TechSpective Podcast

My guest on this episode of the Inner Circle podcast is Corey Williams, Senior Director of Product Management at Centrify. The focus of our chat is next-gen access, and how the principle of zero trust security is a better approach for identity and access management. I think we can all agree at this point that [...]

Inner Circle Podcast: Episode 005

Chad Skipper, VP of Competitive Intelligence and Product Testing at Cylance, is my guest for this episode of the Inner Circle podcast. We talk about the importance of anti-malware testing, and how and why you should do the testing yourself.

Does your anti-malware solution work? If you are looking at the available options and trying to choose a new anti-malware tool, how can you effectively determine which one is best? You can review information and product specs from the vendors, or look at industry reviews or customer testimonials--but some of that information may be biased and much of it might not apply to you and your specific environment and threat landscape.

Chad is one of the co-authors of a "For Dummies" ebook on the subject of anti-malware testing. A blog post from Cylance about the ebook explains:

Next-Generation Anti-Malware Testing For Dummies consists of six concise chapters that explore:

Why legacy anti-malware techniques are limited, and how artificial intelligence and machine learning combat modern malware more effectively

Why you should test for yourself

How to set up your own anti-malware testing environment

How to safely obtain malware samples and test anti-malware products yourself

How to take action on your anti-malware testing results

What to consider when choosing an anti-malware solution for your organization

The ebook is a quick and easy read. You might think that doing your own anti-malware testing is too technical for you and that you don't have the tools or skills to do it, but the ebook walks through the steps you need to set up a testing environment and conduct your own tests.

As promised in the podcast, here is a link for you to get a copy of the ebook: Next-Generation Anti-Malware Testing for Dummies.

You should also listen to previous episodes of the Inner Circle podcast, including the episode with Malcolm Harkins from Cylance.

Chad Skipper, VP of Competitive Intelligence and Product Testing at Cylance, is my guest for this episode of the Inner Circle podcast. We talk about the importance of anti-malware testing, and how and why you should do the testing yourself. Does your anti-malware solution work? If you are looking at the available options and trying [...]

Inner Circle Podcast: Episode 004

My guest on the Inner Circle podcast this week is Cesar Cerrudo, CTO of IOActive. Our topic revolves around ransomware--but with a twist that involves robots.

I think we can all agree that ransomware is annoying. When it comes to the standard ransomware business model of encrypting data and holding it hostage, though, there's a simple solution. As long as you have current backups of your data, you can simply ignore the ransomware demand and restore your unencrypted data from backup.

Researchers from IOActive have uncovered a potential twist on ransomware, however, that would make it much harder to ignore or recover from without paying the ransom. If attackers use malware to exploit vulnerabilities in robots and take them offline or make them dysfunctional, that could have a significant financial impact on companies that rely on robot automation for manufacturing, production, and logistics.

A blog post from IOActive explains, "Businesses and factories lose money every second one of their robots is non-operational. It stands to reason, then, that service and/or production disruption is another strategy for attackers. Instead of encrypting data, an attacker could target key robot software components to make the robot non-operational until the ransom is paid."

The robot ransomware angle has two significant and insidious advantages over the standard ransomware model. First, as mentioned above, recovery is more complex and can't be achieved by simply restoring data from backup. Second, the companies that rely on robots will suffer huge financial losses while the robots remain dysfunctional--providing a massive incentive to simply pay the ransom and get back to business.

The IOActive blog post points out that many robots don’t provide any simple way to perform a factory reset or update the operating system or software. "Having a technician fix a robot problem could take weeks depending on availability. Ironically, during our research, our robot started to malfunction. The only option to repair it was to send it back to the vendor. We had to ship it from our country to the US and wait a couple weeks for its return. We also had to cover the associated shipping costs, including customs handling."

As promised in the podcast, here are the links to the resources from IOActive:

Video: https://youtu.be/4djvZjme_-M

Check out the podcast to learn more. Share your thoughts or ask questions in the comments below.

