Exploring Information Security – Exploring Information Security

Summary:

In this episode of Exploring Information Security, host Timothy De Block sits down with Thomas Ritter, a seasoned attorney specializing in cybersecurity and privacy law, to discuss the often-overlooked legal complexities surrounding incident response (IR). From breach terminology to ransomware negotiations, Ritter shares insights from his years of experience navigating legal pitfalls that can arise when responding to security incidents.

Key Takeaways:

• Understanding "Incident" vs. "Breach": Ritter emphasizes the importance of careful communication within an organization during a security incident. Misusing legally significant terms, like "breach," can lead to premature obligations, such as breach notifications, which may have serious consequences for an organization.

• Attorney-Client Privilege in IR: External counsel's role can extend attorney-client privilege over critical aspects of IR, including the involvement of forensic specialists. This protection can prove essential if an incident escalates into litigation.

• Ransomware Negotiation Nuances: With ransomware incidents on the rise, Ritter provides a detailed look at the negotiation process, advising organizations to work with professional negotiators. He recounts instances where attackers leveraged knowledge of clients' cyber insurance coverage to increase ransom demands.

• Tabletop Exercises for IR Preparedness: Ritter highlights the value of tabletop exercises, especially involving executive leadership. He notes that regular, comprehensive drills help organizations refine incident response policies and minimize legal exposure during actual incidents.

• Navigating Class Action Exposure: As data breaches often trigger class action lawsuits, organizations must take steps to prepare, including consulting legal professionals to reduce risk through privilege-protected documentation.

Resources Mentioned:

• International Association of Privacy Professionals (IAPP): A valuable source for privacy and security trends.

• Cybersecurity Law Report: An in-depth publication on current legal issues in cybersecurity.

• Ritter Gallagher Blog: Thomas Ritter’s firm provides regular insights on emerging legal topics in cybersecurity.

About Our Guest:

Thomas Ritter is a cybersecurity and privacy attorney at Ritter Gallagher, where he focuses on helping organizations navigate the legal landscape of security incidents and data breaches. For more information, or to get in touch, visit RitterGallagher.com or email Thomas directly at [email protected].

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

In this holiday edition of the Exploring Information Security podcast, Ed Skoudis joins me to discuss the SANS Holiday Hack Challenge.

Around this time each year the SANS Holiday Hack Challenge releases under the direction of Ed (@edskoudis) and instructor with the SANS institute. This year Santa has been kidnapped and it’s up to use to figure out who did it and save Christmas. The challenge is for new people in infosec, and for those who have been in the industry for many years. As Ed notes in the episode it is even for children. The challenge itself has been around for years and several past years are still available for people to go through.

In this episode we discuss:

• What is the SANS Holiday Hack Challenge

• How it got started

• What preparation goes into making the challenge each year

• Who can participate

[RSS Feed] [iTunes]

In this epic episode of the Exploring Information Security podcast Jayson E. Street (@jaysonstreet), Dave Chronister (@bagomojo), Johnny Xmas (@J0hnnyXm4s), April Wright (@aprilwright), Ben Brown (@ajnachakra), and surprise guests Adrian Crenshaw (@irongeek_adc) and Kevin Johnson (@secureideas)all join me to discuss various security related topics.

ShowMeCon is one of my favorite security conferences. The organizers are awesome and take care of their speakers like no other conference. The venue is fantastic. The content is mind blowing. I can't say enough good things about the even that Dave and Renee Chronister put on every year in St. Louis, Missouri. They know how to put on a conference.

Regular listeners of the podcast will note that I recorded an episode with Dave on ShowMeCon several weeks ago. After that recording he asked if I was interested in doing a recording at the conference. I said yes and thus the birth of this epic episode. This format is experimental. First, it is marked as explicit, because there is swearing. Second, It's over 90 minutes long. I didn't think breaking it up into four or five pieces would serve the recording well. Send me your feedback good or bad on this episode, because I'd like to do more of these. I would really like to hear it for this episode.

In this episode we discuss:

• Certificates

• Hiring

• Interviewing

• Where to get started

• Soft skills

• ShowMeCon and other conferences

• Community and giving back

• Imposter syndrome

• Irongeeks impact on those in attendance

[RSS Feed] [iTunes]

In the refreshed edition of the Exploring Information Security (EIS) podcast, I talk to Amanda Berlin AKA @Infosystir about security awareness. 

Amanda was charged with setting up a security awareness program for her company from scratch. Setting up a security awareness program is hard work, making it effective is even harder, but Amanda rose to the challenge and came up with some creative ways to help fellow employees get a better handle on security.

In this interview we cover:

• What is security awareness?

• How a security awareness program should be implemented.

• What does an effective security program look like?

• How do you measure the effectiveness of a security awareness program

[RSS Feed] [iTunes]

Summary:

In this episode, Dave Chronister, founder of Parameter Security and ShowMeCon, shares valuable insights into the world of penetration testing (pentesting). Listeners will learn about the differences between vulnerability assessments and penetration tests, what red teaming is, and why organizations should lean towards white-box pentests. Dave and Tim discuss how to avoid common pitfalls when engaging with pentest companies, the importance of rules of engagement, and how to ensure you're getting a high-quality test. Dave also shares stories from his 17+ years in the field, illustrating the critical lessons organizations need to understand.

Key Topics Covered:

• Difference between vulnerability assessments and penetration tests.

• Red teaming vs. penetration testing: When and why to use each.

• How to choose the right pentest company.

• The importance of setting clear rules of engagement.

• Real-world examples of pentesting gone wrong.

Resources Mentioned:

• Parameter Security

• ShowMeCon

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this timely episode of Exploring Information Security, host Timothy De Block is joined by Pieter Arntz from Malwarebytes to discuss the growing threat of election-related scams. With election season upon us, scammers are becoming more active, and this episode dives deep into how these scams work, what tactics scammers use, and how to protect yourself from falling victim.

You can check out Pieter’s article How To Avoid Election Related Scams at the Malwarebytes blog.

Key Topics:

• Seasonal Scams: Scams are often timed with key events, including elections, holidays, and tax season. Pieter discusses how scammers shift focus from elections to events like Black Friday or Christmas.

• Common Election Scams: Scammers often target voters through text messages, social media, and robocalls, attempting to steal personal information or solicit fake donations.

• Mobile Devices as a Target: With more focus on mobile devices, Android and Apple users are increasingly targeted through phishing texts and malicious links.

• Social Engineering: Scammers manipulate users by pretending to represent political parties, asking for donations, or engaging in online discussions to steal information.

• Detecting Scams: Pieter and Timothy offer practical advice on identifying scam messages, such as unsolicited communications, urgency in messaging, and phishing links with suspicious domains (e.g., .xyz, .top).

• Who’s Behind These Scams?: The episode touches on the actors behind the scams, ranging from cybercriminal gangs to state actors, and how they profit from fraudulent activities.

• Scams Beyond Elections: While elections are a prime target, natural disasters and other events are also exploited by scammers to steal donations and personal information.

• Privacy Concerns: A survey revealed that 3% of people are hesitant to vote due to privacy concerns, highlighting the critical need for secure election processes.

Key Takeaways:

1. Be Wary of Unsolicited Messages: If you receive unsolicited texts or emails, always double-check the source before acting. Election scams often use urgency to push people into making hasty decisions.

2. Verify Political Donations: Only donate through verified websites. Scammers frequently clone official websites to trick people into giving money to fraudulent causes.

3. Protect Your Personal Information: Avoid sharing personal details through unofficial or unfamiliar channels. Scammers can use this information for identity theft or phishing attacks.

4. Report Scams: If you suspect a scam, report it to organizations like the FTC or the FBI to help others stay safe.

Resources Mentioned:

• Report Fraud – Federal Trade Commission’s fraud reporting site.

• Do Not Call Registry – Sign up to reduce unwanted calls.

• National Association of Secretaries of State – Provides resources on election security.

• FBI Alerts – Stay updated on the latest scams from the FBI.

• Election season raises fears for nearly a third of people who worry their vote could be leaked - MalwareBytes Labs

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Jennifer VanAntwerp shares her journey of sobriety and how it inspired her to create the Sober in Cyber community. They discuss the challenges of navigating industry events saturated with alcohol, tips for staying sober, and how the younger generation's attitude towards alcohol is changing. Jennifer also emphasizes the importance of offering alternative options at events and how the sober community is growing in cybersecurity.

Key Topics Covered:

• Jennifer's personal journey of 23 years of sobriety.

• The impact of alcohol at cybersecurity conferences.

• Tips for avoiding pressure to drink at social events.

• The role of Sober in Cyber in creating inclusive, alcohol-free spaces.

• How companies can support sober individuals.

Resources Mentioned:

• Sober in Cyber

• Mental Health Hackers

Get Involved:

• Join the Sober in Cyber Discord community to connect with others in the industry who are sober or looking to reduce alcohol consumption

• Follow Sober in Cyber on social media for updates on events and community resources

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Timothy De Block chats with Renee DiResta about the role of disinformation in elections, particularly as we approach the 2024 cycle. Renee discusses her work in tracking narratives across social media, how state actors like Russia and Iran manipulate public opinion, and the growing importance of platform integrity in identifying inauthentic behavior.

Check out her book Invisible Rules: The People Who Turn Lies into Reality.

Key Topics:

• The Evolution of Propaganda: How modern disinformation connects to historical propaganda efforts.

• State-Sponsored Disinformation: Tactics used by Russia, Iran, and China in shaping election narratives.

• Platform Integrity Teams: How social media platforms now combat disinformation networks.

• Disinformation Trends: Recurring themes in election-related rumors, such as false claims about voter fraud.

• The Role of Social Media: How users, not just state actors, influence and spread misinformation.

Recommended Resources:

• Digital Forensics Research Lab (DFR Lab)

• Stanford Journal of Trust and Safety

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Timothy De Block and Jonathan Singer dive into the challenges of modern enterprise security. The conversation covers how organizations—using McDonald's as an example—face threats from both digital and physical vectors. They explore how hackers might exploit everything from public Wi-Fi to social engineering tactics and touch on the evolving role of security leaders in dealing with both controllable and uncontrollable risks.

