In this episode of the podcast (#232), Tomislav Peričin of the firm ReversingLabs joins us to talk about Log4Shell, the vulnerability in the ubiquitous Log4j Apache library. Tomislav tells us why issues related to Log4j won’t be going away anytime soon and how organizations must adapt to deal with the risk it poses.

If you’ve been paying attention to your infosec news feed this week, you’ve been inundated with stories and headlines about something called “log4j, a (previously) obscure library that is a common component of a number of Apache software frameworks. This quiet little soldier of the open source software world,  we now know, has a glaring security hole in it that allows remote code execution on affected systems. 

Episode 218: Denial of Sustenance Attacks -The Cyber Risk To Agriculture

Tomislav Peričin is the co-founder and Chief Software Architect at ReversingLabs.

Log4j: A Very Popular Library

And that’s a big problem. Why? Well, it turns out that Log4j is a very, very, very popular software library. The firm Sonatype notes that in November, log4j-core, the vulnerable version of the module, was the 252nd most popular component by download volume in Sonatype’s Maven Central code repository. That’s out of a total population of 7.1 million artifacts – that’s the top 0.003% percentile in popularity by downloads. To date, more than 2000 software packages have been identified that are potentially vulnerable to attacks targeting log4j. Those include both the popular Minecraft massively multiplayer online game as well as Apple’s iCloud and Twitter. SAP announced on Wednesday that it, alone, patched 20 applications that used Log4j. In the meantime, threat actors are scanning the Internet to identify servers vulnerable to exploitation.

Episode 208: Getting Serious about Hardware Supply Chains with Goldman Sachs’ Michael Mattioli

Supply Chain Risks: The New Normal

What does this mean for your organization? And what does the Log4j vulnerability tell us about the shape of cyber risks and threats to come? We invited Tomislav Peričin in to the Security Ledger studios to talk. Tomislav is the Chief Software Architect at the firm ReversingLabs and he’s an expert in software analysis and supply chain risks.

In this episode of the podcast (#231) Rodney Petersen, the director of the National Initiative for Cybersecurity Education (NICE) at the National Institute of Standards and Technology (NIST) joins host Paul Roberts to talk about the massive shortage of information security workers at the United States – estimated at more than 400,000 workers. Rodney talks about how NICE is working to promote information security skills and development.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

[MP3]

Rodney is the director of the National Initiative for Cybersecurity Education (NICE)

The U.S. is struggling with a multitude of economic challenges these days. On top of a pandemic, which is crippling sectors like retail, entertainment and restaurants, companies are struggling with what’s been termed the “Great Resignation” – a nation-wide wave of quitting by workers worried about risks to their health or just fed up with substandard salaries, working conditions or both. 

Episode 207: Sarah Tatsis of BlackBerry on finding and Keeping Women in Cyber

But in the information security field, a “Great Resignation” would be considered a good problem to have. After all, in order to have workers resign, you first have to find and hire them, and that’s been a nearly constant challenge for organizations in need of information security talent in a country that has an estimated 465,000 unfilled cybersecurity jobs. 

What is the source of the U.S.’s chronic information security worker shortage and what can be done about it? To answer those questions, we invited Rodney Petersen into the studios to talk. Rodney is the director of the National Initiative for Cybersecurity Education (NICE) at the National Institute of Standards and Technology (NIST) in the U.S. Department of Commerce. In this conversation, we talk about the challenges of developing the cybersecurity workforce and why “teach...

In this Spotlight edition of the podcast, we’re joined by Mackenzie Jackson, the Developer Advocate at the firm GitGuardian. Mackenzie and I discuss the problem of so-called “secrets sprawl” – the migration of all manner of sensitive information, from credentials to private keys -into public source code repositories on sites like GitHub.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

[MP3]

“Given enough eyeballs, all bugs are shallow.” That is “Linus’s Law.” First formulated by Eric Raymond in his 1999 book “The Cathedral and the Bazaar,” and named after Linus Torvalds, the creator of Linux. It speaks to a hidden value of open source code: with an unbounded population of developers given access to source code, security and quality issues will quickly bubble up and be discovered, improving security rather than undermining it. 

Mackenzie Jackson is a Developer Advocate at GitGuardian

All Secrets Are Shallow, Too!

