Security Unlocked

Remember the good ole days when we spent youthful hours playing hide and seek with our friends in the park? Well it turns out that game of hide and seek isn’t just for humans anymore. Researchers have begun putting A.I. to the test by having it play this favorite childhood game over and over and having the software optimize its strategies through automated reinforcement training.  

In today’s episode, hosts Nic Fillingham and Natalia Godyla speak with Christian Seifert and Joshua Neil about their blog post Gamifying machine learning for stronger security and AI models, and how Microsoft is releasing this new open-sourced code to help it learn and grow.  

In This Episode, You Will Learn:

• What is Microsoft’s CyberBattleSim? 
• What reinforcement learning is and how it is used in training A.I. 
• How the OpenAI Gym allowed for AI to be trained and rewarded for learning  

Some Questions We Ask:

• Is an A.I. threat actor science fiction or an incoming reality? 
• What are the next steps in training the A.I.? 
• Who was the CyberBattleSim created for? 

Resources:

OpenAI Plays Hide and Seek…and Breaks The Game! 🤖 

Gamifying Machine Learning for Stronger Security and AI Models 

Christian Seifert’s LinkedIn

Joshua Neil’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Anyone who’s ever watched boxing knows that great reflexes can be the difference between a championship belt and a black eye. The flexing of an opponent’s shoulder, the pivot of their hip - a good boxer will know enough not only to predict and avoid the incoming upper-cut, but will know how to turn the attack back on their opponent.  Microsoft’s newest capabilities in Defender puts cyber attackers in the ring and predicts their next attacks as the fight is happening.

On today’s episode, hosts Nic Fillingham and Natalia Godyla speak with Cole Sodja, Melissa Turcotte, and Justin Carroll (and maybe even a secret, fourth guest!) about their blog post on Microsoft’s Security blog about the new capabilities of using an A.I. to see the attacker’s next move. 

In This Episode, You Will Learn:

• What kind of data is needed for this level of threat detection and prevention? 
• The crucial nature of probabilistic graphical modeling in this process 
• The synergistic relationship between the automated capabilities and the human analyst 

Some Questions We Ask:

• What kind of modeling is used and why? 
• What does the feedback loop between program and analyst look like? 
• What are the steps taken to identify these attacks? 

Resources:

Justin, Melissa’s, and Cole’s blog post

Justin Carroll’s LinkedIn

Melissa Turcotte’s LinkedIn

Cole Sodja’s LinkedIn

Joshua Neil’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

All of us have seen – or at least, are familiar with – the antics of Tom and Jerry or Road Runner and Wile E. Coyote. In each one the coyote or the cat set up these elaborate plans to sabotage their foe, but time and time again, the nimble mouse and the speedy bird are able to outsmart their attackers.

In our third episode discussing Ensuring Firmware Security, hosts Nic Fillingham and Natalia Godyla speak with Shweta Jha and Gowtham Reddy about developing the tools that allow for them to stay one step ahead of cybercriminals in the cat & mouse game that is cyber security.  

In this Episode You Will Learn: 

• The new capabilities within Microsoft Defender to scan the Unified Extensible Firmware Interface (UEFI)
• How the LoJax attack compromised UEFI firmware
• How UEFI scanning emerged as a capability  

Some Questions that We Ask: 

• Has UEFI scanning always been possible? 
• What types of signals is UEFI scanning searching for? 
• What are the ways bad actors may adjust to avoid UEFI scanning? 

Resources:  

Shweta Jha’s LinkedIn

Gowtham Reddy’s LinkedIn

Defender Blog Post

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Throughout the course of this podcast series, we’ve had an abundance of great conversations with our colleagues at Microsoft about how they’re working to better protect companies and individuals from cyber-attacks, but today we take a look at a different source of malfeasance: the insider threat. Now that most people are working remotely and have access to their company’s data in the privacy of their own home, it’s easier than ever to access, download, and share private information.

On today’s episode, hosts Nic Fillingham and Natalia Godyla sit down with Microsoft Applied Researcher, Rob McCann to talk about his work in identifying potential insider risk factors and the tools that Microsoft’s Internal Security Team are developing to stop them at the source. 

In This Episode, You Will Learn:

• The differences between internal and external threats in cybersecurity 
• Ways that A.I. can factor into anomaly detection in insider risk management 
• Why the rise in insider attacks is helping make it easier to address the issue

Some Questions We Ask:

• How do you identify insider risk? 
• How do you create a tool for customers that requires an extreme amount of case-by-case customization? 
• How are other organizations prioritizing internal versus external risks?

