Security Unlocked

Most people know the age-old adage, “Don’t judge a book by its cover.” I can still see my grandmother wagging her finger at me when I was younger as she said it. But what if it's not the book cover we’re judging, but the title? And what if it’s not a book we’re analyzing, but instead a security bug? The times have changed, and age-old adages don’t always translate well in the digital landscape. In this case, we’re using machine learning (ML) to identify and “judge” security bugs based solely on their titles. And, believe it or not, it works! (Sorry, Grandma!) 

Mayana Pereira, Data Scientist at Microsoft, joins hosts Nic Fillingham and Natalia Godyla to dig into the endeavors that are saving security experts’ time. Mayana explains how data science and security teams have come together to explore ways that ML can help software developers identify and classify security bugs more efficiently. A task that, without machine learning, has traditionally provided false positives or led developers to overlook misclassified critical security vulnerabilities. 

In This Episode, You Will Learn:

• How data science and ML can improve security protocols and identify and classify bugs for software developers 
• How to determine the appropriate amount of data needed to create an accurate ML training model 
• The techniques used to classify bugs based simply on their title 

Some Questions We Ask:

• What questions need to be asked in order to obtain the right data to train a security model? 
• How does Microsoft utilize the outputs of these data-driven security models?  
• What is AI for Good and how is it using AI to foster positive change in protecting children, data and privacy online? 

Resources: 

Microsoft Digital Defense Report

Article: “Identifying Security Bug Reports Based Solely on Report Titles and Noisy Data”

Mayana’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Prior to the pandemic, workdays used to look a whole lot different. If you had a break, you could take a walk to stretch your legs, shake the hands of your co-workers, or get some 1-on-1 face time with the boss. Ahh... those were the days. That close contact we once had is now something that many of us yearn for as we’ve had to abruptly lift and shift from living in our office to working from our home. But communicating and socializing aren’t the only things that were easier back then. The walls of your office have expanded, and with them, the boundaries of your security protocols. Small in-office tasks like patching a server have now become multi-step processes that require remote management, remote updates, and remote administrative control. With that comes the prioritization of resilience and what it means for enterprises, customers, and security teams alike. That’s where remote enterprise resiliency comes into play.  

Today on the pod, we explore the final chapter of the MDDR. Irfan Mirza, Director of Enterprise Continuity and Resilience at Microsoft, wraps up the observations from the report by giving hosts Nic Fillingham and Natalya Godyla the rundown on enterprise resiliency and discusses how we can ensure the highest levels of security while working from home. Irfan explains the Zero trust model and how Microsoft is working to extend security benefits to your kitchen or home office, or...  that make-shift workspace in your closet.  

In the second segment, Andrew Paverd, Senior Researcher on the Microsoft Security Response Center Team and jack of all trades, stops by… and we’re not convinced he’s fully human. He’s here to tell us about the many hats he wears, from safe systems programming to leveraging AI to help with processes within the MSRC, and shares how he has to think like a hacker to prevent attacks. Spoiler alert: he’s a big follower of Murphy’s Law.   

In This Episode, You Will Learn:  

• How classical security models are being challenged 
• What the Zero Trust Model is and how it works  
• The three critical areas of resilience: extending the enterprise boundary, prioritizing resilient performance, and validating the resilience of our human infrastructure.  
• How hackers approach our systems and technologies 

Some Questions We Ask: 

• How has security changed as a product of the pandemic? 
• Do we feel like we have secured the remote workforce? 
• What frameworks exist to put a metric around where an organization is in terms of its resiliency? 
• What is Control Flow Guard (CFG) and Control-Flow Integrity? 
• What’s the next stage for the Rust programming language?  

Resources: 

Microsoft Digital Defense Report

Irfan’s LinkedIn

Andrew’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Close your eyes, and imagine a world where booting up your computer wasn’t a susceptibility point for attacks. Imagine a Root of Trust that’s integrated into the CPU. Imagine all of your devices being protected against advanced attacks. Now, what if I told you there’s a cutting-edge processor that’s battle-tested for hardware penetrations, easy to update, and protects credentials, encryption keys, and personal data all at once? What if I told you it was already here, and your systems might already be using it?! Open your eyes, and get ready to be amazed! It’s Pluton, baby! Peter Waxman, Group Program Manager at Microsoft, joins hosts Nic Fillingham and Natalia Godyla in a tell-all about Pluton. Trust us, Pluton is sure to knock your SOCs off (that’s System on a Chip)!

Now that your eyes have been opened to a more secure system, we’d like to ask you to keep the volume down, because you’ve just entered the Library of Threats. While it may sound like inspiration for the next installment of National Treasure, you won’t find Nicolas Cage in this library (at least you shouldn’t). However, you will find Madeline Carmichael, MSTIC’s Threat Intel Librarian, whose movie-worthy title is just as impressive as it sounds. To be honest though, you might not find anyone in the library, as it bears more resemblance to Professor X’s Cerebro than it does your local hardcover sanctuary.  

