, in the enterprise security news,

1. AI is still getting a ton of funding!
2. Netwrix acquires PingCastle
3. Tenable looks for a buyer
4. SentinelOne hires Alex Stamos as their new CISO
5. Crowdstrike doesn’t appreciate satire when it’s at their expense
6. Intel begins one of the biggest layoffs we’ve ever seen in tech
7. Windows Downdate
8. RAG poisoning
9. GPT yourself
10. The Xerox Hypothesis

All that and more, on this episode of Enterprise Security Weekly.

Show Notes: https://securityweekly.com/esw-371

We chat with Sounil Yu, co-founder of LLM access control startup, Knostic. We discuss both the experience of participating in Black Hat's startup competition, and what his company, Knostic, is all about. Knostic was one of four finalists for Black Hat's Startup Spotlight competition and was announced as the winner on August 6th.

References

• DarkReading: Knostic Wins 2024 Black Hat Startup Spotlight Competition
• Knostic's Website

Show Notes: https://securityweekly.com/esw-371

0.0.0.0, Blacksuit, OpenAI, AWS, Cisco Phones, Win 10, Aaran Leyland, and More on the Security Weekly News.

Show Notes: https://securityweekly.com/swn-405

In this interview we explore the new and sometimes strange world of redteaming AI. I have SO many questions, like what is AI safety?

We'll discuss her presence at Black Hat, where she delivered two days of training and participated on an AI safety panel.

We'll also discuss the process of pentesting an AI. Will pentesters just have giant cheatsheets or text files full of adversarial prompts? How can we automate this? Will an AI generate adversarial prompts you can use against another AI? And finally, what do we do with the results?

Resources:

• PyRIT AI redteaming tool
• Microsoft's AI redteaming guide

Show Notes: https://securityweekly.com/esw-371

Learn what is most interesting at hacker summer camp this year!

Show Notes: https://securityweekly.com/psw-838

This week, Downgrade attacks, bootloader fun, check your firmware before you wreck your firmware, you've got mail server issues, Ivanti is the new Rhianna, you should update your BIOS, Openwrt dominates, and attacking the security tools for fun and profit!

Show Notes: https://securityweekly.com/psw-838

The code curation considerations of removing abandoned protocols in OpenSSL, kernel driver lessons from CrowdStrike's crash, choosing isolation primitives, cross-cache attacks made possible by SLUBStick, and more!

Show Notes: https://securityweekly.com/asw-294

Fake IDS, Storm Bamboo, uBlock, Rhysida, Snake, Delta, TikTok, Josh Marpet, and more, on this Edition of the Security Weekly News.

Show Notes: https://securityweekly.com/swn-404

Even though Security Champions programs look very different across organizations and maturity levels, they share core principles for becoming successful. Marisa shares her experience in building these programs to foster a positive security culture within companies. She explains the incentives and rewards that lead to more engagement from champions and the benefits that come from so many people being engaged with security.

Segment Resources:

• OWASP Security Champions Guide - Get Involved! - https://owasp.org/www-project-security-champions-guidebook/#div-getinvolved
• OWASP Security Champions Guide - LinkedIn page - https://www.linkedin.com/company/owasp-security-champions-guide/
• The Security Champions Success Guide - https://securitychampionsuccessguide.org/
• "Building a Successful Security Champions Program... What Does it Take?" - https://www.katilyst.com/post/building-a-successful-security-champions-program-what-does-it-take

Show Notes: https://securityweekly.com/asw-294

Inspired by my co-host Jason Albuquerque, this quarter's Say Easy, Do Hard segment is Job Search Strategies for CISOs. In part 2, Jason proposes we blow it all up, while Ben recommends a certification board for CISOs. We have no shortage of suggestions for how to fix the CISO hiring problem.

Show Notes: https://securityweekly.com/bsw-359