Resources:

Rob McCann’s Linkedin

Rob McCann on Uncovering Hidden Risk

Insider Risk Blog Post

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

How many languages do you speak? The average person only speaks one or two languages, and for most people that’s plenty because even as communities are becoming more global, languages are still very much tied to geographic boundaries. But what happens when you go on the internet where those regions don’t exist the same way they do in real life? Because the internet connects people from every corner of the world, cybercriminals can perpetrate scams in countries thousands of miles away. So how do organizations like Microsoft’s Digital Crime Unit combat cybercrime when they don’t even speak the language of the perpetrators?  

On today’s episode of Security Unlocked, hosts Nic Fillingham and Natalia Godyla sit down with Peter Anaman, Principal Investigator on the Digital Crimes Unit, to discuss how Peter looks at digital crimes in a very interconnected world and how language and culture play into the crimes being committed, who’s behind them, and how to stop them.  

In This Episode, You Will Learn:

• Some of the tools the Digital Crime Unit at Microsoft uses to catch criminals.  
• How language and cultural factors into cyber crime 
• Why cyber crime has been on the rise since Covid began 

Some Questions We Ask:

• How has understanding a specific culture helped crack a case? 
• How does a lawyer who served as an officer in the French Army wind up working at Microsoft? 
• Are there best practices for content creators to stay safe from cyber crime? 

Resources

Peter Anaman’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

For Women’s History Month, we wanted to share the stories of just a few of the amazing women who make Microsoft the powerhouse that it is. To wrap up the month, we speak with Valecia Maclin, brilliant General Engineering Manager of Customer Security & Trust, about the human element of cybersecurity. 

In discussion with hosts Nic Fillingham and Natalia Godyla, Valecia speaks to how she transitioned into cybersecurity after originally planning on becoming a mechanical engineer, and how she oversees her teams with a sense of humanity - from understanding that working from home brings unique challenges, to going the extra mile to ensure that no member of the team feels like an insignificant cog in a big machine - Valecia is a shining example of what leadership should look like, and maybe humanity too. 

In this Episode You Will Learn: 

• The importance of who is behind cybersecurity protocols 
• How Microsoft’s Engineering, Customer Security & Trust team successfully transitioned to remote work under Valecia’s leadership 
• Tips on being a more inclusive leader in the security space 

Some Questions that We Ask: 

• What excites Valecia Maclin about the future of Cybersecurity 
• How does a mechanical engineering background affect a GM’s role in Infosec 
• How Valecia Maclin, General Manager of Engineering, Customer Security & Trust, got to where she is today 

Resources:  

Valecia’s LinkedIn

Advancing Minorities’ Interest in Engineering

SAFECode

Microsoft’s TEALS

Microsoft’s DigiGirlz

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Every day there are literally billions of authentications across Microsoft – whether it’s someone checking their email, logging onto their Xbox, or hopping into a Teams call – and while there are tools like Multi-Factor Authentication in place to ensure the person behind the keyboard is the actual owner of the account, cyber-criminals can still manipulate systems. Catching one of these instances should be like catching the smallest needle in the largest haystack, but with the algorithms put into place by the Identity Security team at Microsoft, that haystack becomes much smaller, and that needle, much larger.

On today’s episode, hosts Nic Fillingham and Natalia Godyla invite back Maria Puertos Calvo, the Lead Data Scientist in Identity Security and Protection at Microsoft, to talk with us about how her team monitors such a massive scale of authentications on any given day. They also look deeper into Maria’s background and find out what got her into the field of security analytics and A.I. in the first place, and how her past in academia helped that trajectory.  

In this Episode You Will Learn:

• How the Identity Security team uses AI to authenticate billions of logins across Microsoft
• Why Fingerprints are fallible security tools
• How machine learning infrastructure has changed over the past couple of decades at Microsoft

Some Questions that We Ask:

• Is the sheer scale of authentications throughout Microsoft a dream come true or a nightmare for a data analyst?
• Do today’s threat-detection models share common threads with the threat-detection of previous decades?
• How does someone become Microsoft’s Lead Data Scientist for Identity Security and Protection?

Resources:

#IdentityJobs at Microsoft

Maria’s First Appearance on Security Unlocked, Tackling Identity Threats with A.I.

