Youtube exclusive! Mick Douglas discussing Sensible AI use poilcy, RAGs, and how to get up to speed for your business' sake

Youtube Video: https://www.youtube.com/watch?v=hcbj94kMCJE 

Questions and topics: (please feel free to update or make comments for clarifications)
* Everyone wants us to use AI, but only when it benefits them
   * “Don’t use AI to submit your resume to our company”
   * “Do know how to use AI”
    * “Don’t use AI to answer the interview questions”
* AI implementations range from “super easy” to “crazy easy”
    * If you already know how to use AI
* Setting it up wrong can really hurt your company
* Tasks in AI that can get you into trouble
    * Contract summarizing
    * P&C docs
    * Sensitive business proposals
    * Using code from an AI that lacks a license
* A Sensible AI policy?
    * Should a company already have one, even if they aren’t using AI?
     * Maybe like an “AI Code of Conduct”
        * “Cool if you use it, but don’t put XX in it”

Additional information / pertinent LInks (Would you like to know more?):
Alignment in data science: https://techcommunity.microsoft.com/blog/azuredevcommunityblog/the-true-meaning-of-alignment-decision-modeling-in-data-science/3258269 
https://www.amazon.com/Alignment-Problem-Machine-Learning-Values/dp/0393635821  
https://blogs.nvidia.com/blog/what-is-retrieval-augmented-generation/  
https://ai.meta.com/research/ 
https://www.youtube.com/watch?v=oVapD2OKCZw  
https://github.com/danielmiessler/Fabric  - prompts AI in github
https://x.com/thealexbanks/status/1862124708163944859  
https://hbr.org/2018/01/podcast-ideacast 
https://www.forbes.com/councils/forbestechcouncil/2024/11/15/why-85-of-your-ai-models-may-fail/  
https://www.tomshardware.com/tech-industry/artificial-intelligence/research-shows-more-than-80-of-ai-projects-fail-wasting-billions-of-dollars-in-capital-and-resources-report  
https://github.com/InfoSecInnovations/concierge  

Show points of Contact:
Amanda Berlin: https://www.linkedin.com/in/amandaberlin/ 
Brian Boettcher: https://www.linkedin.com/in/bboettcher96/  
Bryan Brake: https://linkedin.com/in/brakeb  
Brakesec Website: https://www.brakeingsecurity.com 
Youtube channel: https://youtube.com/@brakeseced 
Twitch Channel: https://twitch.tv/brakesec 

Jay Beale discusses his K8s class at BlackHat, Kubernetes developments, and mental health

Youtube Video at: https://www.youtube.com/watch?v=yHPvGVfPgjI

Jay Beale is a principal security consultant and CEO/CTO for InGuardians. He is the architect of multiple open source projects, including the Peirates attack tool for Kubernetes (in Kali Linux), the Bustakube CTF Kubernetes cluster, and Bastille Linux. Jay created and leads the Kubernetes CTF at DEF CON and previously helped in the Kubernetes project's Security efforts. He’s co-written eight books and given many public talks at Black Hat, DEF CON, RSA, CanSecWest, Blue Hat, ToorCon, DerbyCon, WWHF, HushCon and others. He teaches the highly-rated Black Hat class, “Attacking and Protecting Kubernetes, Linux, and Containers.” He has served on the review board of the O’Reilly Security Conference, the board of Mitre’s CVE-related Open Vulnerability and Assessment Language, and been a member of the HoneyNet project. He’s briefed both Congress and the White House. 

Questions and topics: (please feel free to update or make comments for clarifications)
* Kubernetes vs. Docker vs. LXC vs. VMs - why did you settle on K8s?
* What’s new with k8s? Version 1.33? Do you always implement the latest version in your CTF, or something that is deliberately vulnerable? (https://www.loft.sh/blog/kubernetes-v-1-33-key-features-updates-and-what-you-need-to-know)
* When you are making a CTF, what’s your methodology? Threat model then verify? Code review? Github pull requests?
* Story time; Not the first year you’ve done this(?), have participants ever surprised you finding something you didn’t expect? 
* If I’m running K8s at my workplace, what should be bare minimum k8s security I should implement? Any security controls that I should implement that might cause performance or are ‘nice-to-have’ but may run counter to how orgs use k8s that I should be concerned about implementing? 

Additional information / pertinent LInks (Would you like to know more?):
https://kubernetes.io/ 
DEF CON Kubernetes CTF: https://containersecurityctf.com/ 
Black Hat training:  https://www.blackhat.com/us-25/training/schedule/index.html#0-day-unnecessary-attacking-and-protecting-kubernetes-linux-and-containers-45335 
https://www.bustakube.com/ 
https://github.com/inguardians/peirates 
Rory McCune’s blog: https://raesene.github.io/ 
https://www.oreilly.com/library/view/production-kubernetes/9781492092292/  - O’Reilly book: Production Kubernetes

Show points of Contact:
Amanda Berlin: https://www.linkedin.com/in/amandaberlin/
Brian Boettcher: https://www.linkedin.com/in/bboettcher96/ 
Bryan Brake: https://linkedin.com/in/brakeb 
Brakesec Website: https://www.brakeingsecurity.com
Youtube channel: https://youtube.com/@brakeseced
Twitch Channel: https://twitch.tv/brakesec

Socvel intel threat quiz, Pearson Breached, nintendo bricking stuff, and kevintel.com

socvel.com/quiz if you want to play along!

Check out the BrakeSecEd Twitch at https://twitch.tv/brakesec

join the Discord: https://bit.ly/brakesecDiscord

Music:

Music provided by Chillhop Music: https://chillhop.ffm.to/creatorcred

"Flex" by Jeremy Blake
Courtesy of Youtube media library

Bronwen Aker - harnessing AI for improving your workflows

Guest Info:

• Name:       Bronwen Aker

• Contact Information (N/A): https://br0nw3n.com/ 

• Time Zone(s): Pacific, Central, Eastern

–Copy begins–

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information and experiences, and do not represent views of past, present, or future employers.

Recorded: https://youtube.com/live/guhM8v8Irmo?feature=share 

Show Topic Summary: By harnessing AI, we can assist in being proactive in discovering evolving threats, safeguard sensitive data, analyze data, and create smarter defenses. This week, we’ll be joined by Bronwen Aker, who will share invaluable insights on creating a local AI tailored to your unique needs. Get ready to embrace innovation, transform your work life, and contribute to a safer digital world with the power of artificial intelligence! (heh, I wrote this with the help of AI…)

Questions and topics: (please feel free to update or make comments for clarifications)

1. Things that concern Bronwen about AI: (https://br0nw3n.com/2023/12/why-i-am-and-am-not-afraid-of-ai/)
   Data Amplification: Generative AI models require vast amounts of data for training, leading to increased data collection and storage. This amplifies the risk of unauthorized access or data breaches, further compromising personal information.