Key Topics:

• Digital & Physical Attack Vectors: Discussion on hacking tactics such as public Wi-Fi, kiosk vulnerabilities, API exploitation, and social engineering.

• Security Beyond the Firewall: Why enterprise security involves more than just digital defense—physical security, insider threats, and brand manipulation also pose risks.

• The Growing Complexity of Security: How new technologies, like IoT devices and AI, are adding layers of complexity to enterprise security.

• Insider Threats & Social Engineering: The impact of internal threats, from disgruntled employees to social engineering attacks, on large organizations.

Rapid-Fire Hacking Vectors:

1. Public Wi-Fi

2. Self-service kiosks

3. Badge cloning

4. Typo-squatting for domains

5. Supply chain dependencies

6. Insider threats

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Timothy De Block chats with Ben Burkert about the challenges of managing internal certificate authorities (CAs) and certificates. Ben shares his experiences working with internal CAs at major companies and how those challenges inspired the creation of Anchor.dev.

Key Topics:

• The Importance of Certificates: Ben explains how certificate mismanagement can lead to outages and business interruptions, and why automation is crucial.

• TLS and ACME: Understanding how TLS secures communications and how ACME clients automate certificate management.

• Anchor.dev: A cloud service that simplifies internal CA management and helps companies secure their internal networks with automated renewals and distribution.

• LCL Host: A tool from Anchor.dev that enables HTTPS in local development environments, improving deployment workflows.

Links:

• Anchor: https://anchor.dev/

• lcl.host: https://lcl.host/

• ACME: https://datatracker.ietf.org/doc/html/rfc8555/

• Let'sEncrypt: https://letsencrypt.org/how-it-works/

• mkcert: https://github.com/FiloSottile/mkcert

• NIST PQ standards: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

This is the last week to register for Tim’s class in 2024 - go to https://www.practisec.com/events/ to get signed up.

In this educational edition of the Exploring Information Security podcast, Tim Tomes joins me to discuss Practical Web Application Pentration Testing (PWAPT) training.

Tim (@LaNMaSteR53) is one of the leading names within the application security field. A former instructor for many organizations, he wanted to do more with training. He wanted to provide attendees to training with more hands on work. Get into an application, exploit it, and then provide remediation steps. He came up with the PWAPT training.

In this episode we discuss

• How the idea for the training came about

• Why the training is important

• Who should attend the training

• What makes this training unique

[RSS Feed] [iTunes]

In this susceptible edition of the Exploring Information Security podcast, Samy Kamkar joins me to discuss how to find vulnerabilities. This is a RERELEASE EPISODE.

Samy (@samykamkar) shouldn't need too much of an introduction to most people. He's been in the news for hacking garage doors, credit cards, cars, and much much more. Samy likes to hack things and has a knack for finding vulnerabilities in everything from locked machines to wireless doorbells. His site has the full list of vulnerabilities as well as videos and press appearances. Which made him the perfect guess for talking about how to find vulnerabilities.

In this episode we discuss:

• What got him started in looking for vulnerabilities

• What is a vulnerability

• What skills are necessary for finding vulnerabilities

• How he decides his next project

• The steps to finding vulnerabilities

• What he does when he discovers a vulnerability

• How long the process takes

[RSS Feed] [iTunes]

Summary:

Patrick Gray, the host of the Risky Business podcast, shares how he transitioned from a tech journalist to a leading voice in cybersecurity podcasting. Patrick discusses the origins of his podcast, the evolution of his content, and how he maintains integrity with sponsors. He also offers advice for aspiring podcasters on focusing on the audience and using the right tools.

Key Topics:

• The unexpected inspiration behind Risky Business.

• Moving from general tech journalism to focused security content.

• The importance of understanding technical details in reporting.

• The growth of the Risky Business team and their venture into video content.

• Navigating sponsorships while maintaining editorial independence.

• Advice for new podcasters: prioritize your audience and use the right tools.

Resources:

• Risky Business Podcast

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Timothy De Block sits down with Ralph Collum, a cybersecurity educator with over a decade of experience in the field. They delve into Ralph's career journey, discussing his transition from a chemist to a cybersecurity professional and the various roles he's taken on, including server administration, auditing, and penetration testing. Ralph shares insights on the importance of soft skills, continuous learning, and the evolving landscape of cybersecurity.

Key Topics Discussed:

• Ralph’s Career Journey

• The Impact of the Pandemic on Cybersecurity Groups

• Getting Into Cybersecurity

• The Role of Soft Skills in Cybersecurity

• The Impact of AI on Cybersecurity Careers

• Resources and Recommendations

Resources Mentioned:

• Books:

  • The Code to the Dead Cow Joseph Menn

  • Spam Nation by Brian Krebs

  • The Art of Invisibility by Kevin Mitnick

  • Social Engineering: The Science of Human Hacking by Christopher Hadnagy

• Websites:

  • Help Net Security

  • Bleeping Computer

  • Hacker News

  • Dark Reading

• Tools:

  • Feedly for organizing cybersecurity news

  • TryHackMe and Hack The Box for practical labs

Connect with Ralph Collum:

• Website: Training Concepts

• Social Media: Instagram, TikTok

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Episode Summary: In this exchanged episode, Timothy De Block chats with Mubix about the intricacies of SIM swapping, an attack vector that has seen significant attention. They discuss the current state of SIM swapping, how attackers exploit this technique, and the measures carriers have implemented to mitigate these risks. Mubix highlights the importance of understanding your risk profile and the practical steps organizations and individuals can take to protect themselves.

Key Topics:

• The evolution and difficulty of executing SIM swapping attacks.

• Real-world examples and the misclassification of SIM swapping incidents.

• The impact of enhanced carrier protections and the role of user awareness.

• The distinction between SIM swapping and other forms of social engineering.

• Practical advice for businesses and high-risk individuals to safeguard against SIM swapping.

Discussion Points:

• SIM swapping detection and reporting procedures.

• The role of eSIMs and potential security concerns.

• The importance of proactive security measures and user empowerment.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this engaging episode, Timothy De Block speaks with Steve Orrin Federal CTO at Intel about the intersection of artificial intelligence and cybersecurity. The conversation delves into the challenges and opportunities that AI presents in the cybersecurity landscape, exploring topics such as deep fakes, disinformation, and the implementation of AI in security practices.

Key Discussion Points:

1. AI in Cybersecurity:

   • The rise of AI in both defensive and offensive cybersecurity strategies.

   • How AI is being used to enhance security measures and identify threats.

2. Deep Fakes and Disinformation:

   • The challenges posed by deep fakes in the current digital landscape.

   • Techniques to detect and counteract deep fakes.

   • The implications of deep fake technology on public opinion and security.

3. Practical AI Applications:

   • Real-world examples of AI in action within cybersecurity frameworks.

   • The role of AI in threat detection and response.

   • Implementing AI to automate routine security tasks, freeing up human resources for more complex issues.

4. Policy and Ethical Considerations:

   • The importance of developing policies for the responsible use of AI.

   • Ethical considerations in deploying AI for cybersecurity purposes.

   • Balancing innovation with security in AI development.

5. Future of AI and Cybersecurity:

   • Upcoming trends in AI and their potential impact on cybersecurity.

   • The evolving nature of cyber threats and how AI can adapt to these changes.

   • The need for continuous learning and adaptation in the face of rapidly advancing technology.

Resources Mentioned:

• OWASP

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this automatic episode of Exploring Information Security, Timothy De Block talks with Mark Baggett about automating information security tasks using Python. They delve into the SANS SEC573 and SEC673 courses, which cover Python basics, advanced automation techniques, and real-world applications. Mark shares insights on using AI for coding, highlights his YouTube series "Infosec Tool Shed," and discusses upcoming workshops and conferences. The conversation also touches on the importance of Python in information security and practical experiences in automating security tasks.

Key Discussion Points:

• Mark's journey in automating security tasks with Python.

• Overview of SANS SEC573 and SEC673 courses.

• Practical applications of Python in information security.

• Using AI for coding and debugging.

• Mark’s YouTube series "Infosec Tool Shed."

• Upcoming workshops and conferences.

Links and Resources:

• SANS SEC573 Course: https://www.sans.org/cyber-security-courses/automating-information-security-with-python/

• SANS SEC673 Course: https://www.sans.org/cyber-security-courses/advanced-information-security-automation-with-python/

• Infosec Tool Shed YouTube Series: https://www.youtube.com/@markbaggett/videos

• Upcoming Workshop Registration 31 July, 2024: https://www.sans.org/webcasts/advanced-python-automation-hands-on-workshop-2024/

• B-Sides Augusta Conference: https://bsidesaugusta.org/

• Cyber Security Training at SANS Network Security Las Vegas 2024: https://www.sans.org/cyber-security-training-events/network-security-2024/

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this off-the-cuff episode, Timothy De Block brings a mic to the floor of ShowMeCon for the first-ever HallwayCon podcast episode. He walks around with a mic and recorder, engaging in spontaneous conversations with random attendees. Timothy highlights the immense value of attending security conferences, emphasizing that these real, impromptu conversations with professionals are crucial for expanding knowledge and building relationships within the industry. This unique approach captures some just some of the many conversations going on at security conferences.

Key Topics Discussed:

1. Importance of Networking:

   • Knowing your target employers and daily tasks.

   • Overcoming the fear of talking to strangers.

2. Effective Techniques:

   • Asking engaging questions.

   • Volunteering and getting involved.

3. Conference Culture:

   • Evolution of conference attire.

   • Balancing business and casual environments.

4. Career Challenges:

   • Job market difficulties for younger and older professionals.

   • Role of networking in career advancement.

5. Humorous Stories:

   • Conference experiences and unique attire.

   • Creative uses of business cards.