Maria’s Linkedin

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

If you use email, there is a good chance you’re familiar with email scams. Who hasn’t gotten a shady chain letter or suspicious offer in their inbox? Cybercriminals have been using email to spread malware for decades and today’s methods are more sophisticated than ever. In order to stop these attacks from ever hitting our inboxes in the first place, threat analysts have to always be one step ahead of these cybercriminals, deploying advanced and ever-evolving tactics to stop them.

On today’s podcast, hosts Nic Fillingham and Natalia Godyla are joined by Elif Kaya, a Threat Analyst at Microsoft. Elif speaks with us about attacker email infrastructure. We learn what it is, how it’s used, and how her team is combating it. She explains how the intelligence her team gathers is helping to predict how a domain is going to be used, even before any malicious email campaigns begin. It’s a fascinating conversation that dives deep into Elif’s research and her unique perspective on combating cybercrime. 

In This Episode, You Will Learn:  

• The meaning of the terms “RandomU” and “StrangeU” 
• The research and techniques used when gathering intelligence on attacker email structure 
• How sophisticated malware campaigns evade machine learning, phish filters, and other automated technology 
• The history behind service infrastructure, the Netcurs takedown, Agent Tesla, Diamond Fox, Dridox, and more 

Some Questions We Ask:

• What is attacker email infrastructure and how is it used by cybercriminals? 
• How does gaining intelligence on email infrastructures help us improve protection against malware campaigns? 
• What is the difference between “attacker-owned infrastructure” and “compromised infrastructure”? 
• Why wasn’t machine learning or unsupervised learning a technique used when gathering intelligence on attacker email campaigns? 
• What should organizations do to protect themselves? What solutions should they have in place? 

Resources:

What tracking an attacker email infrastructure tells us about persistent cybercriminal operations

Elif Kaya

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Today is International Women’s Day, and we are celebrating with a very special episode of Security Unlocked. Hosts Nic Fillingham and Natalia Godyla revisit their favorite interviews with some of the prominent women featured previously on the podcast.

We speak with Holly Stewart, a Principal Research Lead at Microsoft and known in the Defender organization as “The Queen of AI.” Holly shares how building a security team with different perspectives helps to better understand and stop threats.

Next, we talk with Dr. Anna Bertiger, a Senior Applied Scientist at Microsoft. Anna has an incredible passion for math and explains how she’s using math to catch villains and make computer networks safer. 

Finally, we explore what it’s like to hunt down threats with Sam Schwartz, a Program Manager with Microsoft Threat Experts. She came to Microsoft right out of college and didn’t even know what malware was; now she’s helping coordinate a team of threat hunters on the cutting edge of attack prevention. 

Security Unlocked will be highlighting female security leaders at Microsoft throughout the month of March. Subscribe now to make sure you don’t miss an episode! 

In This Episode, You Will Learn:

• How math is used to help analyze attack trends 
• How AI and ML help identify patterns that can stop attacks 
• How threat hunters are tracking down the newest security risks 
• Why Microsoft Threat Experts are focused on human adversaries, not malware 

Some Questions We Ask:

• How do AI and ML factor into solving complicated security problems? 
• What’s next on the horizon for data science? 
• How do you use math to determine if an action is dangerous or benign? 
• Why do threat hunters need to limit the scope of their work? 
• What skills do you need to be a security program manager? 

Resources: 

Sam Schwartz’s LinkedIn

Dr. Anna Bertiger’s LinkedIn

Holly Stewart’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Digital crime-fighter Donal Keating revisits the podcast, but this time… it’s personal. *cue dramatic crime-fighting music* The Director of Innovation and Research of the Digital Crimes Unit (DCU) at Microsoft joins hosts Nic Fillingham and Natalia Godyla to regale us with the origin story of the DCU and his captivating career exploits. Whether it’s tales of his early days preventing Windows 98 counterfeits in Ireland or the many international law enforcement raids he’s participated in…there’s no shortage to Donal’s crime-fighting adventures.

In This Episode, You Will Learn:

• The mission of Microsoft’s DCU and the techniques used to combat fraud
• The events and needs that led to the creation of a forensic analytic lab at Microsoft
• How counterfeiting and intellectual property crime have evolved over the years with advanced technology
• What it’s like partnering with law enforcement to take down criminals around the world

Some Questions We Ask:

• What does a day in the life of Donal look like in the DCU?
• Was there ever a counterfeit example that shocked Donal at just how good it was?
• With so many shifts in Donal’s work, what in his background has prepared him to stay on top of the changes?
• What does a digital crime fighter do in their time off?

Resources:  

Donal’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.