2. Data Inference: LLMs can deduce sensitive information even when not explicitly provided. They may inadvertently disclose private details by generating contextually relevant content, infringing on individuals’ privacy.

3. Deepfakes and Misinformation: Generative AI can generate convincing deepfake content, such as videos or audio recordings, which can be used maliciously to manipulate public perception or deceive individuals. (Elections, anyone?)

4. Bias and Discrimination: LLMs may inherit biases present in their training data, perpetuating discrimination and privacy violations when generating content that reflects societal biases.

5. Surveillance and Profiling: The utilization of LLMs for surveillance purposes, combined with big data analytics, can lead to extensive profiling of individuals, impacting their privacy and civil liberties.

6. Setting up a local LLM? CPU models vs. gpu models
   pros/cons? Benefits?

7. What can people do if they lack local resources?
   Cloud instances? Ec2? Digital Ocean? Use a smaller model?

8. https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/ 

• AI coding assets are hallucinating package names

• 5.2 percent of package suggestions from commercial models didn't exist, compared to 21.7 percent from open source or openly available models

• Attackers can then create malicious packages matching the invented name, some are quite convincing with READMEs, fake github repos, even blog posts

• An evolution of typosquatting named “slopsquating” by Seth Michael Larson of Python Software Foundation

• Threat actor "_Iain" posted instructions and videos using AI for mass-generated fake packages from creation to exploitation

Additional information / pertinent LInks (Would you like to know more?):

1. https://www.reddit.com/r/machinelearningnews/s/HDHlwHtK7U

2. https://br0nw3n.com/2024/06/llms-and-prompt-engineering/ - Prompt Engineering talk

3. https://br0nw3n.com/wp-content/uploads/LLM-Prompt-Engineering-LayerOne-May-2024.pdf (slides)

4. Daniel Meissler ‘Fabric’ - https://github.com/danielmiessler/fabric

5. https://www.reddit.com/r/LocalLLaMA/comments/16y95hk/a_starter_guide_for_playing_with_your_own_local_ai/ 

6. Ollama tutorial (co-founder of ollama - Matt Williams): https://www.youtube.com/@technovangelist

7. https://mhtntimes.com/articles/altman-please-thanks-chatgpt 

8. https://www.whiterabbitneo.com/ - AI for DevSecOps, Security

9. https://blogs.nvidia.com/blog/what-is-retrieval-augmented-generation/ 

10. https://www.youtube.com/watch?v=OuF3Q7jNAEc - neverending story using an LLM

11. https://science.nasa.gov/venus/venus-facts 

Show points of Contact:

Amanda Berlin: https://www.linkedin.com/in/amandaberlin/

Brian Boettcher: https://www.linkedin.com/in/bboettcher96/ 

Bryan Brake: https://linkedin.com/in/brakeb 

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

post-bsides SD discussion, EPSS, the answer I should have given, and 'Lord Brake'

March23: buy browser extensions, attackers don't need exploits, socvel CTI quiz

steam distributes malware in game form, RDP open from DOGE servers, hacking a supply chain for 50K

Youtube VOD: https://www.youtube.com/watch?v=zu_smyQGvG4 

1. https://lcamtuf.substack.com/p/how-security-teams-fail

2. https://cyberintel.substack.com/p/doge-exposes-once-secret-government

3. https://x.com/SteamDB/status/1889610974484705314  – supply chain issues can crop up anywhere… are you blocking people from steam and popular software downloads online?

4. https://www.landh.tech/blog/20250211-hack-supply-chain-for-50k/

5. https://medium.com/@cyberengage.org/rethinking-incident-response-from-picerl-to-dair-7b153a76e044

6. https://www.youtube.com/watch?v=3HRkKznJoZA <- 100 digits of pi

7. https://www.youtube.com/watch?v=rz4Dd1I_fX0 <- periodic table song

Additional information / pertinent LInks (Would you like to know more?):

1. https://www.socvel.com/quiz/

2. https://xphantom.nl/posts/Offensive-Security-Lab/

Show points of Contact:

Amanda Berlin: https://www.linkedin.com/in/amandaberlin/

Brian Boettcher: https://www.linkedin.com/in/bboettcher96/ 

Bryan Brake: https://linkedin.com/in/brakeb 

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

discord: https://discord.gg/brakesec

Twitch Channel: https://twitch.tv/brakesec

 Music: https://chillhop.ffm.to/creatorcred "Flex" by Jeremy Blake

Courtesy of Youtube media library

Tanya Janca Talks secure coding, Semgrep Academy, and community building, and more!

Check out the BrakeSecEd Twitch at https://twitch.tv/brakesec

Join the Discord! https://discord.gg/brakesec

#youtube VOD (in 1440p): https://www.youtube.com/watch?v=axQWGyd79NM 

Questions and topics:
Bsides Vancouver discussion
Semgrep Community and Academy
Building communities
What are ‘secure guardrails’
Reducing barriers between security and developers
How to sell security to devs: “hey, if you want to see us less, buy/use this?”
“Security is your barrier, but we have goals that we can’t reach without your help.”
https://wehackpurple.com/devsecops-worst-practices-artificial-gates/ 
How are you seeing things like AI being used to help with DevOps or is it just making things more complicated? Not just helping write code, but infrastructure Ops, software inventories, code repo hygiene, etc?
OWASP PNW https://www.appsecpnw.org/
Alice and Bob coming next year!

Additional information / pertinent LInks (Would you like to know more?):
shehackpurple.ca 
Semgrep (https://semgrep.dev/)
https://aliceandboblearn.com/
https://academy.semgrep.dev/ (free training)
Netflix ‘paved roads’: https://netflixtechblog.com/how-we-build-code-at-netflix-c5d9bd727f15
https://en.wikipedia.org/wiki/Nudge_theory 
https://www.perforce.com/blog/qac/what-is-linting 
https://www.youtube.com/watch?v=FSPTiw8gSEU 
https://techhq.com/2024/02/air-canada-refund-for-customer-who-used-chatbot/ 

Show points of Contact:
Amanda Berlin: @infosystir @hackershealth 
Brian Boettcher: @boettcherpwned
Bryan Brake: https://linkedin.com/in/brakeb 
Brakesec Website: https://www.brakeingsecurity.com
Youtube channel: https://youtube.com/@BrakeSecEd
Twitch Channel: https://twitch.tv/brakesec

Josh Grossman - building Appsec programs, bridging security and developer gaps

Youtube VOD: https://youtu.be/G3PxZFmDyj4

#appsec, #owasp, #ASVS, #joshGrossman, #informationsecurity, #SBOM, #supplychain, #podcast, #twitch, #brakesec, #securecoding, #Codeanalysis

Questions and topics:

1. The background to the topic, why is it something that interests you?
How do you convince developers to take your course?