6. Management Insights:

   • Effective management and hiring practices.

   • Importance of structured onboarding.

7. Impact of AI:

   • AI’s role in security and deepfake technology.

   • Future relevance in cybersecurity.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, we sit down with Geoff Hill from Tutamantic_Sec to explore the innovative approach of Rapid Threat Model Prototyping (RTMP). Geoff shares his journey from being a C++ developer to becoming a threat modeling expert, highlighting the challenges and successes he encountered along the way. This episode dives deep into how RTMP can help streamline threat modeling processes, making them more efficient and scalable.

Key Discussion Points:

1. Introduction to RTMP:

   • Geoff explains the origins and the need for a new threat modeling approach.

   • Discussion on traditional threat modeling challenges and how RTMP addresses them.

2. Implementation and Benefits:

   • Detailed walkthrough of RTMP’s implementation in various organizations.

   • How RTMP integrates with existing development workflows like Agile and DevOps.

   • Benefits of using RTMP, including reduced workload on security teams and improved security posture.

3. RTMP Methodology:

   • Explanation of the stages and numerical ranking system in RTMP.

   • How RTMP utilizes open-source frameworks and tools.

   • The role of security champions within development teams.

4. Practical Applications and Case Studies:

   • Real-world examples of RTMP in action.

   • Success stories and lessons learned from implementing RTMP in different industries.

5. Future of Threat Modeling:

   • Geoff’s insights on the evolution of threat modeling.

   • Upcoming trends and the importance of being proactive in security.

Resources Mentioned:

• Tutamantic

• GitHub Repository for RTMP

• OWASP Top 10

Connect with Geoff Hill:

• Twitter: @Tutamantic_Sec

• LinkedIn: Geoff Hill

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Timothy De Block sits down with Ed Rojas to discuss the origins and development of the Ransomware Defense Initiative (RDI). They explore Ed’s motivation behind creating RDI, its evolution, and how it aids organizations in proactively combating ransomware threats.

Key Topics Discussed:

• Origins of RDI: Ed explains his drive to identify effective controls against ransomware, focusing on proactive measures rather than reactive strategies.

• Research Findings: Insights from extensive research on ransomware techniques and the identification of key controls.

• Implementation: How RDI assists organizations in assessing their maturity and readiness against ransomware attacks.

• Use Cases: Examples of how companies and new CISOs can utilize RDI for rapid assessment and strategic planning.

• Future Developments: Upcoming features and improvements in RDI to enhance its utility and accessibility.

Quotes:

• “I wanted to identify a set of controls that everyone should have implemented to be okay against ransomware.”

• “Most recommendations focus on recovery. I wanted to focus on how we detect and mitigate ransomware attacks as early as possible.”

Resources Mentioned:

• RDI Shield

Contact Information:

• Ed Rojas: Connect with Ed on LinkedIn.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this dynamic episode, host Timothy De Block engages in a lively conversation with Joey Smith, Tim McLaren, and Ben Miller live from the floor of Show Me Con 2024. They discuss various topics including the importance of trust in vendor relationships, the evolution of security roles, and the innovative approaches being adopted in the food industry.

Episode Highlights:

Conversations with Industry Experts:

• Spontaneous discussions about the importance of genuine interactions at conferences.

• Joey's perspective on the value of treating vendors with respect and professionalism.

Insights from Tim McLaren:

• Tim shares his experience transitioning from a vendor-specific role to a broader consultancy position.

• Discussion on the importance of having diverse solutions and the role of trust in customer relationships.

Ben Miller's Take:

• Ben emphasizes the need for critical thinking and continuous learning in security roles.

• Reflections on how past experiences shape current practices in cybersecurity.

Vendor Relationships and Trust:

• The group discusses the significance of building long-term, trust-based relationships with vendors.

• Examples of how trust influences decision-making and security practices.

Innovations in Security:

• Conversations on how emerging technologies and innovative solutions are reshaping the cybersecurity landscape.

• Joey's insights on the latest advancements and their implications for the industry.

Key Quotes:

• "Trust is between two people. I don't trust the business or a line of questioning; I trust the individuals behind it." - Joey Smith

• "Critical thinking and adaptability are essential in the ever-evolving field of cybersecurity." - Ben Miller

Recommended Resources:

• ShowMeCon

• GuidePoint Security

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this insightful episode, Timothy De Block sits down with Jack Jones, the creator of the Factor Analysis of Information Risk (FAIR) model. Jack shares his journey and the challenges he faced that led to the creation of FAIR, a groundbreaking framework for understanding and quantifying information risk.

Episode Highlights:

Introduction to FAIR:

• FAIR stands for Factor Analysis of Information Risk.

• It is a logical decomposition of the factors that drive how much loss exposure a scenario represents.

Jack's Catalyst for Creating FAIR:

• The need for a quantifiable measurement of risk during his tenure as a CISO at Nationwide Insurance.

• The pivotal moment when an executive asked him to quantify the organization's risk exposure.

Understanding Quantitative vs. Qualitative Risk:

• Quantitative risk involves using units of measurement like percentages and dollar amounts.

• Qualitative risk is ordinal and involves categories like high, medium, and low without precise measurement units.

Applying FAIR in Organizations:

• The process of using FAIR starts with understanding the decision you need to support, scoping the scenario, identifying assets, threats, and controls, and using ranges to estimate frequency and impact.

• FAIR helps in prioritizing risks and determining the ROI on security investments.

Challenges and Solutions in Using FAIR:

• Common challenges include the perception that perfect data is needed, the skills gap, and the complexity of scaling quantitative analysis.

• Leveraging community resources, training, and new automated solutions from vendors can help overcome these challenges.

Resources and Training:

• The FAIR Institute offers free membership and extensive resources.

• The Open Group provides professional certification and training materials.

• The book "Measuring and Managing Information Risk: A FAIR Approach" is a recommended read.

Key Quotes:

• "FAIR is about critically thinking about risk. The quantitative measurement is a bonus, but it's really a framework for thinking more clearly about the scenarios we need to manage against." - Jack Jones

• "Protecting applications from session hijacking involves understanding the application's handling of temporary credentials and implementing robust security measures." - Jack Jones

Recommended Resources:

• FAIR Institute

• The Open Group

• Book: Measuring and Managing Information Risk: A FAIR Approach

• Jack Jones on LinkedIn

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode of Exploring Information Security, Chris Hadnagy and Shane McCombs join the podcast to discuss the Innocent Lives Foundation (ILF). They delve into the challenges of running a nonprofit focused on identifying and reporting online predators, the importance of volunteer mental health, and their personal experiences and motivations behind ILF.

Episode Highlights:

• Challenges of Running ILF: Chris and Shane discuss the operational complexities and the importance of back-end work, including finances and CPA dealings.

• Volunteer Involvement and Mental Health: Emphasis on mandatory wellness sessions for volunteers to ensure their mental well-being while dealing with disturbing content.

• Personal Journeys and ILF’s Growth: Chris shares his unexpected journey from founding ILF to growing it with 40 volunteers and collaborating with the FBI.

• Board Member Contributions: Stories about diverse board members, including actors and professionals from various fields contributing to ILF’s mission.

• Prevention and Education Efforts: Shane highlights ILF's focus on preventing exploitation through education and engaging with parents and schools.

Quotes:

• "Your children need to see you as their advocate, not their adversary." - On the importance of parental support in preventing exploitation.

Resources:

• Visit Innocent Lives Foundation to get involved or donate.

• Sign up for the 2nd Annual Ending Child Exploitation Gala in Los Angeles, CA, September 21, 2024.

Social Media:

Instagram

Facebook

LinkedIn

YouTube

Twitch

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this informative episode, Timothy De Block discusses session hijacking with Web Application Security Engineer and PractiSec Founder Tim Tomes. The discussion delves into the intricacies of session hijacking, exploring its mechanics, vulnerabilities, and prevention strategies.

Tim’s website: https://www.lanmaster53.com/

You can reach out to Tim for Training, Consulting, Coaching, Remediation Support, and DevSecOps.

Episode Highlights:

• Understanding Session Hijacking:

  • Tim Tomes clarifies the common misconceptions about session hijacking, emphasizing its relation to temporary credentials rather than sessions alone.

  • The conversation covers the technical aspects, including how sessions and tokens are hijacked, and the role of cookies in managing temporary credentials.

• Technical Mechanisms and Vulnerabilities:

  • Detailed explanation of how session hijacking occurs, focusing on temporary credential management and the vulnerabilities that allow hijackers to exploit these credentials.

• Prevention and Security Best Practices:

  • Strategies to prevent session hijacking, such as secure management of tokens and sessions, are discussed.

  • Importance of using flags like HTTPOnly and Secure to protect data transmitted in cookies.

• Common Tools and Exploitation Techniques:

  • Tim Tomes discusses common tools like Burp Suite and its Collaborator tool for detecting and exploiting session hijacking vulnerabilities.

• Real-world Application and Examples:

  • Practical insights into how session hijacking is executed in the real world, including Tim’s personal experiences and how these vulnerabilities are identified during security assessments.

Key Quotes:

• "Session hijacking is not just about stealing sessions; it's about exploiting the temporary credentials that represent a user." - Tim Tomes

• "Protecting applications from session hijacking involves understanding the application's handling of temporary credentials and implementing robust security measures." - Tim Tomes

Recommended Resources:

• OWASP Guide on Session Management

• Web Security Academy by PortSwigger

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode, Mike Holcomb discusses the intricacies of Industrial Control Systems (ICS) and Operational Technology (OT) security. Michael provides a comprehensive overview of the challenges and strategies associated with securing ICS and OT environments.

Episode Highlights:

• Michael discusses the evolution of the Bsides Greenville event, emphasizing the incorporation of OT topics and the balance they aim to maintain between IT and OT content.

• Michael shares insights into the unique cybersecurity challenges faced by different sectors, including manufacturing and power plants.

• A deep dive into network architecture in ICS environments reveals the importance of segmentation and controlled access between IT and OT networks.

