Security Weekly Podcast Network (Video)

In the leadership and communications section, Cybersecurity in the C-Suite: A CISO's Guide to Engaging the Board, The CISO's Guide to AI: Embracing Innovation While Mitigating Risk, Cyber Insurance Strategy Requires CISO-CFO Collaboration, and more!

Show Notes: https://securityweekly.com/bsw-341

When you think of executive protection, you think of work related activities such as security details, travel planning, and other physical security protections. But in the world of Artificial Intelligence and DeepFakes, the risk landscape for executives goes far beyond work and into their personal lives. The home is now the new battle field and family life will never be the same.

Chris Pierson, CEO at BlackCloak, joins Business Security Weekly to discuss the changes in the risk landscape for executives, including Generative AI, and its impacts on social engineering, personal attacks, and family threats. Executive protection must now include digital protection, both at work and at home.

This segment is sponsored by BlackCloak. Visit https://securityweekly.com/blackcloak to learn more about them!

Show Notes: https://securityweekly.com/bsw-341

Star Trek, JetBrains, Facebook, Chrome, FBI, USBs, TikTok, Aaran Leyland, and More on this edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-367

In the enterprise security news,

1. Axonius raises $200M and is doing $100M ARR!
2. Claroty raises $100M and is doing $100M ARR!
3. Crowdstrike picks up DSPM with Flow Security
4. CyCode picks up Bearer
5. Are attackers like lawyers?
6. How a bank failed (with no help from a cyber attack)
7. the FTC cracks down on customer data collection
8. Apple's car sadly won't be a thing any time soon
9. or maybe ever.

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-352

Defenders spend a lot of time and money procuring and implementing security controls. At the heart of SecOps and the SOC are technologies like XDR, SIEM, and SOAR. How do we know these technologies are going to detect or prevent attacks?

Wait for the annual pen test? Probably not a good idea.

In this segment, we'll talk with Michael Mumcuoglu about how MITRE's ATT&CK framework can help defenders better prepare for inevitable attack TTPs they'll have knocking on their doors.

Segment Resources:

• CardinalOps Contributes to MITRE ATT&CK for Fourth Consecutive Release
• ESG Report: Operationalize MITRE ATT&CK with Detection Posture Management
• Report: Enterprise SIEMs offer inadequate threat detection
• 2023 State of SIEM Detection Risk Report

Show Notes: https://securityweekly.com/esw-352

Defenders spend a lot of time and money procuring and implementing security controls. At the heart of SecOps and the SOC are technologies like XDR, SIEM, and SOAR. How do we know these technologies are going to detect or prevent attacks?

Wait for the annual pen test? Probably not a good idea.

In this segment, we'll talk with Michael Mumcuoglu about how MITRE's ATT&CK framework can help defenders better prepare for inevitable attack TTPs they'll have knocking on their doors.

Segment Resources:

• CardinalOps Contributes to MITRE ATT&CK for Fourth Consecutive Release
• ESG Report: Operationalize MITRE ATT&CK with Detection Posture Management
• Report: Enterprise SIEMs offer inadequate threat detection
• 2023 State of SIEM Detection Risk Report

Show Notes: https://securityweekly.com/esw-352

BiaSciLab from DEF CON joins us to discuss DCNextGen! In the security News: MouseJacking still works, CISA recommends a complete rebuild, memory safety and re-writing code, not all doorbells are created equal, putting a firewall in front of your LLM, rugged gear and vulnerabilities, PLCs are not safe, neither are Windows kernels..

Segment Resources: https://www.defcon.kids https://www.BiaSciLab.com https://www.GirlsWhoHack.com https://www.SecureOpenVote.com

Show Notes: https://securityweekly.com/psw-819

Public information about exploits and vulnerabilities alone is not enough to inform prioritization, especially with the growing rate and variety of CVEs. Dan DeCloss, founder and CTO of PlexTrac, joins the show to discuss solving the challenges of risk prioritization to drive faster, more strategic assessment cycles. Spoiler: The key is adding context and prioritization to risk-scoring equations.

Segment Resources: https://plextrac.com/get-ready-to-prioritize-risk-with-our-new-contextual-scoring-engine/?utmmedium=techptr&utmsource=securityweekly

https://plextrac.com/video/priorities/?utmmedium=techptr&utmsource=securityweekly

This segment is sponsored by PlexTrac. Visit https://securityweekly.com/plextrac to learn more about them!

Show Notes: https://securityweekly.com/psw-819

ToddleShark, Zeek, Stuxnet revisited, ICS, AMEX, Apple, Change, Josh Marpet, and More on this Edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-366

The need for vuln management programs has been around since the first bugs -- but lots of programs remain stuck in the past. We talk about the traps to avoid in VM programs, the easy-to-say yet hard-to-do foundations that VM programs need, and smarter ways to approach vulns based in modern app development. We also explore the ecosystem of acronyms around vulns and figure out what's useful (if anything) in CVSS, SSVC, EPSS, and more.

Segment resources:

• https://www.redhat.com/en/blog/patch-management-needs-a-revolution-part-1
• https://next.redhat.com/blog/
• https://www.first.org/cvss/v4-0/
• https://www.first.org/epss/
• https://deadliestwebattacks.com/appsec/2010/02/19/primordial-cross-site-scripting-xss-exploits -- For a bit of history, one of the earliest "bugs bounty" from 1995.

Show Notes: https://securityweekly.com/asw-275