The 2016 DBIR OSVDB Thoughts on the DBIR Analyzing the 2016 Verizon Data Breach Investigations Report » Digital Shadows The DBIR’s ‘Forest’ of Exploit Signatures – Trail of Bits Blog Response to Kenna Security’s Explanation of the DBIR Vulnerability Mess | OSVDB

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter.

This evening, Martin, Steve, and Joseph talk about overhyped vulnerabilities, and how that affects communication with the business.

Badlock’s Site Sadlock Hyping vulnerabilities is no longer helping application security awareness | TechCrunch

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter. And if you’ve found our Facebook page, we’re sorry. We’re going to fix that up.

Tonight, Martin and Joseph sit down and talk about communicating cautionary tales without turning them into FUD.

US-CERT advisory on ransomware

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter. And if you’ve found our Facebook page, we’re sorry. We’re going to fix that up.

InfoSec programs without money are like cereal but no milk, peanut butter but no jelly, Milli but no Vanilli… (Get over it, I’m old - Martin)

Martin is doing a talk on “The ABCs of Getting Your InfoSec Program Funded” and we’re going to discuss how this works in the real world at all of the different levels.

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter. And if you’ve found our Facebook page, we’re sorry. We’re going to fix that up.

Episode 175 - RSAC Wrapup and More...

Congrats to Risky Business for winning this year’s podcast of the year!

RSA: Let’s get an update from our reporter on the scene: Mr. Steve Ragan.

Fear and loathing at RSA: Hacking, security and the limits of protection | TechCrunch

Hack the Planet! I mean the Pentagon: U.S. military invites vetted experts to "Hack the Pentagon" | Fortune

Spear Phishing: Three more firms hit by targeted Phishing attacks seeking W2 data | CSO Online

What Happens When You Dare Expert Hackers to Hack You

Backdoors: Linux Mint hacked: Compromised data up for sale, ISO downloads backdoored | CSO Online

Transmission Infected with KeRanger Ransomware – MacStories

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter.

We’ve been nominated for the 2016 Security Blogger Awards!

Topic: Threat Intel

Norse Corp disappears shortly after CEO is asked to step down

Digital Shadows announces 14 million series B fund raising

PDF WARNING - Threat Intelligence Maturity Model (tl;dr - Intel programs are hard and take years to get right)

Forrester - Maximizing your investment in cyber threat intelligence providers (tl;dr - be careful spending big bucks and make sure you are gathering your own intel first)

Mind Over Matter: The Importance of Intelligence in Your Threat Program - “When it comes down to it, you can’t outsource your business risk management strategy.”

Threat Intelligence Indicators are not Signatures // InfoSec Zanshin

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter.

We’ve been nominated for the 2016 Security Blogger Awards!

Topic: Vendor Relationships 

Trend Micro AV gave any website command-line access to Windows PCs

Google security researcher excoriates TrendMicro for critical AV defects

Trustwave lawsuit

Norse story

Demos: Pro Tip: Kicking off your demo with "I hope you'll understand these concepts" sets a pretty sad tone. - Martin

Pro Tip: Presuming you know our business processes during your demo means you aren't showing us what we are looking for. Ask first. - Martin

Pro Tip: If you don't prepare to demo the requested features please just cancel and move along. - Martin

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter.

Topic: Security Awareness

Some people think it's a waste of time:

Why you shouldn’t train employees for security awareness Schneier on Security Awareness Training Does security awareness training even work?

But, that said, it's a requirement for government agencies and regulated industries:

HHS Security Awareness and Training Requirements

Privacy and Security Training requirements for multiple regulations

DISCUSSION & OPINION: Is Security Awareness worth the time?

If you have to do it, make it better: Ten Recommendations for Security Awareness Programs

Find us on Twitter: @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter.

Tonight, Martin, Joseph, Steve, and Andy got together and went over how their 2015 predictions went, and laid out what their predictions were for 2016.

The gang is on break from now until the new year, happy holidays!

Check for signs of the apocalypse, everyone was here tonight...

Comcast resets nearly 200,000 passwords

In the era of GPS, Naval Academy revives celestial navigation

How Carders Can Use eBay as a Virtual ATM

What Flu Season Can Teach Us About Fighting Cyberattacks

Find us on Twitter: @SFSPodcast @jsokoly @steveD3 @armorguy @jetsetyvette