• Michael emphasizes the critical nature of asset management and network monitoring in maintaining security in ICS environments.

• The conversation also covers the increasing convergence of IT and OT systems and the implications for security.

• Michael touches on the impact of ransomware on ICS environments and the need for robust incident response plans.

Guest Biography: Mike Holcomb is a seasoned expert in ICS and OT security, with extensive experience in developing and implementing security strategies in some of the world's largest industrial environments. He has contributed significantly to the field through education and practical solutions to enhance infrastructure resilience.

Resources Mentioned:

• Mike Holcomb’s website

  • Free eBooks - Mike mentions that he has written free eBooks on getting started in ICS and OT cybersecurity, tailored for those coming from IT backgrounds and those from engineering or automation backgrounds.

• YouTube Course - A free 25-hour course available on YouTube, designed to help beginners in ICS and OT cybersecurity.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this relaxed and engaging episode recorded from air loungers at Show Me Con, Timothy De Block catches up with Amanda Berlin from Mental Health Hackers during Mental Health Awareness Month. They discuss the importance of mental health in the IT security industry, which is often fraught with stress and high demands.

Episode Highlights:

1. Personal Stories of Mental Health: Timothy and Amanda share their personal experiences with mental health challenges, emphasizing the common struggles many face in the IT security field.

2. Impact of Alcohol: The discussion explores the impact of alcohol on mental health, particularly how it affects sleep and stress levels. They touch upon efforts to create event spaces that offer alternatives to alcohol-centric activities.

3. Mental Health Hackers: Amanda talks about the work of Mental Health Hackers, a group that attends various conferences to provide spaces for people to relax and decompress.

4. Fundraising and Awareness: Mention of Mental Health Hackers' new t-shirt campaign designed to promote mental wellness, with proceeds supporting their activities at conferences. You can get T-Shirts here: https://www.customink.com/fundraising/mental-health-awareness-for-mhh

Key Quotes:

• "It’s really about awareness... paying attention to how habits like drinking can impact our mental state and sleep." - Timothy De Block

• "We need to create environments at events where drinking isn’t the main focus, allowing people to enjoy without the pressure of alcohol." - Amanda Berlin

Additional Resources:

• Mental Health Hackers Website: Visit Here

• Blumira: Visit Here

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this insightful episode of Exploring Information Security, Troy Hunt, the creator of the widely recognized website, Have I Been Pwned (HIBP) talks about the origins and evolution of the service. Troy discusses his transition from writing about application security to developing HIBP and delves into the impacts of data breaches on both individuals and companies.

Episode Highlights:

• Impact of HIBP: Troy shares insights on how HIBP has evolved into a crucial tool for internet users to check if their data has been compromised in various data breaches.

• Community Interaction: Discussion on how the community aids in identifying new breaches and the collective effort to maintain data integrity and security awareness.

• Legal and Ethical Considerations: Troy talks about navigating legal challenges and ethical dilemmas in disclosing breaches and interacting with affected companies.

• Technical Insights: An exploration of the technical aspects of running HIBP, including dealing with massive datasets and implementing security measures to protect stored data.

Additional Resources:

• Have I Been Pwned: Visit HIBP

• Blog posts by Troy Hunt for further reading on cybersecurity and breach analysis.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this episode of Exploring Information Security, Security Engineer Kyle Goode takes a deep dive into the versatile world of pfSense, a robust open-source firewall and router that has been a mainstay in the network security arena for over two decades. Kyle shares insights from his own experiences with pfSense, exploring both the practical and technical aspects of setting up and managing a pfSense system.

Episode Highlights:

• Setting Up pfSense: Practical tips on how to set up pfSense on different types of hardware, and troubleshooting common setup issues.

• Security Customizations: Detailed discussion on customizing pfSense for enhanced security, including the use of threat feeds and SSL inspection.

• Maintenance and Updates: Tips on maintaining a pfSense installation, including regular updates and leveraging community resources for troubleshooting.

• Benefits of Using pfSense: A look at the benefits of using pfSense over commercial routers, especially for those interested in a deeper understanding of network security.

Resources:

• https://bsidesnash.org

• Network Chuck Pfsense

• Lawrencesystems

• Netgate pfsense docs 

• Ben Heater Pfsense and Wazuh   

• SecurityOnion and Pfsense

• Crowdsec and Pfsense

• Netgate depreciation of squid 

• Squid updated package

• Pfsense going to the linux kernel 

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this enlightening episode of the Exploring Information Security podcast, we dive deep into the world of deepfakes with Dr. Donnie Wendt. With a background in cybersecurity at MasterCard, Dr. Wendt shares his journey into the exploration of deepfake technology, from setting up a home lab using open-source tools to presenting the potential business impacts of deepfakes to leadership teams.

Key Discussions:

• What are Deepfakes? Dr. Wendt explains the basics of deepfakes, a technology that uses machine learning to superimpose someone's likeness onto another person, creating realistic fake videos or audio recordings. Initially used for nefarious purposes, the technology has found applications in politics, social engineering, and entertainment.

• Creating Deepfakes: Discover how Dr. Wendt utilized open-source tools and a good Nvidia video card to experiment with deepfake creation, including making Nicholas Cage a regular "guest" in security briefings at MasterCard.

• The Threat Landscape: Dr. Wendt discusses the use of deepfakes in political manipulation and fraud, highlighting recent instances where deepfakes have influenced elections and scammed individuals and businesses out of large sums of money.

• Detection and Prevention: The conversation touches on the challenges of distinguishing deepfakes from real footage, emphasizing the importance of skepticism, critical thinking, and verification processes to combat misinformation.

• Positive Applications: Despite their potential for misuse, deepfakes also have beneficial uses, such as giving voice back to ALS patients, recreating historical speeches, and aiding medical diagnosis. Dr. Wendt stresses the importance of recognizing the technology's positive impact alongside its threats.

Episode Highlights:

• Dr. Wendt's firsthand experience with creating deepfakes and the technical requirements for doing so.

• Insight into the evolving capabilities of deepfake technology and the cat-and-mouse game between creators and detectors.

• The significance of robust verification processes within organizations to safeguard against deepfake-related fraud.

Resources Mentioned:

• Faceswap.dev: An open-source tool for experimenting with different deepfake creation algorithms.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this compelling episode of the Exploring Information Security podcast, we sit down with Joe Weiss, a seasoned expert in control systems security, to unravel the complexities and challenges facing the security of Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems today.

Key Topics Discussed:

• Understanding SCADA/ICS: Joe Weiss provides an in-depth explanation of what SCADA and ICS are, emphasizing their critical role in monitoring and controlling physical processes across various industries, from utilities to manufacturing.

• The Security Gap: Weiss outlines the fundamental security gap existing between traditional IT cybersecurity measures and the unique needs of control systems. He highlights the dire consequences of neglecting the security of these systems, including potential physical damage and disruptions to critical infrastructure.

• Bridging the Divide: The conversation delves into the challenges of bridging the knowledge and communication gap between IT professionals and engineers. Weiss stresses the importance of integrating engineering insights with cybersecurity practices to protect control systems effectively.

• Historical Oversights and Current Challenges: Reflecting on over two decades of experience, Weiss discusses how historical oversights and the prioritization of IT security have led to vulnerabilities in control systems. He calls for a paradigm shift in how organizations and governments approach the cybersecurity of physical infrastructure.

• Future Outlook and Solutions: Looking ahead, Weiss offers insights into the future of control systems security, advocating for education, awareness among senior management, and the need for a holistic approach that encompasses both the digital and physical aspects of security.

Episode Highlights:

• A Call to Action for Senior Management: Weiss underscores the critical need for senior management in both the private and public sectors to recognize the existential threat posed by inadequate control systems security.

• The Importance of Engineering Knowledge: The discussion emphasizes the need for cybersecurity professionals to possess a foundational understanding of engineering principles to secure control systems effectively.

• Practical Steps Forward: Weiss suggests practical steps for improving the security posture of control systems, including enhancing cross-disciplinary education, fostering collaboration between IT and engineering teams, and adopting security measures tailored to the unique characteristics of control systems.

Resources:
Blog: Control Global - Unfettered

Applied Control Systems

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Welcome to a special edition of the Exploring Information Security podcast, where we dive into the intricacies of cybersecurity with industry veteran Jeff Man! A distinguished figure in cybersecurity Jeff has a wealth of experience that spans over four decades, including his early years at the National Security Agency and extensive work in the private sector.

This podcast sponsored by ShowMeCon.

Key Discussions:

• Jeff's Journey: From his initial steps in the cybersecurity realm at the NSA to becoming a pivotal player in the payment card industry, Jeff shares his rich journey and the lessons learned along the way.

• The Essence of PCI DSS 4.0: With the imminent rollout of PCI DSS version 4.0, Jeff breaks down the major changes and what organizations need to focus on to remain compliant. He emphasizes the shift towards continuous security practices over checkbox compliance.

• Tales from the Crypt(analyst): Jeff gives us a sneak peek into his upcoming keynote at ShowMeCon, titled "Tales from the Crypt(analyst)," where he'll explore his cybersecurity adventures and the evolution of cyber threats and defenses over the years.

• The Cloud Misconception: A discussion on common misconceptions about cloud security and the continuous responsibility of organizations to secure their cloud environments.

• PCI as a Framework for Critical Infrastructure: Jeff argues that the PCI DSS, often seen merely as a compliance standard, holds the potential to serve as a robust security framework for various industries, including critical infrastructure.

Episode Highlights:

• Advice from a Veteran: Jeff shares invaluable insights on the importance of understanding cybersecurity history to better navigate current and future challenges.

• The Reality of Compliance and Security: Through anecdotes and personal experiences, Jeff illustrates the often-overlooked aspects of implementing and maintaining security measures effectively.