In This Episode, You Will Learn:   

• What the Pluton Security Processor is and how it was created 
• The architecture of the Pluton Security Processor 
• What challenges were faced while bringing the Pluton Security Processor to life 
• The Root of Trust today vs. The Future with Pluton 
• The naming systems for threat actors, from periodic elements to volcanoes 

Some Questions We Ask: 

• What differentiates the Pluton Security Processor from previous methodologies? 
• Why is the Pluton Processor better than what we have used in the past?   
• What challenges lie ahead with the next steps around Pluton? 
• What has changed since Pluton was in Xbox to where it is now? 
• What tools and platforms does a Threat Intel Librarian utilize? 

Resources: 

Microsoft Pluton Announcement

Peter’s LinkedIn

Madeline’s LinkedIn 

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

CCI: Cyber Crime Investigation. Another day, another email attack - something smells “phishy” in the network. *Slowly puts on sunglasses and flips up trench coat collar* Time to go to work. 

Just how easy is it for someone to steal your credentials? Because once they’re stolen, and sold for pocket change, it’s open season. Homoglyphs, drop accounts, email forwarding… is it any wonder billions of dollars have been lost to BEC (business email compromise)?

Join hosts Nic Fillingham and Natalia Godyla for a fascinating conversation with Peter Anaman, Director and Principal Investigator of the CELA Digital Crimes Unit, as they unpack the cybercrime section of the Microsoft Digital Defense Report to see what these phishers are up to. Scott Christiansen joins us later in the show to recount his journey to security and his role as an Adjunct Professor for Bellevue University's Master of Science in Cybersecurity, along with some great advice for choosing security as a profession.     

In This Episode, You Will Learn:   

• The difference between consumer and enterprise phishing 
• The types of people and professions that are usually targeted in cyber attacks  
• How putting policies on backups and policies to protect the organization in place will help prevent digital crimes 
• The four categories of the internet: the dark web, the surface web, the deep web, and the vetted web 

Some Questions We Ask:  

• What would an example of credential phishing look like? 
• What is the end goal for phishers? 
• How are phishing and business email compromise techniques leveraged during the pandemic? 
• What patterns are being seen when it comes to credential phishing? 
• How do you use ML to classify whether a bug is security-related or not? 

Resources:  

Microsoft Digital Defense Report

Peter’s LinkedIn

Scott’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Special Edition! 

We’ve been told for years how important passwords are, taught how to make them stronger and longer and better, and we frantically tear up our home or office when we can’t find that sticky note where we wrote them down. Life feels like it comes to a screeching halt when we’ve lost our passwords, but… what would life be like if we didn’t need them? Can your passwords truly become a thing of the past? Sounds a bit unnerving, but we can promise you, it’s always security first here at Microsoft.  

On this special edition episode of the Security Unlocked podcast, hosts Nic Fillingham and Natalia Godyla explore the journey of becoming passwordless with Alex Weinert, Director of Identity Security at Microsoft, as he explains why your passwords don’t matter and how going passwordless can protect you from attackers.

In This Episode, You Will Learn:   

• The risks that are being mitigated through passwordless authentication 
• Where the challenges lie within using passwordless authentication 
• The functions of Windows Hello, Microsoft Authenticator and FIDO tokens 
• How ML is used in these technologies 

Some Questions We Ask:  

• What does passwordless mean? 
• What are some common misconceptions or risks? 
• Where are customers on their journey to going passwordless? 
• hat is the end goal for passwordless authentication? 

Resources:

Alex’s Blog Post

Alex’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

How do we ensure firmware integrity and security? Join hosts Nic Fillingham and Natalia Godyla and guest Nazmus Sakib, a Principal Lead Program Manager at Microsoft, to dive deeper and assess the complexities and challenges that come along with securing firmware - bootstraps and all!  

Megamind Bhavna Soman, a Senior Security Research Lead, joins us later in the show and we learn about her journey in optimizing AI and ML to improve efficiency in security and give the humans a break.  

In This Episode, You Will Learn:

• How Microsoft ensures firmware integrity and security 
• How firmware is making it harder for attackers
• Where AI and ML will take threat intelligence in the near future 

Some Questions We Ask:

• What is firmware? 
• Do we know where firmware attacks begin? 
• What does the threat landscape look like for firmware? 
• What part of ML should be automated better so that humans can shift to other tasks? 

Resources: 

Microsoft Digital Defense Report

Nazmus’s LinkedIn

Bhavna’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Watchdogs in tow, hosts Nic Fillingham and Natalia Godyla are joined by guest Randy Treit, Principal Security Leader at Microsoft, to examine the process of identifying the source of a threat and stopping the spread by protecting “patient zero.” Randy has a few key tricks up his sleeve as a defender, but you can decide if they’re more impressive than the antics he and his identical twin have pulled while working at Microsoft.