Two decades later, open source culture is now firmly entrenched, open source code and libraries are part and parcel of nearly every software development project, and massive, online repositories like GitHub put code at the fingertips of a population of millions of developers and billions of Internet users.

In that new milieu, something like a corollary to Linus’s Law has emerged: given enough eyeballs, all secrets are shallow, too. 

In other words: having thousands of developers crawling over your source code may expose hidden flaws in your application code. (Though there is ample reason to doubt that happens.) But it may also reveal secrets you weren’t aware were buried in your code, or that you hoped nobody would notice. 

Credentials: Gone in 60 Seconds

In this episode of the podcast (#230) Siddarth Adukia, a regional Director at NCC Group, joins host Paul Roberts to talk about the (cyber) risks and (public health) rewards of vaccine passport systems: how they work, how they can be compromised and what to do about it.

As the world struggles to emerge from the COVID 19 pandemic, countries face one of two distinct challenges. Many poor and developing nations still struggle to obtain vaccines to inoculate their citizens and halt spread of the virus. However, in industrial nations in North America, Europe and parts of asia where vaccines are readily available, a secondary challenge has emerged: how to manage large and strident populations of unvaccinated residents who harbor doubts about the vaccines themselves, or are hostile to government and private sector vaccine mandates. 

In many of those countries, vaccine passports have emerged as a popular tool to help manage the spread of COVID. In much of Western Europe as well as some U.S. states, residents have had to present proof of vaccination to receive a digital pass – often in the form of a QR code – that then grants them access to stores, restaurants and entertainment venues.  

Episode 179: CISO Eye on the Virus Guy – Assessing COVID’s Cyber Risks

But – like any technology – vaccine passports can, themselves, become a target of those who wish to siphon off sensitive information,  create forged credentials or merely sow chaos and distrust in the passport system. 

That was the case last week after security researchers discovered valid, signed vaccine passports issued in the name of Adolph Hitler and Mickey Mouse were passing checks by state-run vaccine passport scanning apps like Germany’s Green Pass and Italy’s VerificaC19. The forged passports immediately led to speculation that digital keys for signing vaccine passports had been leaked – potentially undermining the entire European vaccine passport system. 

The Spectrum of Mobile Risk: Protecting Your Corporate Data

That begs the question of how vaccine passport systems work and what risks exist as countries look to implement vaccine passports to help them curtail the spread of COVID 19 amid populations of vaccinated and unvaccinated citizens. 

To help us understand the vaccine passport landscape a bit better, we invited Siddarth Adukia, Regional Director at NCC Group into the studio. Siddarth recently authored a blog post that explored both the security features and associated threats of vaccine passports. He says that risks abound: from dodgy mobile applications that siphon off sensitive data, to attacks on core passport infrastructure like cryptographic signing keys. 

Check out my full conversation with Siddarth above, or by clicking the download link below.

Download the MP3

When the first bugs for cash programs emerged almost two  decades ago, they were controversial. Programs like  iDefense Labs Vulnerability Contributor Program (VCP) (launched in 2002) and TippingPoint’s Zero Day Initiative (2005) were accused -at the time- of incentivizing the work of criminals and bad actors. 

Today, however, bug bounty programs are part and parcel of the software industry. Companies like Microsoft, Google and Apple all offer them, as well as countless other software firms. In recent years, even “old economy” industrial and manufacturing firms like Ford, GM and John Deere got into the act.

Careers Built on Bugs

That has spurred growth in the demand for vulnerability hunters. These days, talented bug hunters and pen testers can make six figure salaries – or higher – on crowdsourced bug bounty marketplaces: finding and reporting flaws in software in accordance with corporate bug bounty programs. 

Security Holes Opened Back Door To TCL Android Smart TVs

Casey Ellis is the CTO and Founder of BugCrowd.

But standing up a bug bounty program is no easy task. Apple, for example, has faced criticism for how it manages its disclosure program, with many vulnerability researchers claiming the company is too slow to address issues they report. For the countless other companies without big budgets and deep roots in the information security community, the logistics of standing up a bounty program and managing the flow of submissions are daunting. For those firms, bug bounty platforms have been a critical bridge to the global community of “white hat” security pros.