2. What do you think the root cause of the gap is?

3. Who is causing the gaps? (‘go fast’ culture, overzealous security, GRC requirements, basically everyone?)

4. Where do gaps begin? Is it the ‘need’ to ‘move fast’?

5. What can devs do to involve security in their process? Sprint planning? SCA tools?

6. How have you seen this go wrong at organizations?

7. How important is it to have security early in the product development process?

8. What sort of challenges do you think mainstream security people face in AppSec scenarios?

9. How does Product Security differ from Application Security? (what if the product is an application?)

10. What are the key development concepts that security people need to be familiar with to effectively get involved in AppSec/ProdSec?

11.. How do you suggest a security team approach AppSec/ProdSec?
               Leadership buy-in
               Effective/valuable processes
               Tools should achieve a goal

12. SBOM - NTIA is asking for it, How to get dev teams to care.

13. Key takeaways?

Additional information / pertinent LInks (Would you like to know more?):
BlackHat Training: https://www.blackhat.com/us-24/training/schedule/index.html#accelerated-appsec--hacking-your-product-security-programme-for-velocity-and-value-virtual-37218

https://www.walkme.com/blog/leadership-buy-in/

https://www.bouncesecurity.com/

https://www.teamgantt.com/blog/raci-chart-definition-tips-and-example

https://www.cisa.gov/sbom

SCA Tools https://chpk.medium.com/top-10-software-composition-analysis-sca-tools-for-devsecops-85bd3b7512dd 

https://semgrep.dev/ 

https://www.linkedin.com/in/joshcgrossman 

https://owasp.org/www-project-application-security-verification-standard/ 

https://github.com/OWASP/ASVS/tree/master/5.0

https://owasp.org/www-project-cyclonedx/

https://joshcgrossman.com/

PyCon talk about custom security testing: https://www.youtube.com/watch?v=KuNZzDjvMlg 

Michal's Black Hat course - Accurate and Scalable: Web Application Bug Hunting: https://www.blackhat.com/us-24/training/schedule/index.html#accurate-and-scalable-web-application-bug-hunting-37210 

https://www.blackhat.com/us-24/training/schedule/index.html#accurate-and-scalable-web-application-bug-hunting-372101705524544 

ASVS website: https://owasp.org/asvs 

Lightning talk I did recently about OWASP: https://www.bouncesecurity.com/eventspast#f86548cb37cb2a82728b1762bd1b7aee 

Show points of Contact:
Amanda Berlin: @infosystir @hackershealth 
Brian Boettcher: @boettcherpwned
Bryan Brake: https://linkedin.com/in/brakeb 
Brakesec Website: https://www.brakeingsecurity.com
Youtube channel: https://youtube.com/@brakeseced
Twitch Channel: https://twitch.tv/brakesec

Managing messaging with management, becoming a CISO with Mary Gardner from Goldiknox

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information and experiences and do not represent views of past, present, or future employers.

Recorded: 08 Apr 2024

Youtube VOD: https://www.youtube.com/watch?v=K8qApvsFtqw

Show Topic Summary:

If you want to get in the mind of a board member, I submit to you my discussion with Mary Gardner we did last night on #brakesec #education. Join Mary and I as we discuss the functions of a board, messaging to various levels of leadership and teams, and what it takes to make that leap to being a CISO.
And when you're done, and you need someone to help your org get more mature, contact the team at GoldiKnox.
#cybersecurity #informationsecurity #ciso #leadership #GRC

Questions and topics:

1. https://hbr.org/2023/05/boards-are-having-the-wrong-conversations-about-cybersecurity

   1. “Just 69% of responding board members see eye-to-eye with their chief information security officers (CISOs). Fewer than half (47%) of members serve on boards that interact with their CISOs regularly, and almost a third of them only see their CISOs at board presentations. “

   2. They obviously have different priorities, so what brings everyone to the table to discuss? Are they even worried about security?

2. Tactical goals vs. org goals and aligning them

3. What are boards most worried about these days? 

   1. Staying relevant in the face of AI?

   2. What tech will protext them from the newest threats?

4. GRC is forced security, security is completely optional, Compliance requires some sort of security

Additional information / pertinent LInks (Would you like to know more?):

1. Research organizations (gartner, forrester, etc)

2. https://goldiknox.com/ 

3. https://www.linkedin.com/pulse/board-needs-help-planning-cybersecurity-start-here-daniel-briley-k7xzc

4. https://hbr.org/2022/11/is-your-board-prepared-for-new-cybersecurity-regulations

5. https://www.justice.gov/usao-ndca/pr/former-chief-security-officer-uber-sentenced-three-years-probation-covering-data

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth 

Brian Boettcher: @boettcherpwned

Bryan Brake: https://linkedin.com/in/brakeb 

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

Discord: https://discord.gg/brakesec

p2-accidentalCISO, building trust in new places

Full Youtube VOD: https://www.youtube.com/watch?v=uX7odQTBkyQ 

Questions and topics:

1. Let’s talk about Mindful Business Podcast

   1. What’s the topics you cover?

2. Topic #1: discuss your experiences when you were a new leader.

   1.  What worked? What didn't? What would you have done differently?

   2. Do you emulate your manager's style? What have been your go-to management resources? 

   3. What is a good piece of advice that you’ve been given or that you impart to others that relates to leadership?

3. Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc)

4. Topic #3: What are bare minimums for building ‘secure’ Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates

5. Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security? 

Additional information / pertinent LInks (Would you like to know more?):

1. Twitter/Mastodon:
   https://twitter.com/AccidentalCISO
   https://infosec.exchange/@accidentalciso

2. The Mindful Business Security Show:
   https://www.mindfulsmbshow.com/
   https://twitter.com/mindfulsmbshow
   
   

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth 

Brian Boettcher: @boettcherpwned

Bryan Brake: https://linkedin.com/in/brakeb 

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

AccidentalCISO on BrakeSecEd, talking Leadership, SaaS development, and Appsec

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information, and do not represent views of past, present, or future employers.

