episode of the new series and remember to subscribe so you catch all the rest that are yet to come.  

In This Episode You Will Learn: 

• The initialism FFUUEE and why it’s important in understanding people’s resistance to adopting newer security capabilities 
• Mark Russinovich’s three points of advice for those looking to become more secure 
• Theories on improving MFA adoption across the board 

Some Questions We Ask: 

• How do we think of cloud security now versus ten years ago? 
• What does a leading engineer think of moving toward a hybrid workforce? 
• How do you find and screen potential new team members in a remote world? 

Resources 

CISO Series with Bret Arsenault

Brett Arsenault’s LinkedIn

Mark Russinovich’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

Remember the good ole days when we spent youthful hours playing hide and seek with our friends in the park? Well it turns out that game of hide and seek isn’t just for humans anymore. Researchers have begun putting A.I. to the test by having it play this favorite childhood game over and over and having the software optimize its strategies through automated reinforcement training.  

In today’s episode, hosts Nic Fillingham and Natalia Godyla speak with Christian Seifert and Joshua Neil about their blog post Gamifying machine learning for stronger security and AI models, and how Microsoft is releasing this new open-sourced code to help it learn and grow.  

In This Episode, You Will Learn:

• What is Microsoft’s CyberBattleSim? 
• What reinforcement learning is and how it is used in training A.I. 
• How the OpenAI Gym allowed for AI to be trained and rewarded for learning  

Some Questions We Ask:

• Is an A.I. threat actor science fiction or an incoming reality? 
• What are the next steps in training the A.I.? 
• Who was the CyberBattleSim created for? 

Resources:

OpenAI Plays Hide and Seek…and Breaks The Game! 🤖 

Gamifying Machine Learning for Stronger Security and AI Models 

Christian Seifert’s LinkedIn

Joshua Neil’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.

Anyone who’s ever watched boxing knows that great reflexes can be the difference between a championship belt and a black eye. The flexing of an opponent’s shoulder, the pivot of their hip - a good boxer will know enough not only to predict and avoid the incoming upper-cut, but will know how to turn the attack back on their opponent.  Microsoft’s newest capabilities in Defender puts cyber attackers in the ring and predicts their next attacks as the fight is happening.

On today’s episode, hosts Nic Fillingham and Natalia Godyla speak with Cole Sodja, Melissa Turcotte, and Justin Carroll (and maybe even a secret, fourth guest!) about their blog post on Microsoft’s Security blog about the new capabilities of using an A.I. to see the attacker’s next move. 

In This Episode, You Will Learn:

• What kind of data is needed for this level of threat detection and prevention? 
• The crucial nature of probabilistic graphical modeling in this process 
• The synergistic relationship between the automated capabilities and the human analyst 

Some Questions We Ask:

• What kind of modeling is used and why? 
• What does the feedback loop between program and analyst look like? 
• What are the steps taken to identify these attacks? 

Resources:

Justin, Melissa’s, and Cole’s blog post

Justin Carroll’s LinkedIn

Melissa Turcotte’s LinkedIn

Cole Sodja’s LinkedIn

Joshua Neil’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Hosted on Acast. See acast.com/privacy for more information.