• A Look Ahead: With PCI DSS 4.0 set to redefine compliance standards, Jeff offers practical advice for organizations to adapt and evolve their security posture.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this engaging episode Jayson E. Street, a renowned cybersecurity expert, joins me to discuss the return of ShowMeCon, the impact of AI in cybersecurity, and innovative strategies for enhancing security and combating threats. Jayson shares his excitement for ShowMeCon, insights on utilizing AI for security enhancements rather than traditional attacks, and offers practical advice for users, executives, and information security professionals.

This podcast sponsored by ShowMeCon.

Episode Highlights:

• ShowMeCons return

• Utilizing AI in Cybersecurity

• Creative Use of AI for Security

• Practical Security Tips Across the Board

• The Future of AI in Security

Guest Information:

Jayson E. Street referred to in the past as: A "notorious hacker" by FOX25 Boston, "World Class Hacker" by National Geographic Breakthrough Series and described as a "paunchy hacker" by Rolling Stone Magazine.

He however prefers if people refer to him simply as a Hacker, Helper & Human.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Scott Miller, a fresh voice in the cybersecurity arena, joins me to discuss the intricacies of hacking Azure services. Scott shares his journey from a recent college graduate to becoming a speaker at cybersecurity conferences, along with valuable insights into Azure AD (Active Directory), vulnerabilities within cloud services, and the art of escalation.

This episode sponsored by ShowMeCon.

Episode Highlights:

• Scott's Entry into Cybersecurity

• Focus on Azure AD

• Exploring Vulnerabilities

• Methodology and Tools

• Learning and Resources

• The Importance of Entry-Level Accessibility

Scott Miller Penetration Tester at Accenture

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

In this captivating episode of the "Exploring Information Security" podcast, cybersecurity expert Paul Coggin discusses the intricate world of threat hunting in SCADA networks and the emerging frontier of space cybersecurity. From the inspiration drawn from Transformers movies to the sophisticated attacks like Stuxnet, Coggin delves deep into how monitoring physical indicators could revolutionize our approach to cybersecurity in both terrestrial and extraterrestrial domains.

This podcast is sponsored by ShowMeCon.

Episode Highlights:

• The significance of ShowMeCon in filling the void left by other conferences.

• Paul's historical involvement and contribution to the naming of ShowMeCon and DerbyCon.

• The Internet of Military Things

• Initiating Threat Hunting in New Domains

• Case Studies and Practical Applications

• Looking Ahead: Cybersecurity in Space

Guest Information:

Paul Coggin is a Cyber SME at nou Systems, Inc.

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Arnar is not a speaker this year at ShowMeCon but he will be in attendance. He doesn’t work in the security field but he’s doing some really advanced stuff with cooling in cloud environments. We get into a little bit of everything around what he’s doing as well as talk about AI. Surprise!

This podcast is sponsored by ShowMeCon.

Episode Highlights:

• What Arnar is looking forward to at ShowMeCon

• Some of the cool things he’s doing with his company

• AI

Guest Information:

Arnar

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Amanda Berlin is Lead Incident Detection Engineer at Blumira, where she leads the development of new detections for the Blumira platform, based on threat intelligence and research. In this episode I catch up with her to talk about Sysmon and ShowMeCon. Sysmon is such a great tool for getting more information out of your systems. The best part is it’s free.

This podcast is sponsored by ShowMeCon.

Episode Highlights:

• What is Sysmon

• How to use Sysmon

• ShowMeCon

Guest Information:

Amanda Berlin is Lead Incident Detection Engineer at Blumira

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Veteran conference speaker Johnny Xmas joins me to discuss ShowMeCon and his talk Couch to Compromise the 2024 edition. His talk is an update from previous years which goes over the latest attacks impacting organizations.

Episode Highlights:

• ShowMeCon

• Couch to Compromise 2024 talk

Guest Information:

Johnny Xmas: The Most Interesting Man in Information Security

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Shameer Amir AKA Titan joins me to discuss his upcoming talk on his research into bypassing multifactor authentication (MFA) at the upcoming ShowMeCon conference. In this episode we talk about a variety of different ways of bypassing MFA from human interaction to more technical interactions with the platforms. A lot of what it comes down to is making sure MFA is setup properly.

Episode Highlights:

• Why this talk

• Response manipulation

• SIM jacking

• Misconfigurations

Guest Information:

Shameer Amir AKA Titan is a globally recognized bug hunter

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Micah Hoffman and Griffin Glynn from My OSINT Training join me to talk about the current state of OSINT. Both bring a wealth of knowledge and first meet while working together at the National Child Protection Task Force. They bring a wealth of knowledge and we get into a lot of the ins and outs of OSINT.

Episode Highlights:

• What is OSINT?

• What tools are used for OSINT

• Social media changes?

• How do APIs play into OSINT?

• How is AI impacting OSINT?

Guest Information:

Micah Hoffman and Griffin Glynn co-owners of My OSINT Training environment and co-workers at National Child Protection Task Force (NCPTF)

https://twitter.com/myosinttrainer

https://www.linkedin.com/company/my-osint-training

https://www.myosint.training

Resources and Mentions:

• Free OSINT Newsletter

• Free intro to OSINT course

• The Ultimate OSINT Collection

• Cloud browser desktop for OSINT

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Rob Fuller AKA Mubix joins me to talk about security tooling every organization should have. This was a result of a discussion Rob and I were having about Thinkst Canary and RunZero. Two fantastic tools that are low cost, easy implementation, and provide a ton of value to a security team.

Episode Highlights:

• Lots of tooling to talk about

• You might hear Rob mention that he’s used one of the tools I suggest in a pentest engagement

Guest Information:

Rob Fuller aka Mubix - Twitter

https://malicious.link/

Resources and Mentions:

RunZero

• https://www.runzero.com/

• Canaries (Thinkst)

• https://canarytokens.org/

• https://canary.tools/

• Shodan.io

• https://www.shodan.io/

• OSQuery / Fleet

• https://github.com/fleetdm/fleet

• https://fleetdm.com/

• Netbird / TailScale

• https://netbird.io/

• https://tailscale.com/

• Sysmon / GrayLog / Logstash / Cribl / Zeek / Wazuh

• https://github.com/SwiftOnSecurity/sysmon-config

• https://graylog.org/

• https://www.elastic.co/logstash

• https://cribl.io/

• https://zeek.org/get-zeek/

• https://wazuh.com/

• Security Onion

• GoDot - Game Dev -> Security Awareness / Security Appreciation

• https://godotengine.org/

• PDQ

• https://www.pdq.com/ 

• GOAD

•  https://github.com/Orange-Cyberdefense/GOAD

• Velociraptor

• https://docs.velociraptor.app/training/

• MISP

• https://www.misp-project.org/

LinkedIn Suggestions

• WisQuas - Lost Rabbit Labs - Noa Park suggestion

• https://www.lostrabbitlabs.com/wisquas 

• Deprovisioning tool - Arvil Nagpal - Abbey Labs

  • https://www.abbey.io/
    

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

This is a sponsored podcast by ShowMeCon which is May 13th & 14th. Tickets are still available! They’re also still looking for sponsors. Don't miss out on this opportunity to be part of the cybersecurity event of the year! Whether you're looking to learn, network, or elevate your brand, ShowMeCon is the place to be.

Summary:

Brandon Potter joins me to discuss the different ways he’s seeing MFA bypassed as part of his companies work. Attackers are using old and new techniques to discover creative ways to bypass MFA. This is a result of more companies getting onboard with MFA. Unfortunately, that means attackers are going to start to find more ways to bypass MFA. A lot of what Brandon is seeing is coming down to misconfiguration with how MFA is implemented and attackers are starting to use browser in the middle to hijack sessions. Finally, we go over how AI is going to impact MFA.

Episode Highlights:

• ShowMeCon one of the few conferences in the Midwest to attend

• Bypassing MFA

• Misconfigurations in MFA

• Browser-in-the-middle

• Where is MFA being bypassed?

• How is AI going to impact bypassing MFA

Guest Information:

Brandon Potter (CISSP, GSEC, GCIH, CCFP, GWAPT) is the Chief Technology Officer of ProCircular, Inc.,

Brandon Potter LinkedIn

ProCircular Website

ProCircular LinkedIn

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Tyron Kemp Presales Engineer at Thinkst Canary joined me to discuss what is a canary. More specifically Thinkst Canaries which is one of the most useful and simple to use tools in the security space. I’m surprised I haven’t heard of more companies using the tool. You drop it in an environment and if you get people scanning or touching it alerts the people that can respond. It’s as simple as that.

Episode Highlights:

• What is a canary?

• How are canaries used?

• How Thinkst contributed to the community through free tools like Log4j discovery

• How do canaries get implemented?

• What’s ahead for Thinkst?

• How AI will impact canaries

Guest Information:

Tyron Kemp Presales Engineer at Thinkst Canary - LinkedIn

Resources and Mentions:

• Thinkst Canary - Tools site

• Thinkst Canary - Hardware site

• Canary Love - Customer feedback site

• ThinkstScapes - Quarterly report on the latest from security conferences

• Twitter

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

This is a sponsored podcast by ShowMeCon which is May 13th & 14th. Tickets are still available! They’re also still looking for sponsors. Don't miss out on this opportunity to be part of the cybersecurity event of the year! Whether you're looking to learn, network, or elevate your brand, ShowMeCon is the place to be.

Summary:

Kevin Johnson the Chief Executive Officer of Secure Ideas joined me to discuss ShowMeCon and his keynote presentation on the infosec community rising from the ashes like a phoenix. It’s been a while since I’ve had the opportunity to catch up with Kevin but we got right into it and had a lot of great laughs. It’s a little all over the place with talk about ShowMeCon, reincarnation, and John Wick as a romantic comedy. Also, there is an EXPLICIT tag on this podcast.

Check the episode highlights below for a jingle on the topic.