Report: Critical Infrastructure Cyber Attacks A Global Crisis

In the last decade, such programs have become a staple of countless software security and software assurance programs: crowd sourcing the work of finding and reporting software flaws that leverages the “wisdom of the crowd.”

BugCrowd: Bug Bounty Programs 10 Years On

What does it take to stand up a bounty program? And what skills are in demand on the bug bounty marketplaces today? To answer those questions, we invited Casey John Ellis into the studio. Casey is the founder and Chief Technology Officer at BugCrowd, an online marketplace that helps connect independent bug hunters, pen testers and software security experts with software publishers of every stripe. 

Episode 200: Sakura Samurai...

In this Spotlight edition of the podcast, we’re joined by Curtis Simpson, the Chief Information Security Officer at Armis. Curtis and I discuss the growing cyber risks posed by Internet of Things devices within enterprise networks. IoT and OT (operation technology) deployments are growing and pose challenges to organizations that are still focused on conventional IT systems and threats, and that struggle to detect such devices in their environments.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

In the past decade, security threats posed by the “Internet of Things” have gone from a curious “what if” to an urgent problem affecting national security. Earlier this month, for example, CISA warned of ongoing cyber attacks targeting water and wastewater facilities. Those attacks are targeting both IT and OT – or operational technology – networks and systems including industrial control system (ICS) and SCADA systems, CISA said. (PDF)

But, in truth, IoT risk is something that affects organizations of all types – from critical infrastructure owners and operators down to small businesses. Network connected printers, door/badge and HVAC systems, CCTV installations – all are common fixtures of modern workplaces – from defense contractors to doctors’ offices.

Curtis Simpson is the Chief Information Security Officer at Armis.

Still, the vast majority of security technology available to these organizations to manage their cybersecurity was designed to fight the “last war”: securing mostly Windows laptops, desktops and servers, even as non-traditional endpoints proliferate – most running operating systems other than Windows has cropped up on corporate networks. Consider, for example, the so-called “Urgent11” software vulnerabilities that were discovered to impact real time operating systems including VxWorks, OSE, Integrity and ThreadX RTOSs that, collectively, run billions of connected devices.

Identifying these devices is critical if they are to be managed and secured. But what does that take? In this episode of the podcast we are joined by Curtis Simpson, the CISO at Armis, a cybersecurity firm that offers a knowledge base and tools for fingerprinting IoT devices and then monitoring and sec...

In this Spotlight edition of the podcast, we’re joined by Brian Trzupek the Senior Vice President of Product at DigiCert. Brian and I take a look at the findings of a recent State of PKI Automation survey and the challenges organizations face as they look to manage a fast-growing population of tens of thousands of PKI certificates.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

Twenty years ago, Public Key Infrastructure, or PKI, had a pretty limited remit. Its first applications were securing email and physical access systems in security conscious environments like the military, intelligence community and government. With the explosion of the Internet, PKI became a foundational technology for securing web traffic and authenticating users to applications via technologies like SSL and TLS.

Brian Trzupek is SVP of Products at DigiCert

Since then, both the scale and applications of PKI have transformed. Today, PKI and digital certificates are used to sign and secure electronic documents and – increasingly – to secure communications and interactions between billions of connected devices on the Internet of Things.  Moreover, as digital transformation and DEVOPS has taken hold within the enterprise, the demand for PKI to secure critical development and production infrastructure has exploded. 

Survey: 50,000 Certs on Average

In fact, a recent survey of PKI use in 400 enterprises worldwide found that the typical enterprise is managing more than 50,000 digital certificates, with most dedicated to securing users, servers, web applications, email and mobile devices. That’s a 43% jump year over year, according to the survey.

Not surprisingly, IT managers are feeling overwhelmed by the sudden growth in the population of certificates. 61% of those surveyed said they were concerned about the time required to manage certificates in their environment, while 47% reported having encountered “rogue” (or unmanaged) certificates. 

In this episode of the podcast (#228) we’re joined by Eric Goldstein, Executive Assistant Director for Cybersecurity for the Cybersecurity and Infrastructure Security Agency (CISA) to talk about how the US government’s lead cybersecurity agency is helping companies and local government to keep hackers at bay. But are organizations ready to ask for help?

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

[MP3]

October is the 18th annual Cybersecurity Awareness Month – a month dedicated to educating the public and the private sector about cyber risks. What better time, then, to check in with our friends at CISA, the Cybersecurity and Infrastructure Security Agency. 