Recorded: 28 Jan 2024

Youtube VOD: https://youtube.com/live/uX7odQTBkyQ

Questions and topics:

1. Let’s talk about Mindful Business Podcast

   1. What’s the topics you cover?

2. Topic #1: discuss your experiences when you were a new leader.

   1.  What worked? What didn't? What would you have done differently?

   2. Do you emulate your manager's style? What have been your go-to management resources? 

   3. What is a good piece of advice that you’ve been given or that you impart to others that relates to leadership?

3. Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc)

4. Topic #3: What are bare minimums for building ‘secure’ Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates

5. Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security? 

Additional information / pertinent LInks (Would you like to know more?):

1. Twitter/Mastodon:
   https://twitter.com/AccidentalCISO
   https://infosec.exchange/@accidentalciso

2. The Mindful Business Security Show:
   https://www.mindfulsmbshow.com/
   https://twitter.com/mindfulsmbshow
   

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth 

Brian Boettcher: @boettcherpwned

Bryan Brake: https://linkedin.com/in/brakeb 

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/@brakeseced

Twitch Channel: https://twitch.tv/brakesec

1st show of 2024! Our 10th Anniversary...

It's our 10th anniversary and the first show of our 2024 season!

Amanda was on "7 minute security"

https://7minsec.com/projects/podcast

Check out the complete VOD at https://youtu.be/vbmEtkxhAMg

Explicit language warning

www.brakeingsecurity.com

https://twitch.tv/brakesec

https://bit.ly/brakesecyt

Brakesec Call to Action 2023

Youtube Video:  https://youtu.be/IUDPlQaQg8M

https://forms.gle/rf145MoN7cskwMjf8 
 is the link to the survey. Your information (should you choose to identify yourself) will not be shared outside of the BrakeSec Team.

Thank all of you for listening and for your input.

RSS feed for the audio podcast is at https://www.brakeingsecurity.com/rss 
website: https://www.brakeingsecurity.com 

How to get more headcount, BLUFFs Vulnerability, and Ranty Clause debuts!

Show Topic Summary:

Ms. Berlin proposes a question of how to gather more headcount with metrics, we discuss the BLUFFS bluetooth vulnerability, and “Ranty Claus” talks about CISA’s remarks of putting the onus on device product makers to remove choice for customers and implement secure defaults.

#youtube VOD: https://www.youtube.com/watch?v=emcAzTx9z0c 

Questions and topics:

1. https://cyberscoop.com/cisa-goldstein-secure-by-design/

2. https://hackaday.com/2023/12/02/update-on-the-bluffs-bluetooth-vulnerability/

Additional information / pertinent LInks (Would you like to know more?):

1. https://cyberscoop.com/jen-easterly-secure-by-design/
   
   

2. https://www.cisa.gov/resources-tools/resources/stop-passing-buck-cybersecurity 

3. Examples of companies forcing changes https://www.bleepingcomputer.com/news/microsoft/microsoft-will-roll-out-mfa-enforcing-policies-for-admin-portal-access/  

4. https://github.com/aya-rs/aya - eBPF implementation in Rust

5. https://ossfortress.io/  

6. https://www.darkreading.com/endpoint-security/critical-logofail-bugs-secure-boot-bypass-millions-pcs 

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth 

Brian Boettcher: @boettcherpwned

Bryan Brake: @bryanbrake on Mastodon.social, https://linkedin.com/in/brakeb 

Brakesec Website: https://www.brakeingsecurity.com

Twitter: @brakesec 

Youtube channel: https://youtube.com/c/BDSPodcast

Twitch Channel: https://twitch.tv/brakesec

25Oct - okta breached (again), Energy company hit by supply chain attack, and you can help hire the best people

Subscribe on Twitch using Amazon Prime and watch us live: https://twitch.tv/brakesec

Check out our VODs on Youtube: https://www.youtube.com/@BrakeSecEd 

Join the BrakeSecEd discord: https://discord.gg/brakesec 

News:

https://www.darkreading.com/remote-workforce/1password-latest-victim-okta-customer-service-breach

https://www.documentcloud.org/documents/24075435-bhi-notice

https://www.bleepingcomputer.com/news/security/us-energy-firm-shares-how-akira-ransomware-hacked-its-systems/

https://www.bleepingcomputer.com/news/security/ransomware-isnt-going-away-the-problem-is-only-getting-worse/

https://www.shacknews.com/article/137505/ransomware-group-capcom-2020-arrested

https://www.bleepingcomputer.com/news/security/flipper-zero-can-now-spam-android-windows-users-with-bluetooth-alerts/

https://www.nasdaq.com/articles/three-cybersecurity-sectors-that-resist-economic-downturns

Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.

Guest Bio: Nicole is the Chief Product Officer at Axio. Nicole has spent her career building awareness around the benefits of usable security and human-centered security as a way to increase company revenue and create a seamless user experience.

 Youtube VOD Link: https://youtube.com/live/tFaAB9an47g

 Questions and topics: Usable security: is it an oxymoron?

What determines if the security is ‘usable’ or no? We sacrifice security for a better UX, what can be done to alleviate that? Or is it some sort of sliding scale in “poor UX, amazing security or awesome UX, poor security” Examples of poor UX for ‘people’: MFA, and password managers.

SEC updates and ‘material events’ and how that would affect security, IR, and other company reporting functions. 

Also, additional documentation (Regulation S-K Item 106) https://www.linkedin.com/posts/nicole-sundin-5225a1149_sec-adopts-rules-on-cybersecurity-risk-management-activity-7090065804083290112-ISD8

Are companies ready to talk about their cybersecurity? Can the SEC say “you’re not doing enough?”

 What is ‘enough’?

Are we heading toward yet another audit needed for public companies, similar to SOX?

When does an 8-K get publicly disclosed?

Materiality is based on a “reasonable investor”?

So, you don’t need to announce that until you’re certain, and it’s based on what you can collect? Cyber Risk Management and some good examples of how to set up a proper cyber risk organization

Additional Links:

https://csrc.nist.gov/CSRC/media/Projects/usable-cybersecurity/images-media/Is%20Usable%20Security%20an%20Oxymoron.pdf

http://web.mit.edu/Saltzer/www/publications/protection/Basic.html

https://www.sec.gov/news/press-release/2023-139

https://www.sec.gov/news/statement/munter-statement-assessing-materiality-030922

https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/sec-final-cybersecurity-disclosure-rules.html

https://www.nasa.gov/centers/ames/research/technology-onepagers/hc-computing.html

 https://securityscorecard.com/blog/what-is-cyber-security-performance-management/

John Aron, letters of marque, what does a "junior" job look like with AI?