My guest on the Inner Circle podcast this week is Cesar Cerrudo, CTO of IOActive. Our topic revolves around ransomware–but with a twist that involves robots. I think we can all agree that ransomware is annoying. When it comes to the standard ransomware business model of encrypting data and holding it hostage, though, there’s a [...]

My guest on the Inner Circle podcast this week is Cesar Cerrudo, CTO of IOActive. Our topic revolves around ransomware–but with a twist that involves robots. I think we can all agree that ransomware is annoying. When it comes to the standard ransomware business model of encrypting data and holding it hostage, though, there’s a [...]

Inner Circle Podcast: Episode 003

Brandon Board, Senior Director of Corporate Security, IT Compliance and Audit at Alert Logic, is my guest for the Inner Circle podcast this week. Alert Logic is a security company and helps customers achieve and maintain compliance with various regulations and frameworks. First and foremost, though, Alert Logic is itself a company--which means it must also comply with those same mandates.

I thought it would be interesting to chat with Brandon about the issues and challenges faced by a medium-sized software-as-a-service (SaaS) company striving to achieve and maintain compliance. We talked specifically about the European Union's General Data Protection Regulation (GDPR), which goes into effect on May 25, 2018.

I don't want to spoil the podcast for you, but one thing that appears to be an alarmingly pervasive issue--especially with less than 90 days until GDPR goes into effect--is the belief by many companies outside of the EU that it doesn't apply to them. Yes, GDPR is an EU mandate, but it applies to any company anywhere that has customers from the EU or might capture or store personal information on any citizen of the EU. In a nutshell, GDPR is a fairly global compliance mandate that applies to most companies around the world.

Hopefully, you're already aware of the impact of GDPR and you're already taking steps to make sure you're compliant by May 25. Regardless, Brandon provides some valuable insight and advice that can help you. Enjoy the podcast, and don't forget to check out Alert Logic and learn more about how they can help you achieve and maintain compliance.

Brandon Board, Senior Director of Corporate Security, IT Compliance and Audit at Alert Logic, is my guest for the Inner Circle podcast this week. Alert Logic is a security company and helps customers achieve and maintain compliance with various regulations and frameworks. First and foremost, though, Alert Logic is itself a company–which means it must [...]

Brandon Board, Senior Director of Corporate Security, IT Compliance and Audit at Alert Logic, is my guest for the Inner Circle podcast this week. Alert Logic is a security company and helps customers achieve and maintain compliance with various regulations and frameworks. First and foremost, though, Alert Logic is itself a company–which means it must [...]

Inner Circle Podcast: Episode 002

In this episode of the Inner Circle podcast, my guest is Christer Edwards from Adobe Security, Christer is a developer and a member of the team that developed HubbleStack--an open source security compliance tool.

Christer and I discuss the origin of HubbleStack and why they decided to create it in the first place. We also talk about what it does, why they chose to make it an open source project, and what the future might hold for HubbleStack.

This is only the second episode of Inner Circle, so I'm still working out some of the technical details of connecting with guests and recording. I cleaned up the audio as much as I can, and it is functional, but I will need to make some changes going forward to make sure I get the best quality audio from my guests.

In case you have trouble understanding some of what Christer say when explaining the components that make up HubbleStack, a blog post from Adobe explains it:

Nova – This is the audit piece of Hubble. It uses a set of user-defined profiles to audit against security standards, such as CIS (Center for Internet Security) standards. It returns successes and failures as well as a compliance percentage for the system.

Nebula – This is the information-gathering piece of Hubble. It primarily uses the open source project osquery (https://osquery.io) to collect all sorts of raw information from the systems which we can then use to search for patterns, vulnerabilities, and attacks.

Pulsar – This is the file integrity monitoring piece of Hubble. On Linux it uses inotify to monitor file events on the system and send them wherever you specify.

Quasar – Quasar is the reporting piece of Hubble. It is a series of modules which help you get the data to its final destination.

I hope you enjoy the podcast and learn a thing or two about HubbleStack and Adobe Security. Go check out the tool for yourself. I would love to get some feedback from the TechSpective audience about what you like or don’t like about HubbleStack. The good news is, it’s open source. If you don’t like something, you can change it or contribute to the project so everyone can benefit.