It can be a tour de force as we have a limited amount of time and an almost unlimited number of topics we can chat about. Yes, we can all agree that the InfoSec industry has become a variegated field with a great variety of people and stories. We sure love that, but when storytime is also lunchtime, it takes a special topic to get the energy level up and starting the podcast by telling stories about the early days (1970’s) of the Atari 800 can have that reinvigorating effect. That’s exactly what Marco and I did when we spoke with Darren Mar-Elia from Semperis. That wasn’t all that we spoke about though—that was just the ice-breaker for the chat we had.

Keep it simple, they say. With technology—and cybersecurity—most of the time, this is way easier said than done; especially when you set out from the start to solve very complex problems. But you know what you can do? You can look at these problems from a different angle and make your mission and goal to find solutions that are simple to deploy and manage.

You’ve likely heard that cybercriminals run their underground businesses similar to those seen in public—they have employees, managers, executives—they have formal business processes, employ marketing tactics, use innovative technologies, and even employ machine learning, artificial intelligence, and automation to help them get the best return—they have a supply chain to help the cybercriminal community make the most of their business ventures—and, with this, of course, there is a ton of supply and demand up and down the cybercrime stack.

The timing was perfect to have this conversation since the Ponemon Institute and Devo put together a new research-driven report, Improving The Effectiveness Of The SOC. Marco was happy to join me to discuss the results with Dimitri and Matt, and we uncovered some additional elements to consider when a poor user experience is delivered with a security application or service. Without giving everything away, I will leave you with one word: burnout.

“Water drops hit the wet stone floor. The sound reverberates in the distance.”

“I see there is somebody lurking in the shadow here.”

“Grunt__”

“Sean?__”

“Grunt__” “Grunt__”

“He couldn't sound creepier if he tries to sound creepier__”

“I could try.”

“He could probably be.“

“He probably could. He probably could__ anxious laugh.”

“Evil laugh echoes in the emptiness of the dark corridor__”

This was not scripted. It just happened.

This conversation gets even better as we dig deeper into BlueKeep than I thought we would/could—plus we got to discuss some other research and tool development on which this duo are working … all things designed to help organizations identify and mitigate the risks they face when it comes to some of the potentially-nastiest exploits in recent times if the negative stars were to line up properly.

Once upon a time, there was an idea. It was a good one. It was so good that it became a flawless product and an extremely successful company overnight.

And they lived successfully and happily ever after.

— The End

The story of the latest “overnight success” took years to bring together...

There are numerous methods available to uncover and identify operational weaknesses and functional vulnerabilities in both software applications and hardware systems. One manner in particular—running a bug bounty—has become one of the more popular methods in recent years as it can quickly scale to the scope of the environment being evaluated [covering breadth] while also matching expert researchers to specific functional areas of the operational environment to ensure the most covert weaknesses are exposed [encompassing depth]. As with most vulnerability testing methods, the goal is to find and fix these issues before a bad actor does it on the company's behalf.

Next time you think that a social engineer is a social media expert or a criminal of some sort, do me a favor and look at yourself in the mirror — chances are you won't see either. One thing that you will see is a social engineer; all humans are social engineers—it is in our nature, and we are damn good at it.

This is a story that started about ten years ago; however, in some ways, it goes back a bit further than that—and perhaps we will never catch up with the present.