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.

Guest Bio: John is the CEO of Aronetics. An avid climber and runner, John has spoken at many conferences about topics like ZeroTrust, BIOS/UEFI security, communication security, and malware. Aronetics is a technology-enabled service provider. 

Youtube VOD: https://youtube.com/live/5dIVTwVZLAU

Linkedin VOD: https://www.linkedin.com/video/live/urn:li:ugcPost:7101738254823030784

Show Topic Summary:

John joins us to discuss “letters of Marque” in an effort for hackers to ‘hack back’... the overreliance on automation, and communication siloes. We also talk about what a ‘junior position’ in infosec looks like with AI doing all the “Level 1 SOC Analyst” type roles normally given to someone fresh to the security industry.

Questions and topics:

1. Is infosec over reliant on automation? Automation comes with its own challenges.

   1. Documentation woes

   1. Automation is usually found in userland

Aronetics’ Thor provides defense and counter-offense tamper-proof technology digitally tied to 

Letter of Marque - good idea, or geopolitical disaster waiting to happen?

Siloes and communication -best ways to overcome those in an org and outside?

How do we overcome siloing?

Overcoming security challenges?Identity management - 2FA is everywhere, there’s already ways around 2FA, so what now? 3FA? Biometrics? Make everyone carry around physical tokens that we can lose?

Blog post: https://www.aronetics.com/post-quantum-cryptography/
What do we need to protect against? Nation states with quantum computers? Rubber hose cryptography?

Crime thrives in areas of low visibility. https://www.aronetics.com/unknown/ 

https://www.aronetics.com/inside-the-breach/ (threat detection - the crime thrives in low vis areas)

Show points of Contact:

Brakesec Website: https://www.brakeingsecurity.com

Youtube channel: https://youtube.com/c/BDSPodcast

Twitch Channel: https://twitch.tv/brakesec

Amanda Berlin: @[email protected] (Mastodon) @hackershealth 

Brian Boettcher: @boettcherpwned

Bryan Brake: @bryanbrake on Mastodon.social

Megan Roddie - co-author of "Practical Threat Detecion Engineering"

Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers.

Buy here: https://subscription.packtpub.com/book/security/9781801076715

Amazon Link: https://packt.link/megan

Youtube VOD: https://www.youtube.com/watch?v=p1_jQa9OQ2w

Show Topic Summary:

Megan Roddie is currently working as a Senior Security Engineer at IBM. Along with her work at IBM, she works with the SANS Institute as a co-author of FOR509, presents regularly at security conferences, and serves as CFO of Mental Health Hackers. Megan has two Master's degrees, one in Digital Forensics and the other in Information Security Engineering, along with many industry certifications in a wide range of specialties. When Megan is not fighting cybercrime, she is an active competitor in Muay Thai/Kickboxing. She is a co-author of “Practical Threat Detection Engineering” from Packt publishing, on sale now in print and e-book. Buy here: https://subscription.packtpub.com/book/security/9781801076715

https://packt.link/megan ← Amazon redirect link that publisher uses if you want something easier on the notes

Questions and topics:

1. Of the 3 models, which do you find you use more and why? (PoP, ATT&CK, kill chain)

2. What kind of orgs have ‘detection engineering’ teams? What roles are involved here, and can other teams (like IR) be involved or share a reverse role there?

3. Lab setup requires an agent… any agent for ingestion or something specific? 

4. How does Fleet or data ingestion work for Iot/Embedded device testing? Anything you suggest?

5. How important is it to normalize your log output for ingestion? (app, web, server all tell the story)

Additional information / pertinent LInks (Would you like to know more?):

1. Unified Kill Chain: https://www.unifiedkillchain.com/

2. ATT&CK: https://attack.mitre.org/ 

3. D3FEND matrix BrakeSec show from 2021: https://brakeingsecurity.com/2021-023-d3fend-framework-dll-injection-types-more-solarwinds-infections 

4. Pyramid of Pain: https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html

5. https://www.securitymagazine.com/articles/98486-435-million-the-average-cost-of-a-data-breach 

6. https://medium.com/@gary.j.katz (per Megan, ‘it’s basically Chapter 11 of the book’)

Show points of Contact:

Amanda Berlin: @infosystir @hackershealth 

Brian Boettcher: @boettcherpwned

Bryan Brake: @bryanbrake on Mastodon.social, Twitter, bluesky

Brakesec Website: https://www.brakeingsecurity.com

Twitter: @brakesec 

Youtube channel: https://youtube.com/c/BDSPodcast

Twitch Channel: https://twitch.tv/brakesec

meeting new people, walking on your keyboard causes issues, even google gets phone numbers wrong.

Check out our sponsor (BLUMIRA) at https://blumira.com/brake

youtube channel link: https://youtube.com/c/BDSPodcast

Full video on our youtube Channel! https://www.youtube.com/watch?v=BkBeLuM_urk

https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/

https://www.darkreading.com/remote-workforce/hacker-infected-foiled-by-own-infostealer

https://therecord.media/cisa-warnings-adobe-microsoft-citrix-vulnerabilities

https://www.itsecurityguru.org/2023/07/18/millions-of-keyboard-walk-patterns-found-in-compromised-passwords/

https://therecord.media/airline-customer-support-phone-number-fraud-google

https://twitter.com/Shmuli/status/1680669938468499458

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

https://www.jdsupra.com/legalnews/tabletop-exercises-as-risk-mitigation-5278057/

https://www.darkreading.com/vulnerabilities-threats/linux-ransomware-poses-significant-threat-to-critical-infrastructure

https://bevyengine.org/  - Rust game engine
https://godotengine.org/ - a more mature Rust game engine

https://flappybird.io/ - which I suck at, BTW

Intro/outro music:
"Flex" by Jeremy Blake
Courtesy of YouTube Music Library (used with proper permissions)

Bsides Seattle and Austin, SecureBoot patch, and more

BrakeSec Show Outline – No Guest

Youtube VOD: https://youtube.com/live/UGRaRSYj7kc 

lynsey wolf, conducting insider threat investigations, CASB and UEBA utlization to good use.

3CX supply chain attack, Mark Russinovich and Sysinternals, CISA ransomware notifications, and emotional intelligence

Youtube VOD: https://www.youtube.com/watch?v=afZHiBUr-2g 

Dish Network is still busted, John Deere avoiding OSS requests, Is DAST dead?