Episode Highlights:

(Verse 1)
🎶 In the world of cyber, there's a place to be,
ShowMeCon's the event, in the tech sea.
Kevin Johnson's leading, with a tech-savvy crew,
Bringing folks together, showing what they can do. 🎶

(Chorus)
🎵 ShowMeCon, ShowMeCon, where the tech minds meet,
Diving deep in cyber streets, where challenges and passions greet.
From the ashes, we will rise, like a phoenix, bold and wise,
ShowMeCon, the stage is set, for a tech adventure you won't forget. 🎵

(Verse 2)
🎶 Imagine John Wick, with a softer side,
In a rom-com twist, where love and action collide.
He's hacking through the heart, with a smile so wide,
At ShowMeCon, where worlds of tech and romance abide. 🎶

(Bridge)
🎵 Rising from the ashes, with the phoenix's flight,
We'll conquer cyber battles, in the neon light.
Kevin Johnson guides us, through the digital night,
At ShowMeCon, we'll learn, we'll grow, and take our dreams to height. 🎵

(Chorus)
🎵 ShowMeCon, ShowMeCon, where the future's bright,
Join us in the journey, in the quest for cyber might.
From the ashes, we will rise, with our hearts and minds entwined,
ShowMeCon, where dreams take flight, and every moment's a delight. 🎵

Guest Information:

Kevin Johnson is the Chief Executive Officer of Secure Ideas. Kevin has a long history in the IT field including system administration, network architecture and application development. He has been involved in building incident response and forensic teams, architecting security solutions for large enterprises and penetration testing everything from government agencies to Fortune 100 companies. In addition, Kevin is a faculty member at IANS and was an instructor and author for the SANS Institute.

Resources and Mentions:

Secure Ideas

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Frank Catucci CTO & Head of Security Research at Invicti is someone who I go back with many years. We both meet while working for the state of South Carolina. I was happy to see him end up at Invicti because I think they have a great podcast focused primarily on Dynamic Application Security Testing (DAST). We get into a variety of topics in this episode around MoveIT, implementing DAST, APIs, and AI.

Episode Highlights:

• How DAST could have helped with MoveIT

• How to implement DAST into the SDLC

• Automation that can be setup with DAST

• How tickets from DAST should be handled

• How AI is going to change DAST

• How DAST handles APIs

Guest Information:

Frank Catucci CTO & Head of Security Research at Invicti - LinkedIn

Resources and Mentions:

• Invicti’s main website

• Invicti’s blog

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Rob Fuller aka Mubix joins me to discuss what is Mimikatz? This came from some research I was doing online about hacker tools. I went to the Mimikatz GitHub repo and was immediately hit with a warning that it was a malicious site. Then I looked at the GitHub page and noticed it hadn’t been updated in years.

This lead me to reach out to Hacker Historian Mubix to get the skinny on Mimikatz. He provided some interesting not well known insights that you’ll have to listen to the episode to hear.

Episode Highlights:

• Why Mimikatz is still around

• What is Mimikatz?

• How is it used?

• How to detect Mimikatz

Guest Information:

Rob Fuller aka Mubix

Resources and Mentions:

• Mimikatz GitHub

• Active Directory Security - Mimikatz

• Red Team Wiki

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Kyle Andrus is a seasoned incident responder for a top 500 company. He’s a regular on the podcast when I need to talk incident response and specifically phishing. I last had him on over five years ago to talk about building a malicious link clicker which I used quite a bit in my day-to-day job. Fast forward several years and things have changed significantly.

A lot of the things we used to do no longer make sense because tooling has become much better in the enterprise. A lot of security professionals operate there to respond to phishing emails. While our lives are a littler easier that has led to a new set of threats that the security community hasn’t quite gotten their hands wrapped around the newer problems. Finally, we go over how AI is going to impact phishing. I’m sure that will be a question for more many more podcasts.

Episode Highlights:

• How has phishing response changed?

• How we respond to phishing emails

• The mobile device blind spot

• What’s new in phishing techniques

• How AI is going to impact phishing

Guest Information:

Kyle Andrus

#MISEC

Resources and Mentions:

• URL Scanner

• Virus Total

• How to build a malicious link clicker

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Tim Fowler is an offensive security person at Black Hills Information Security who also happens to be a space nerd thanks to Paul Coggin. I was sitting at the table with Tim at BSides Nashville when Paul planted the seed of satellite hack. Fast forward several hundred hours later and Tim has put together a lot of content on the topic including training for 2024.

He makes a compelling case for why we should care about security in space. Mainly, that it’s the next frontier. After spending over an hour talking to him I completely agree. It’s a path that we’re destined to head and a lot of the big companies are already moving that way. This is also a heavily unexplored space for people looking to get into an emerging field this is it.

Episode Highlights:

• The history of space and the objects up there

• Why we should care about security in space

• The issues with satellite security

• How to hack a satellite

• How to secure objects in space

Guest Information:

Tim Fowler, Offensive Security Analyst and Space Nerd at Black Hills Information Security

Resources and Mentions:

Cybersecurity for Space by Jacob G. Oakley

Open Source global network of satellite ground-stations

https://satnogs.org/

Hack-a-sat CTF

https://hackasat.com/

https://github.com/cromulencellc/hackasat-finals-2023

https://github.com/cromulencellc/hackasat-qualifier-2023-techpapers

https://github.com/cromulencellc/hackasat-qualifier-2023

https://github.com/cromulencellc/hackasat-finals-2022

https://github.com/cromulencellc/hackasat-qualifier-2022

Aerospace Village

https://www.aerospacevillage.org/

Open Source Satellite Program

https://www.opensourcesatellite.org/

OpenSatKit

https://github.com/OpenSatKit/OpenSatKit

Nasa Operational Simulation for Small Satellites  - NOS3

https://www.nasa.gov/nasa-operational-simulation-for-small-satellites/

https://github.com/nasa/nos3

AMSAT CubeSatSim

https://github.com/alanbjohnston/CubeSatSim/tree/master

SPARTA - SPACE ATTACK RESEARCH AND TACTIC ANALYSIS (MITRE ATTACK for space)

https://aerospace.org/sparta

SpaceSHIELD - European Space Agency

https://spaceshield.esa.int/

Ethically Hacking Space (eHs) 

https://www.linkedin.com/company/h4ck32n4u75/about/

Black Hat DC 2009 - Adam Laurie - Satellite Hacking for Fun and Profit

https://www.youtube.com/watch?v=PyXZX63etog

Training Class

https://www.antisyphontraining.com/event/introduction-to-cybersecurity-in-space-systems/

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

Summary:

Erin Barry, Head of Permanent Talent at Code Red Partners, joined me to discuss the hiring trends she’s seeing as we start 2024. I watched Erin’s talk on Security Hiring Trends from BSides San Francisco last year and thought she provided some really great insights. The end of 2023 has been a weird one especially for hiring. Erin provides some insight into the trends she’s seeing as well as what goes on behind the scenes of a recruiter. There’s also lots of good tips for putting together a resume and then navigating the process.

Episode Highlights:

• How to stand out as a candidate

• Networking is still the most important things you can do

• How has the job search changed?

• What to put on a resume
  

Guest Information:

Erin Barry, Head of Permanent Talent at Code Red Partners

LinkedIn

Resources and Mentions:

• Webinar: Personal brand building - the cyber edge your career needs

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Summary:

Dave Chronister the organizer of ShowMeCon joined me to discuss the revival of the conference. ShowMeCon is one of my favorite conferences. I had the pleasure of going to it from 2016-2018. I had plans to return in 2020 but the world event that we shall not speak of happened. I’m happy to see it return in 2024 and I will be there!

We get into a variety of topics around the conference including sponsorship, who attends, the venue, and the theme for 2024. The conference is still looking for sponsors and they’re about to do a second round of call for papers for speakers. If you’re looking to attendee the early bird price ends January 14th, 2024. Looking forward to seeing you there!

Episode Highlights:

• ShowMeCon is still looking for sponsors

• Who comes to the conference

• The origins and venue of ShowMeCon

• The theme for ShowMeCon 2024
  

Guest Information:

Dave Chronister organizer of ShowMeCon and CEO of Parameter Security

Resources and Mentions:

• ShowMeCon

• For questions reach out to [email protected]

Contact Information:

Leave a comment below or reach out via the contact form on the site, email [timothy.deblock[@]exploresec[.]com, or reach out on LinkedIn.

Check out our services page and reach out if you see any services that fit your needs.

Social Media Links:

[RSS Feed] [iTunes] [LinkedIn]

We respect your privacy.

Reboot….initiated

This is an experiment and the first step to a potential return of the Exploring Information Security podcast. The past several months I’ve been working on adding content to the website. Now I’m looking to start podcasting again in 2023. As part of that I was looking at making the news section of the ColaSec user group apart of the podcasting rotation.

ColaSec is a local user meeting based out of Columbia, SC. When the pandemic hit the group moved to online which meant I got to be apart of the group again. Post pandemic we’re still meeting in person but we’ve now expanded to having an online presence along with the in-person meetup. One of the things we do as part of the intro to the meetup is talk about the news. If you’re a fan of Top Gear it’s a bit like that. We even do a Cool Wall sometimes.

In this segment we talk about the below security news topics:

• Okta hacked

• RagnarLocker Ransomware gang taken down

• Atlassian’s critical vulnerability

• CitrixBleed vulnerability

• Alphv/BlackCat files SEC complaint against a company after deploying ransomware

• Updated US export regulation impact chip design and production

Send feedback to timothy[.]deblock[@]gmail[.]com or fill out the contact form below. You can also connect with me on LinkedIn, just make sure to include that you’re a listener of the podcast.

We respect your privacy.

In this inagural stream of the Exploring Information Security podcast, Daniel Ebbutt and Kyle Andrus join me to talk about Emotet.

Daniel (@notdanielebbutt) and Kyle (@chaoticflaws) are the two guys I go to for clicking on suspicious links. Recently, I’ve been seeing more Emotet. So, I wanted to have the guys on to talk about the malware that is making a comeback.

The CFP is open for Converge Conference. The conference is May 16 and 17. They’ll have one day for blue team topics and one day for red team topics. Make sure to submit your malware related talk topics. Also make sure to check out MiSec if you’re in Michigan.