CISA: A Different Kind of Agency

Eric Goldstein (CISA)

As the U.S. government’s newest agency and the tip of the spear for government response to cyber risks and cyber threats, CISA has its hands full. The agency is responsible for coordinating and informing the cybersecurity practices of the federal government, which employs more than 4 million Americans and has a budget of close to $5 trillion. It also is the go-to for cybersecurity intelligence and security services for state and local governments. The agency offers a series of “cyber hygiene services” that local and state governments can use to interrogate their infrastructure. CISA also helps coordinate with the private sector around emerging threats, such as ransomware gangs and the hack of key providers like SolarWinds, Kaseya, the Colonial pipeline and more. 

CISA executives are quick to point out that the agency is not a regulator nor is it law enforcement. Indeed: CISA is “a different kind of agency:” less bureaucratic, more agile and more willing to embrace technologic change. CISA’s most important objective is to be a friend to the agencies and organizations that it serves: involving itself in cyber incident response not to assign blame or mete out punishment,

In this Spotlight Podcast, Pondurance Founder and Chief Customer Officer Ron Pelletier joins me to discuss his predictions about the security trends that will shape 2022. After a devastating 18 months of COVID – which included a surge in cyber attacks – 2022 offers promises of better times. But maybe not for security teams. Ron says organizations need to go back to the risk management drawing board to prepare for new threats and attacks.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted.

[MP3]

The last 18 months has been unlike anything in recent memory. The COVID Pandemic shuttered entire economies, killed millions, sickened hundreds of millions and confined billions of people to their homes. 

Ron Pelletier is the founder and Chief Customer Officer at Pondurance. 

Along the way, the pandemic has been a boon for some businesses – think: supermarkets, video streaming services and Amazon.com. And then there are the cyber criminal groups, who have used the disruptions caused by COVID to worm their way onto sensitive networks: exploiting vulnerable remote workers and security teams that were spread thin. 

2021: The End of the Beginning?

Sure, 2021 has seen a gradual return to normalcy: students are back in the classroom, sports fans have crowded stadiums and workers return to the office. Many hope, that 2022 will bring even happier days, as COVID recedes and the rhythms of life return to normal – even if masks are likely to stay with us for a while. 

What does the next year have in store? To help us answer that question, we invited Ron Pelletier into the Security Ledger studios. Ron is the founder and Chief Customer Officer at the firm Pondurance. In this conversation, and I talk about what may be in store.

2022: Turning A Corner

The tragedies of 2020 aside, Ron says there is plenty of reason for optimism about 2...

In this episode of the podcast (#227) we speak with Allan Liska, the head of the CSIRT at the firm Recorded Future. about the spate of attacks in recent months targeting food processing plants, grain cooperatives and other agriculture sector targets. Allan and I talk about the how these attacks are playing out and why, all of a sudden, the agriculture supply chain is under attack.

As always,  you can check our full conversation in our latest Security Ledger podcast at Blubrry. You can also listen to it on iTunes and Spotify. Or, check us out on Google Podcasts, Stitcher, Radio Public and more. Also: if you enjoy this podcast, consider signing up to receive it in your email. Just point your web browser to securityledger.com/subscribe to get notified whenever a new podcast is posted. 

[MP3]

There’s trouble on the farm. Recent weeks have seen an increase in attacks on elements of the U.S. food production system. Most famously, there was the meat processor JBS ), which paid $11 million in June to ransomware criminals from the REVil group to regain access to hacked systems and data. 

Allan Liska runs the CSIRT at Recorded Future

Then, September brought news of still more attacks on critical food supply chain partners. The New Cooperative, an Iowa grain cooperative with more than 60 locations, was hit by ransomware operated by BlackMatter, a ransomware gang with roots in the DarkSide group, a Russian cybercriminal outfit that was responsible for the attack on the Colonial oil and gas pipeline in the spring. Also in September, the Crystal Valley Cooperative, a Minnesota based farm supply and marketing cooperative was hit with ransomware, knocking the company offline and disrupting business operations.

Episode 216: Signed, Sealed and Delivered: The Future of Supply Chain Security

More Agriculture Supply Chain Attacks on Tap

That might not be the end. Threat researcher Allan Liska