Nickolas Means talks about Security, Devops velocity, blameless orgs, and conferences infosec should attend

SPECIAL INTERVIEW: John Aron and Jerod Brennen

BrakeSec Show Outline (all links valid as of 27 Jan 2023, subject to change)

Layoff discussions, another TMO breach, OneNote Malware, and more!

Full youtube video: https://www.youtube.com/watch?v=1Dgq8FpnWPw

GPS car hacks, Google Threat report, notable topics of 2020, satellite threat modelling, twitter breach(?)

Josh-Whalen-risk-management-data_visualization-tools, value-creating activities -p2

Full stream video on Youtube: https://youtu.be/i1xpAfNFCvY

John's Youtube channel, to find more training/contact information: https://www.youtube.com/channel/UC3ctyx980M8jLa_cEiQveLQ

https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration

ADKAR model: https://www.prosci.com/methodology/adkar

CCE framework: https://inl.gov/cce/

Dashboard (non-sponsored link): https://monday.com

Diagrammming tool: https://figma.com

https://www.sciencedirect.com/topics/computer-science/system-analysis

Amazon book: https://www.amazon.com/Engineering-Safer-World-Systems-Thinking/dp/0262533693

John Whalen, data visualization tools, risk management, handling org risk-p1

Full stream video on Youtube: https://youtu.be/i1xpAfNFCvY

John's Youtube channel, to find more training/contact information: https://www.youtube.com/channel/UC3ctyx980M8jLa_cEiQveLQ

https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration

ADKAR model: https://www.prosci.com/methodology/adkar

CCE framework: https://inl.gov/cce/

Dashboard (non-sponsored link): https://monday.com

Diagrammming tool: https://figma.com

https://www.sciencedirect.com/topics/computer-science/system-analysis

Amazon book: https://www.amazon.com/Engineering-Safer-World-Systems-Thinking/dp/0262533693

Interview with Infrared - one of the Seattle Community Network organizers

https://youtu.be/iW39Mugj4OM  -Full stream video (interview starts at 28m22s)

Broadcasted live on Twitch -- Watch live at https://www.twitch.tv/brakesec

Seattle Community Network - https://seattlecommunitynetwork.org/

https://medium.com/seattle-community-network/ 

Check Bryan out on Mastodon! Mastodon

JAMBOREE - an Android App testing platform from @operat0r -part2

introducing @operat0r talked a bit about mobile device hacking and rooting/jailbreaking phones for testing

Grab the powershell script here: https://github.com/freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy

Check out the Youtube videos, including demo! Part2 is here: https://www.youtube.com/watch?v=RXgwUWpRuYA

JAMBOREE - an Android App testing platform from @operat0r

introducing @operat0r talked a bit about mobile device hacking and rooting/jailbreaking phones for testing

Grab the powershell script here: https://github.com/freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy

Check out the Youtube videos, including demo! Part 2 will be available soon!

Part 1:  https://youtu.be/U5SFav9h1L4 

07-oct-news-twitch streaming

https://www.bnbchain.org/en/blog/bnb-chain-ecosystem-update/

https://medium.com/@johnblatt23/uber-hack-reveals-weakness-in-the-human-firewall-8b44a87d43b4

https://securityintelligence.com/articles/what-to-know-honda-key-fob-vulnerability/

https://www.theregister.com/2022/10/07/binance_hack_566m/

https://www.bnbchain.org/en/blog/bnb-chain-ecosystem-update/

https://www.bbc.com/news/business-58193396

https://www.theverge.com/2022/4/18/23030754/beanstalk-cryptocurrency-hack-182-million-dao-voting

https://www.coindesk.com/business/2022/10/06/celsius-top-execs-cashed-out-17m-in-crypto-before-bankruptcy/

https://jpgormally.medium.com/cybersecurity-is-a-successfully-failure-9bcf92a1bc88

https://www.bitsight.com/blog/zero-50k-infections-pseudomanuscrypt-sinkholing-part-1

Uber Breach, MFA fatigue, who can help communicate biz risk?

https://www.theverge.com/2022/9/16/23356213/uber-hack-teen-slack-google-cloud-credentials-powershell

https://www.zdnet.com/article/uber-security-breach-looks-bad-potentially-compromising-all-systems/

https://twitter.com/RachelTobac/status/1571542949606957057

Twitter:
@boettcherpwned

@infosystir

@brakeSec

@bryanbrake

www.brakeingsecurity.com

Twitch: https://twitch.tv/brakesec

Manual Code reviews/analysis, post-infosec Campout discussion

checkout our website: https://www.brakeingsecurity.com

Follow and subscribe with your Amazon Prime account to our Twitch stream: https://twitch.tv/brakesec

Twitter:
@infosystir

@boettcherpwned

@bryanbrake

@brakesec

Find us on all your favorite podcast platforms! Please leave us a 5 star review to help us grow!

Amanda's Sysmon Talk -p2

Part 2 of our discussion this week with Amanda, Brian, and Bryan on sysmon, We discuss use cases from her talk, and best ways to get sysmon integrated into your environment.

BrakeSec is:
Amanda Berlin @infosystir
Brian Boettcher @boettcherpwned
Bryan Brake @bryanbrake

https://www.brakeingsecurity.com

Our #twitch stream can be found at:

Https://twitch.tv/brakesec (subscription is req'd to see full videos)

Amanda's Sysmon Talk -p1

This week Amanda, Brian, and Bryan discuss sysmon, how it works to detect IOCs in your org, and how it extends beyond regular Windows event monitoring.

oh... and it's available for Linux too!