In the second segment, Jeremy Dallman, Principal Program Manager at Microsoft, discusses why some bad actors are known in the security world under some of the most seemingly harmless codenames, such as “Fancy Bear” and “Charming Kitten”, and highlights the techniques his team is using to protect Microsoft’s customers from Nation-State actors. 

In This Episode, You Will Learn: 

• How Microsoft is defending and protecting patient zero
• The history of Defender and antimalware
• The process of finding gaps in protections
• The importance of protecting customers from Nation-State actors
• How and why security vendors use codenames to refer to threat activity groups 

Some Questions We Ask:

• What is different about focusing on patient zero than other aspects of security?
• How does Microsoft measure the false positive rate in protecting patient zero?
• What tools are being used on a day-to-day basis in defender security?
• Why does Microsoft partner with the industry to identify Nation-State actors?
• How many groups are utilizing AI and ML to enhance their ability to become a threat? 

Resources:

Microsoft Digital Defense Report

Randy’s LinkedIn

Jeremy’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Yeehaw! “Data Cowboy” is in the building. Join us as Nic Fillingham and Natalia Godyla sit down with Ram Shankar Siva Kumar, aka “Data Cowboy” at Microsoft, for an exciting conversation about the release of a new adversarial ML threat matrix created for security analysts. Have no fear, we made sure to find out how Ram acquired the name, “Data Cowboy”, so saddle up and get ready for the ride!

Stick around to hear Nic and Natalia explore the urgency of surfacing threats at a faster rate with Justin Carroll, a Threat Analyst at Microsoft, and why it is more important now than ever before.

In This Episode, You Will Learn:

• How Microsoft is using the new ML threat matrix against cyber attacks 
• The approach and philosophy for putting the threat matrix on GitHub  
• ML applications in regard to healthcare and why it is worrisome 
• What needs to happen in order to be successful in combating certain threats 

Some Questions We Ask:

• What is an adversarial ML threat matrix? 
• How will the community on GitHub contribute to the evolution of the ML threat matrix? 
• What resources are available to learn about all things VM? 
• What techniques are being used to find threats at a faster speed? 
• How do AI and ML factor into the role of managing data and collaborating with other teams? 

Resources

Ram’s Blog

Ram’s LinkedIn

Justin’s LinkedIn

Microsoft Security Blog

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

The last thing we all need this year is an identity crisis. Fear not, hosts Nic Fillingham and Natalia Godyla are here with Maria Puertas Calvo, Data Science Lead of Microsoft’s Identity Security and Protection Team, to learn how AI is being used to protect our personal identities. Maria also reveals previously undisclosed information – her favorite food and her famous top-secret recipe, so get ready to take notes! 

Later, the hosts bring back a previous guest, Geoff McDonald, ML Research Lead at Microsoft to unpack his career in cybersecurity and how game hacking led him to where he is now. 

In This Episode, You Will Learn:

• How offline detections are used for account compromise prevention 
• The importance of multi-factor authentication 
• How Microsoft is taking a new approach with AI to identify threats with real-time prevention  
• The problem with adversaries and malware attackers 

Some Questions We Ask: 

• How is Microsoft applying AI to solve problems for account compromise prevention? 
• How do humans play a role in labeling data sets? 
• How is Microsoft measuring success of their new enhanced AI? 
• What is the future for neural networks? 

Resources

Maria’s Blog

Microsoft Security Blog

Maria’s LinkedIn

Geoff’s LinkedIn

Nic’s LinkedIn

Natalia’s LinkedIn

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

How ready is your corporate security team to handle AI and ML threats? Many simply don’t have the bandwidth or don’t see it as a priority. That’s where security engineers like Microsoft’s Andrew Marshall step in. In this episode, hosts Nic Fillingham and Natalia Godyla speak with Andrew about just what his team is doing to teach security professionals and policy makers about the dangers of AI and ML attacks, and walks through some of the documentation, available for free online, that can help guide the response. Plus, why he really, really doesn’t want to talk about Windows Vista. 

Nic and Natalia then explore what it’s like to hunt down threats with Sam Schwartz, a program manager with Microsoft Threat Experts. She came to Microsoft right out of college and didn’t even know what malware was. Now, she’s helping coordinate a team of threat hunters on the cutting edge of attack prevention. 

In This Episode, You Will Learn:   

• Why data science and security engineering skills don’t necessarily overlap 
• How attackers are using ML to change decision making 
• What security teams are doing to protect AI and ML systems 
• How threat hunters are tracking down the newest security risks 
• Why Microsoft Threat Experts are focused on human adversaries, not malware 

Some Questions We Ask:   

• What does the ML landscape look like at Microsoft? 
• How are ML attacks evolving? 
• What is ‘data poisoning’? 
• Why do threat hunters need to limit the scope of their work? 
• What skills do you need to be a security program manager? 

Resources

Threat Modeling AI Systems and Dependencies 

Andrew’s LinkedIn

Sam’s LinkedIn

Nic’s LinkedIn 

Natalia’s LinkedIn

Microsoft Security Blog

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.