Have you ever wanted to threat model the death star from Star Wars? Well this is one of the many topics we discuss in the latest episode of the Security Repo podcast with our special guest Audrey Long. Audrey is a Senior Security Software Engineer at Microsoft in the Commercial Software Engineering team (CSE), which is a global engineering organization that works directly with the largest companies and not-for-profits in the world to tackle their most significant technical challenges.

Show Links:

Audrey on Linkedin - https://www.linkedin.com/in/audrey-long-53153a11b/

Stride Threat Model Framework - https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats#stride-model

Mitre Att&ck Framework - https://attack.mitre.org/

Threat Modelling at Microsoft - https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats

[Article] Why Threat Detection Should Always be Consideredhttps://www.linkedin.com/pulse/why-threat-detection-should-always-considered-audrey-long/?trk=pulse-article_more-articles_related-content-card

In this episode of The Security Repo we are joined again by Troy Santana from Critical Start to discuss how organizations can set up a Security Operations center regardless of their size. We explore exactly what a security operations center does and why you need one in the current security climate.   For more information on Critical Start please check out their website at https://www.criticalstart.com/

Staff augmentation is the idea of augmenting your internal staff with consultants and tools to give you the collective knowledge of security experts for all teams. We sit down with security consultant Troy Santana to discuss exactly what staff augmentation looks like and how it can be implemented.

Troy Santana joins us as a Sales Engineer for Critical Start. After spending 6 years as part of their 24x7 SOC team in analyst, management, and supporting roles, he moved over to security consulting to provide technical depth and operations experience to the buying process. A veteran of the Marine Corps, he obtained an M.A. in Criminology/Criminal Justice and uses that experience and education to help his team and clients understand the importance of layered security and operational expertise in both tools and personnel.

Learn more about critical start at https://criticalstart.com

In this episode, we sit down with Laurent Balmelli, the CEO of Strong Network, to discuss why development environments are vulnerable to malicious actors and how we can move to a secure cloud IDE (Integrated Development Environment). A cloud IDE isn't entirely new but it also isn't changing how developers are working and more importantly how developers are keeping their environments secure. We ask Laurent what the issue is with cloud IDEs and discuss how we can leverage the concept to build better, more secure environments for our developers.

Breach of the week - This week we take a look at the Atlassian breach in which attackers were able to obtain employee credentials to gain access to a third-party HR system. 

Ross Haleliuk is a champion for Product Lead Growth (PLG) and in this episode sits down with Mackenzie Jackson to discuss how this concept has changed cyber security products and also how organizations can adopt a product lead growth mindset.   Ross is a thought leader in the space and has many interesting publications on the topic, to find out more here are some links.    Linkedin - https://www.linkedin.com/in/rosshaleliuk/ Blog - https://ventureinsecurity.com/?gi=af7863463f56

Nathaniel McCallum is the former CTO and co-founder of Profian and an expert in web assembly and confidential computing. This week on the security repo Dwayne McDaniel goes on a deep dive with Nathaniel to understand web assembly and how it relates to security but also peels apart the layers that surround the term confidential computing. It is a fascinating conversation with a lot of takeaways. 

In this episode, we invite Will Kelly to join Mackenzie and Dwyane in a conversation about implementing DevSecOps in software organizations. We tackle what DevSecOps is in reality, how can organizations implement a plan to roll out a DevSecOps approach, and the challenges that surround this. 

Will Kelly is a freelance writer focused on DevOps and the cloud. He has worked on teams that introduced DevOps and the cloud to commercial and public sector organizations. Will is a correspondent for Red Hat’s Opensource.com. His work has also been published by TechTarget, Enable Architect, InfoQ, InfoWorld, and others. Follow him on Twitter: @willkelly.

Len Noe is both a white hack hacker and a pioneer in the transhuman movement. Current Len has 8 implants which he uses to enhance his offensive security activities. In this episode, I discuss with Len what Biohacking or bio modifications mean as a security threat and what we can do to defend against this new threat.

This episode takes a deep dive into the issues all companies face with the software supply chain including open-source dependencies and the credentials that attackers are after.