BrakeSec is:
Amanda Berlin @infosystir
Brian Boettcher @boettcherpwned
Bryan Brake @bryanbrake

https://www.brakeingsecurity.com

Our #twitch stream can be found at:

Https://twitch.tv/brakesec (subscription is req'd to see full videos)

Tanya Janca, Securing APIs, finding Security Champions, and accepting Risk

Tanya Janca, also known as @SheHacksPurple, is the best-selling author of ‘Alice and Bob Learn Application Security’. She is also the founder of We Hack Purple, an online learning academy, community and podcast that revolves around teaching everyone to create secure software. Tanya has been coding and working in IT for over twenty years, won countless awards, and has been everywhere from startups to public service to tech giants (Microsoft, Adobe, & Nokia). She has worn many hats; startup founder, pentester, CISO, AppSec Engineer, and software developer. She is an award-winning public speaker, active blogger & streamer and has delivered hundreds of talks and trainings on 6 continents. She values diversity, inclusion, and kindness, which shines through in her countless initiatives.

https://wehackpurple.com

BrakeSec is:
Amanda Berlin @infosystir
Brian Boettcher @boettcherpwned
Bryan Brake @bryanbrake

www.brakeingsecurity.com

https://twitch.tv/brakesec

Tanya Janca on secure coding practices, Swagger docs, and why documentation matters

Tanya Janca, also known as @SheHacksPurple, is the best-selling author of ‘Alice and Bob Learn Application Security’. She is also the founder of We Hack Purple, an online learning academy, community and podcast that revolves around teaching everyone to create secure software. Tanya has been coding and working in IT for over twenty years, won countless awards, and has been everywhere from startups to public service to tech giants (Microsoft, Adobe, & Nokia). She has worn many hats; startup founder, pentester, CISO, AppSec Engineer, and software developer. She is an award-winning public speaker, active blogger & streamer and has delivered hundreds of talks and trainings on 6 continents. She values diversity, inclusion, and kindness, which shines through in her countless initiatives.

https://shehackspurple.ca/

BrakeSec is:
Amanda Berlin @infosystir
Brian Boettcher @boettcherpwned
Bryan Brake @bryanbrake

www.brakeingsecurity.com

PYPI enables 2FA, some devs have a problem with this

Full #twitch VOD here (prime sub or paid sub required):  https://www.twitch.tv/videos/1528342722

https://github.com/untitaker/python-atomicwrites

https://thehackernews.com/2022/07/pypi-repository-makes-2af-security.html

Twitch streams (175+ hours of content!):
Https://twitch.tv/brakesec

www.brakeingsecurity.com

Twitter:

@infosystir

@boettcherpwned

@brakesec

@bryanbrake

JW Goerlich on Training, phishing exercises, security metrics,getting the most from user training

JW Goerlich - 

“Wolfgang is a cyber security strategist and an active part of the Michigan security community. He co-founded the OWASP Detroit chapter and organizes the annual Converge and BSides Detroit conferences. Wolfgang has held roles such as the Vice President of Consulting, Security Officer, and Vice President of Technology Services. He regularly advises clients on topics ranging from risk management, incident response, business continuity, secure development life cycles, and more.”

https://jwgoerlich.com/

RSA talks and discussion

Phishing tests - 

https://www.securityweek.com/research-simulated-phishing-tests-make-organizations-less-secure

https://hbr.org/2021/04/phishing-tests-are-necessary-but-they-dont-need-to-be-evil

What are the goal of these tests?

    That someone will click and activate (is that not a given?)

What made them popular in the first place?

Is this an example of management not taking security seriously, so we needed proof?

https://www.csoonline.com/article/3619610/best-practices-for-conducting-ethical-and-effective-phishing-tests.html

FTA: “This will only undermine the efforts of cybersecurity teams as a whole, alienating the very people they aim to engage with, Barker adds. “People generally don’t like to be tricked, and they don’t usually trust the people who trick them. One counterargument I often hear is that criminals use emotive lures in a phish, so why shouldn’t we? Well, criminals also cause physical damage to property, take systems offline, and disrupt services, but physical social engineers and pen-testers don’t—for good reason. Simulations should not cause active harm.””

Is this part of a larger issue? Why do we treat these tests the way we do?

Typical scenario?
Mgmt does not believe or trust their internal people to tell them what is wrong, and takes a 3rd party source/product to tell them the same thing.

    Are these stories Apocryphal? Or just my experience?

RSA conference, Zero Trust, SSO, 2FA, and multi-cloud tenancy with J Goerlich

jon-dimaggio-part2-threat intel-hacking back-analyzing malware

Author of the #noStarch book "The Art of Cyberwarfare" (https://nostarch.com/art-cyberwarfare) 
Topics:
discusses his book, 
threat intel as a service, 
why people enjoy malware analysis?
Should people 'hack back' and what legal issues are around that?
How do you soften the messaging if you have an insider threat team?

www.infoseccampout.com for more information about our 2022 conference in Seattle, WA on 26-28 August 2022!

Our full 90 minute stream with Jon, including 30 minutes of audio you won't get on the audio podcast is available at the $5 USD Patreon level, or via our VOD at our Twitch Broadcast site (https://twitch.tv/brakesec)



Twitch VOD Link: https://www.twitch.tv/videos/1308277609

Thank you to our Patreon and Twitch supporters for their generous donations and subs and bits!

Jon DiMaggio_Art-of-cyberwarfare_hacking_back-insider-threat-messaging_P1

Author of the #noStarch book "The Art of Cyberwarfare" (https://nostarch.com/art-cyberwarfare) 
Topics:
discusses his book, 
threat intel as a service, 
why people enjoy malware analysis?
Should people 'hack back' and what legal issues are around that?
How do you soften the messaging if you have an insider threat team?

www.infoseccampout.com for more information about our 2022 conference in Seattle, WA on 26-28 August 2022!

Our full 90 minute stream with Jon, including 30 minutes of audio you won't get on the audio podcast is available at the $5 USD Patreon level, or via our VOD at our Twitch Broadcast site (https://twitch.tv/brakesec)



Twitch VOD Link: https://www.twitch.tv/videos/1308277609

Thank you to our Patreon and Twitch supporters for their generous donations and subs and bits!

news, infosystir's talk at RSA, conti has an 'image' problem

https://www.reuters.com/technology/tesla-cars-bluetooth-locks-vulnerable-hackers-researchers-2022-05-17/

https://portswigger.net/daily-swig/us-revises-policy-regarding-computer-fraud-and-abuse-act-will-not-prosecute-good-faith-research

https://www.securityweek.com/conti-ransomware-operation-shut-down-after-brand-becomes-toxic

https://portswigger.net/daily-swig/chicago-public-schools-data-breach-blamed-on-ransomware-attack-on-supplier

https://www.helpnetsecurity.com/2022/05/23/protect-kubernetes-cluster/

https://www.darkreading.com/application-security/malicious-package-python-repository-cobalt-strike-windows-macos-linux

https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/

https://www.darkreading.com/application-security/6-scary-tactics-used-in-mobile-app-attacks

Mieng Lim, Ransomware actions, using insurance to offset risk, good IR/PR comms

Mieng-Lim-Ransomware-Best-Practices-p1

Mieng Lim, VP of Product at Digital Defense by HelpSystems

Topic she will discuss:

• Outsmarting RaaS: Strategies to Implement Before, During, and After a Ransomware Attack