In this episode we discuss:

• How is Emotet being constructed

• What are some of the indicators of Emotet?

• How Emotet is being mitigated

• What does Emotet do?

[RSS Feed] [iTunes]

We respect your privacy.

In this end of the year podcast, I discuss the state of the podcast for 2018 and what’s ahead for 2019.

2018 was a good year. I made some format changes that I’m really happy with. I picked up some new audio equipment. I resolved my recording process (I think). I’m not a big statistics guy. I don’t really care if two people or 200 people listen. I’m just happy to have some really great conversations with people and contribute back to the community.

2018 Statistics

Here’s a really interesting graph of my RSS Subscribers.

No, I don’t have 40,000 listeners. Some of that is inflated by other podcast directories ripping my feed. What I look for is a steady increase in subscribers, which did happen by the end of the year. Albeit with a weird dip in November (broken feed, maybe).

This is from iTunes Connect (Beta).

I can’t do a yearly review of podcast stats. Instead here’s the peek month of October for my iTunes listening habits. Looking through all the months, I can make some inferences about my audience. The hacking/red team content is the most popular. With a 25-28% consumption rate, the conference podcasts are turned off by most people before the end.

What’s ahead for 2019

I’ve got a new recording setup that will hopefully make producing a podcast much easier. I’ve setup a Twitch channel for gaming and potentially recording EIS episodes on. Follow for notifications on when I go live. I’ll be trying my first EIS episode Monday, January 7, 2019, at 8:30 p.m. CT. I’ve also turned what was my attempt at a GamerSec Discord channel into the Exploring Information Security channel. Here you can interact with us while record (or on Twitch). Join other people interesting in the podcast. Game with other infosec professionals.

Thank you for being a listener of the podcast. I am refreshed from my month off and energized for what’s ahead in 2019.

[RSS Feed] [iTunes]

We respect your privacy.

In this Hyatt recorded edition of the Exploring Information Security podcast, Micah Hoffman, Josh Huff, and Justin Nordine.

Micah (@WebBreacher), Josh (@baywolf88), and Justin (@jnordine) join me to go over a variety of topics at DerbyCon 2018. The Hyatt was kind enough to provide space near the bar (shout to the amazing Lauren).

In this episode we discuss:

• Why other industries don’t use OSINT

• Where to find your niche

• What are some frustrations of mentorship

• How apps are impacting our lives

[RSS Feed] [iTunes]

We respect your privacy.

In this Hyatt recorded edition of the Exploring Information Security podcast, Micah Hoffman, Josh Huff, and Justin Nordine join me at DerbyCon 2018.

Micah (@WebBreacher), Josh (@baywolf88), and Justin (@jnordine) join me to go over a variety of topics at DerbyCon 2018. The Hyatt was kind enough to provide space near the bar (shout to the amazing Lauren).

In this episode we discuss:

• What OSINT classes and projects everyone is working on

• Why contributing is important

• What value conferences like DerbyCon provide

• Why hotels hate accountant conferences

[RSS Feed] [iTunes]

We respect your privacy.

In this whiskey fueled edition of the Exploring Information Security podcast, Ryan MacDougall and Colin Hadnagy of Social Engineer join me to discuss advanced OSINT.

This past DerbyCon, I had the opportunity to take the Advanced OSINT with Ryan (@joemontmania) and Colin (@UnmaskedSE). The course was great! It was different from some of the other OSINT courses I’ve taken. They covered very specific techniques and tools. After presenting on those techniques and tools we were given the opportunity to dive in from a free-form standpoint.

If you’d like to take the training, signup for their April 23-24, 2019, training in Denver Colorado.

Also, you can catch Ryan at the First Pacific Hackers Conference, November 9-11, 2018.

In this episode we discuss:

• What is advanced OSINT

• What is the mindset needed for OSINT

• What are some of the tools used for OSINT

• How to phish an organizationa

[RSS Feed] [iTunes]

We respect your privacy.

In this authenticated edition of the Exploring Information Security podcast, I talk about when passwords will finally die!

This is a solo episode. I had the idea after sitting in a vendor pitch today (and because I’m slacking on my editing) where one of the sales guy mentioned that passwords WILL die. I disagree. I think passwords have been around for a long time and will continue to be around. They’re easily replaceable and is stored in the most secure location. Unless there are mind readers, then we’re all just screwed anyway.

I would love some thoughts and feedback on this one.

[RSS Feed] [iTunes]

We respect your privacy.

Stu (@cybersecstu) is a Co-Founder of The Many Hats Club, which is a massive Discord community and podcast. Earlier this year, Stu started sharing Unusual Journeys. I love this series because it highlights that there is no true path into infosec. He’s had 18 series so far and each story is fascinating.

In this episode we discuss:

Why failure is good

What sticks out from theses stories

What are some of the backgrounds people come from

Stu (@cybersecstu) is a Co-Founder of The Many Hats Club, which is a massive Discord community and podcast. Earlier this year, Stu started sharing Unusual Journeys. I love this series because it highlights that there is no true path into infosec. He’s had 18 series so far and each story is fascinating.

In this episode we discuss:

What started Unusual Journeys

How Stu got into infosec

What we can learn from these stories

Claire (@ClaireTills) doesn’t have your typical roll in infosec. She sits between the security teams and marketing team. It’s a fascinating roll and something that gives her a lot of insight into multiple parts of the business. What works and what doesn’t work in communicating security to the different areas. Check her blog out.

In this episode we discuss:

How important is it for the company to take security seriously

How would someone get started improving communication?

Why we have a communication problem in infosec

Where should people start

More resources:

Networking with Humans to Create a Culture of Security by Tracy Maleeff - BSides NoVa 2017

Courtney K BsidesLV 2018, Implementing the Three Cs of Courtesy, Clarity, and Comprehension to Optimize End User Engagement (video not available yet)

BSidesWLG 2017 - Katie Ledoux - Communication: An underrated tool in the infosec revolution

Jeff Man, The Art of the Jedi Mind Trick

The Thing Explainer: Complicated Stuff in Simple Words

Chris Roberts, Communication Across Ranges

Claire (@ClaireTills) doesn’t have your typical roll in infosec. She sits between the security teams and marketing team at Tenable. It’s a fascinating roll and something that gives her a lot of insight into multiple parts of the business. What works and what doesn’t work in communicating security to the different areas. Check her blog out.

In this episode we discuss:

What Claire’s experience is with communication and infosec

What’s ahead for communication in infosec

Why do people do what they do?

What questions to ask

More resources:

Networking with Humans to Create a Culture of Security by Tracy Maleeff - BSides NoVa 2017

Courtney K BsidesLV 2018, Implementing the Three Cs of Courtesy, Clarity, and Comprehension to Optimize End User Engagement (video not available yet)

BSidesWLG 2017 - Katie Ledoux - Communication: An underrated tool in the infosec revolution

Jeff Man, The Art of the Jedi Mind Trick

The Thing Explainer: Complicated Stuff in Simple Words

Chris Roberts, Communication Across Ranges

In this brand new edition of the Exploring Information Security podcast, I have a conversation with Justin Seitz (@jms_dot_py).

When I have guests hop on the podcast, I usually try to break the ice a little and get them warmed up for the episode. Often times these can turn into some really good conversation about the infosec field. I'd like to start capturing those conversation and release them (with the person's permission), because there are some really great insights.

I've released this episode early to the people on my newsletter (check below to get in on the fun). I wanted to get feedback and also give people who sign-up some bonus content, which is something I hope to do more.

In this episode we discuss:

• My unique role working with other departments
• Report writing and dealing with awful reports
• Similarities between the developer boom and the security boom

[RSS Feed] [iTunes]

We respect your privacy.

In this shipped edition of the Exploring Information Security podcast, Wes Widner joins me to discuss container security.

Wes (@kai5263499) is not a security person. He is a developer. A developer that understands security and why it's important. He deals a lot with automation and working with container technology.

In this episode we discuss:

• What are some of the other security considerations?7
• Who should secure containers?

More Resources:

• Awesome Container Security
• Cilium

[RSS Feed] [iTunes]

We respect your privacy.

In this shipped edition of the Exploring Information Security podcast, Wes Widner joins me to discuss container security.

Wes (@kai5263499) is not a security person. He is a developer. A developer that understands security and why it's important. He deals a lot with automation and working with container technology.

In this episode we discuss:

• What are containers?
• What are the different kind of containers?
• What is Wes' experience with containers?
• What are the big security concerns?

More Resources:

• Awesome Container Security
• Cilium

[RSS Feed] [iTunes]

We respect your privacy.

In this screenshot edition of the Exploring Information Security podcast, Justin Seitz joins me to discuss Hunchly.

Justin (@jms_dot_py) is the creator of Hunchly. I got to know Hunchly at SANS SEC487 OSINT training earlier this year. It's a fantastic tool that takes screenshot as the web is browsed. This is very useful for investigations involving OSINT. I'm also finding it useful for incident response, particularly for clicking on phishing pages. I sometimes forget to take screenshots as I'm investigating a phishing page. Having Hunchly means, I don't have to worry about taking screenshots. I then use the screenshots for reports and training. It's a really useful tool.

In this episode we discuss:

• What is Hunchly?
• How did Hunchly come about?
• Who should use Hunchly?
• What is the cost of Hunchly?

More resources:

• Automating OSINT

[RSS Feed] [iTunes]

We respect your privacy.

In this crafting episode of the Exploring Information Security podcast, Paul Johnston Customer Champion at Portswigger joins me to discuss how to make a Burp extension.

Paul (@paulpaj) wrote a blog post on how to make a successful burp extension and get it published in the Burp Store. A lot of the recommendations in the article are from Paul's experience handling extension submissions for the Burp Store.

In this episode we discuss:

• What is the process for extension approval?
• What is Burp Suite?
• How does someone make an extension?

[RSS Feed] [iTunes]

We respect your privacy.

In this refused episode of the Exploring Information Security podcast, Michael Kavka joins me to discuss how to handle call for presentation rejections.

Michael (@SiliconShecky) wrote a blog post on his site at the beginning of the year titled, It is CFP season... So what. In the article he hit on rejections and I thought it'd make for a great podcast topic. More recently, he wrote a blog post on the, Anatomy of a Rejected CFP. The article walks through his rejected CFP for DerbyCon.

In this episode we discuss:

• What is Michael's experience in submitting CFPs
• Why a CFP is rejected
• What are the different types of cons?
• How to handle a CFP rejection letter

More resources:

• The Building Blocks of Infosec CFPs by Kat Sweet
• How Do I Make My CFP Stand Out by Nikita
• CFP 101 - Tottenkoph, Guy McDudefella, Security Moey, David Mortman

[RSS Feed] [iTunes]

We respect your privacy.

In this expedition edition of the Exploring Information Security podcast, Chris Maddalena a senior security consultant joins me to discuss how to create a phishing email.

Chris (@cmaddalena) joins me to discuss crafting a phishing email. This is something I've recently explored at work. Having little to no experience actually crafting a phish, I decided I'd go to someone who does this on a regular basis. Check out Chris' ODIN tool for automating intelligence gathering, asset discovery, and reporting.

In this episode we discuss:

• What are the technical steps to creating a phish

• What needs to be consider from a technical standpoint

• What is GoPhish and GoReporter

• How important is timing

Other resources:

• gophish

• goreporter

[RSS Feed] [iTunes]

We respect your privacy.

In this expedition edition of the Exploring Information Security podcast, Chris Maddalena a senior security consultant joins me to discuss how to create a phishing email.

Chris (@cmaddalena) joins me to discuss crafting a phishing email. This is something I've recently explored at work. Having little to no experience actually crafting a phish, I decided I'd go to someone who does this on a regular basis. Check out Chris' ODIN tool for automating intelligence gathering, asset discovery, and reporting.

In this episode we discuss:

• What you need to consider before creating a phish.
• Where to get phishing ideas.
• Where to get phishing templates.
• What happened when accounting sent out an email.

[RSS Feed] [iTunes]

We respect your privacy.

In this battlefield edition of the Exploring Information Security podcast, Micah Hoffman joins me to discuss OSINT ORCS YOGA.

Micah (@WebBreacher), is a SANS Instructor and author of the SEC487 OSINT course. He recently had his second class in Denver, Colorado (more dates here). During that class he found people asking about how to navigate the waters of OSINT resources. His solution was to start the OSINT Resource Classification System (ORCS). It's a call for the OSINT community to standardize on how resources are categorized. YOGA or Your OSINT Graphical Analyzer is meant to be a visual aid for people looking to navigate the streets of OSINT resources.

In this episode we discuss:

• How SANS SEC487 is coming along
• What is YOGA?
• What is ORCS?
• Why is ORCS YOGA important?

[RSS Feed] [iTunes]

We respect your privacy.

In this 2k-like edition of the Exploring Information Security podcast, Stuart Scott AWS Content Lead at Cloud Academy and George Gerchow Chief Security Officer at Sumologic join me to discuss how to implement GDPR.

Stuart (@Stuart_A_Scott) and George (@georgegerchow) both have contributed content to CloudAcademy on GDPR. Stuart has a nine hour course on using AWS Compliance Enabling Services. George has a done a webinar and written an article on the topic. Both are well spoken and highly informed on the topic. They provide a lot of good direction for anyone looking to account for GDPR in their organization (pro tip: everyone should be looking into this).

In this episode we discuss:

• How to implement GDPR in AWS
• What are subject data rights?
• How other regulations are impacted
• What's ahead for GDPR

More resources:

• AWS Security Service
• AWS Access & Key Management
• CloudAcademy Blog
• Stuart's blog on CloudAcademy

[RSS Feed] [iTunes]

We respect your privacy.

In this 2k-like edition of the Exploring Information Security podcast, Stuart Scott AWS Content Lead at Cloud Academy and George Gerchow Chief Security Officer at Sumologic join me to discuss how to implement GDPR.

Stuart (@Stuart_A_Scott) and George (@georgegerchow) both have contributed content to CloudAcademy on GDPR. Stuart has a nine hour course on using AWS Compliance Enabling Services. George has a done a webinar and written an article on the topic. Both are well spoken and highly informed on the topic. They provide a lot of good direction for anyone looking to account for GDPR in their organization (pro tip: everyone should be looking into this).

In this episode we discuss:

• Why am I getting all these privacy update emails?
• What is GDPR?
• How to implement GDPR?
• What are Data Processing Addendum's

More resources:

• AWS Security Service
• AWS Access & Key Management
• CloudAcademy Blog
• Stuart's blog on CloudAcademy

[RSS Feed] [iTunes]

We respect your privacy.

In this crackerjack edition of the Exploring Information Security podcast, Sean Peterson of Parameter Security joins me to discuss password cracking.

Sean (@SeanThePeterson), is one of the most passionate infosec people you don't know. He recently did a talk at ShowMeCon on how to crack passwords. It was his first ever talk and pretty damn good. Sean joined me to give me his insights into password cracking.

In this episode we discuss:

• What type of hardware is needed for password cracking
• What type of attacks are used for password cracking
• How to crack passwords
• What's ahead for password cracking

[RSS Feed] [iTunes]

We respect your privacy.

In this European edition of the Exploring Information Security podcast, Cliff Smith of Parameter Security joins me to discuss General Data Protection Regulation (GDPR).

Cliff (@BismthSalamandr), recently gave a talk at ShowMeCon on GDPR and why everyone should care. It's a really good talk and a great primer if you haven't dug into GDPR, yet (you should). Cliff is a recovering lawyer, so he's providing a different angle than your normal security professional.

In this episode we discuss:

• What is GDPR?

• Why it could change

• Why it's important

• Who it impacts

[RSS Feed] [iTunes]

We respect your privacy.

Tanya (@shehackspurple), is a former developer turned security person. She speaks regularly at conferences around the globe. The topics often focus on working with developers to improve security, which is something I believe in. She's a project lead for OWASP DevSlop.

In this episode we discuss:

Why working with the developers is important

How to talk to developers

What are the benefits of working with developers?

What are the top recommendations for talking to developers

In this panelist episode of the Exploring Information Security podcast, the first ever podcast panel at ShowMeCon 2018!

Amanda Berlin (@InfoSystir), Wik (@jaimefilson), David Cybuck (@dpcybuck), April Wright (@aprilwright), and Dave Chronister (@bagomojo) join me on the live EIS panel at ShowMeCon, June 7, 2018. This is the first panel I've ever done for the podcast. It went so well, I hope to do more in the future. We cover a variety of topics and have a few laughs.

YouTube version

In this episode we discuss:

• What's coming back in vogue

• What to do with master ID

• What our thoughts are on new password policies from NIST

• How to handle best practices

[RSS Feed] [iTunes]

We respect your privacy.

In this ranty edition of the Exploring Information Security podcast, Jayson E. Street joins me to discuss how to achieve security awareness through social engineering.

Jayson (@jaysonstreet), is the VP of Information Security at Sphereny. He and April Wright (@aprilwright) are doing training at both Black Hat and DerbyCon on how to achieve security awareness through social engineering. The training focuses on helping blue team members setup effective security awareness programs.

In this episode we discuss:

• How to communicate with executives

• Why we need to empower users

• What happens when Jayson plays video games

• Why shock value is important

[RSS Feed] [iTunes]

We respect your privacy.

In this ranty edition of the Exploring Information Security podcast, Jayson E. Street joins me to discuss how to achieve security awareness through social engineering.

Jayson (@jaysonstreet), is the VP of Information Security at Sphereny. He and April Wright (@aprilwright) are doing training at both Black Hat and DerbyCon on how to achieve security awareness through social engineering. The training focuses on helping blue team members setup effective security awareness programs.

In this episode we discuss:

• Why security awareness is important
• What our own experience is with training people
• What's in the training
• How to talk to communicate effecitvely

[RSS Feed] [iTunes]

In this pile of an episode for the Exploring Information Security podcast, Johnny Xmas (@J0hnnyXm4s), Kate Vajda (@vajkat), Rachel Andrus, Kyle Andrus (@chaoticflaws), Daniel (not going to try spelling last name), Amanda Ebbutt, Daniel Ebbutt (@notdanielebbutt), Chris Maddalena (@cmaddalena), and myself get together to record a podcast during Converge and BSides Detroit.

It's another podcast special! This one was at Converge and BSides Detroit. This one took a little bit to get going. When we did we got into a little bit of everything. Topics both in infosec and topics outside of infosec.

In this episode we discuss:

• Everyone tries Malort

• The "breach" at Twitter

• One size doesn't fit all for the populace

• Real world issues (net neutrality, income, and public service)

[RSS Feed] [iTunes]

We respect your privacy.

In this mindful episode of the Exploring Information Security podcast, Amanda Berlin joins me from Converge and BSides Detroit this past week to talk about mental health.

Amanda (@InfoSystir) gave a keynote at Converge last week. The topic: mental health. It's a great talk and something I recommend people watch. Mental health is very important in our field. A lot of us were bullied coming up through school. Others grew up in awful environments. We've gotten past those challenges to become successful information security professionals. There are still scars, however, and if we don't identify and address them it will lead to unhealthy actions. Especially, since we are in a high-stress field that is overwhelmed.

We need to have an open dialogue about mental health. The downside to have a poor mental health. We need to share ideas on how to better address our state of minds. Often we feel alone. We are not. If you feel like you are in a bad place mentally, there are resources that can help. Call a hotline (1-800-273-8255). Do a Google search. There are people who can help. Family, friends, or mentors. You matter.

In this episode we discuss:

• Why talking about mental health is important

• What experience we've had

• How we handle our own mental state

• How others are handling their mental state

[RSS Feed] [iTunes]

We respect your privacy.