Webinar: https://www.digitaldefense.com/resources/videos/webinar-outsmarting-raas-strategies-against-ransomware-attacks/

https://www.digitaldefense.com/blog/infographic-the-latest-ransomware-facts/

https://www.digitaldefense.com/wp-content/uploads/2020/07/Digital-Defense-Inc.-Ransomware-Infographic-070621.jpg

https://www.digitaldefense.com/blog/the-terrifying-truth-about-ransomware/

Prepared questions from Mieng:

• Belief that “malicious actors today are using cutting edge techniques for the majority of attacks”
• Belief that “majority of compromises are via zero-day vulnerabilities”
• Organizations continue to leave systems unpatched with years old vulnerabilities
• Belief that “my organization doesn’t have anything a malicious actor would be interested in…I’m not a target”
• My organization has cyber insurance and that’s enough.
• “I don’t have budget to buy all the products/hire the staff needed to protect my network.”

https://www.techrepublic.com/article/initial-access-brokers-how-are-iabs-related-to-the-rise-in-ransomware-attacks/

https://www.pandasecurity.com/en/mediacenter/security/ransomware-statistics/

As new approaches to ransomware like double extortion continue to pay off, attackers are demanding higher ransom payouts than ever before. The average ransom demand in the first half of 2021 amounted to $5.3 million — a 518% increase compared to 2020. The average ransom payment has also increased by 82% since 2020, reaching a whopping $570,000 in the first half of 2021 alone.

The FBI’s Internet Crime Complaint Center (IC3) received 2,084 ransomware complaints in the first half of 2021. (FBI and CISA)

At least one employee downloaded a malicious mobile application in 46% of organizations in 2021. (Check Point)

https://www.marsh.com/us/services/cyber-risk/insights/ransomware-paying-cyber-extortion-demands-in-cryptocurrency.html

@infosystir

@boettcherpwned

@bryanbrake (on Mastodon & Twitter)

@brakeSec

Discord Invite! "please click OK to accept the Code of Conduct in the 'Rules-and-info' channel" https://discord.gg/brakesec

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

Apple Podcasts: https://podcasts.apple.com/us/podcast/brakeing-down-security-podcast/id799131292

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

#Patreon:  https://brakesec.com/BDSPatreon

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Mick Douglas on threat intel, customer worries about being hacked, and more

@bettersafetynet

@infosystir

@boettcherpwned

@bryanbrake

@brakeSec

Discord Invite! "please click OK to accept the Code of Conduct in the 'Rules-and-info' channel" https://discord.gg/jhzm4bK9

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

Apple Podcasts: https://podcasts.apple.com/us/podcast/brakeing-down-security-podcast/id799131292

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

#Patreon:  https://brakesec.com/BDSPatreon

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

news, farmers affected by ransomware, protestware for the 3rd time, trusting opensource

https://www.cyberscoop.com/dhs-bug-bounty-122-vulnerabilities-27-critical-hackers/ https://securityaffairs.co/wordpress/130564/hacking/atlassian-jira-authentication-bypass-issue.html

    https://confluence.atlassian.com/jira/jira-security-advisory-2022-04-20-1115127899.html

https://www.coalfire.com/the-coalfire-blog/research-reveals-cyber-risk-is-the-best-language

https://www.securityweek.com/audio-codec-made-apple-introduced-serious-vulnerabilities-millions-android-phones

https://www.cnet.com/tech/mobile/verizon-wireless-customers-report-outages-across-us/

https://www.infosecurity-magazine.com/news/fbi-warns-us-farmers-of-ransomware/

https://www.bleepingcomputer.com/news/security/3-reasons-connected-devices-are-more-vulnerable-than-ever/

https://www.bleepingcomputer.com/news/security/third-npm-protestware-event-source-polyfill-calls-russia-out/

https://securityaffairs.co/wordpress/130497/security/cyber-insurance-global-riskenvironment.html

https://securityaffairs.co/wordpress/130443/hacking/cisco-umbrella-default-ssh-key.html

https://www.helpnetsecurity.com/2022/04/19/open-source-usage-trends/

https://gizmodo.com/cia-nsa-spies-tracked-anomaly-6-product-demo-1848830150

https://www.infosecurity-magazine.com/news/hackers-gain-admin-rights-with/

https://scottbarrykaufman.com/podcast/

Discord invite (must read and heed the Code of Conduct before admittance to the Discord.
https://discord.gg/38eEBYNJ7B (good for 100 invites)

Twitch stream: https://twitch.tv/brakesec

Mick Douglas discusses What2Log, and guidance in light of Okta incident

https://what2log.com/

https://twitch.tv/brakesec

https://www.brakeingsecurity.com

@bettersafetynet

@infosystir

@boettcherpwned

@bryanbrake

@brakeSec

logging analysis, log correlation, and threat analysis dicussion continues - p2

Amanda and Bryan discusses log analysis, finding, IOCs, and what to do about them.

https://twitch.tv/brakesec

www.brakeingsecurity.com

@infosystir on Twitter

@bryanbrake

@boettcherpwned

Shannon Noonan and Stacey Cameron - process automation -p2

Shannon Noonan and Stacey Cameron - QoS Consulting

https://www.bizagi.com/en/blog/digital-process-automation/4-ways-to-deliver-change-management-for-process-automation

https://www.forrester.com/blogs/the-new-change-management-automated-and-decentralized/

https://www.tibco.com/reference-center/what-is-process-automation

https://kissflow.com/workflow/workflow-automation/an-8-step-checklist-to-get-your-workflow-ready-for-automation/

https://www.malwarearchaeology.com/cheat-sheets

https://overapi.com/

https://www.darkreading.com/attacks-breaches/8-character-passwords-can-be-cracked-in-less-than-60-minutes

Shannon Noonan and Stacey Cameron - process automation

https://www.twitch.tv/brakesec

Youtube video (full version): https://www.youtube.com/watch?v=eRwYB22XMNw

Shannon Noonan and Stacey Cameron - QoS Consulting

https://www.bizagi.com/en/blog/digital-process-automation/4-ways-to-deliver-change-management-for-process-automation

https://www.forrester.com/blogs/the-new-change-management-automated-and-decentralized/

https://www.tibco.com/reference-center/what-is-process-automation

https://kissflow.com/workflow/workflow-automation/an-8-step-checklist-to-get-your-workflow-ready-for-automation/

https://www.malwarearchaeology.com/cheat-sheets

https://overapi.com/

https://www.darkreading.com/attacks-breaches/8-character-passwords-can-be-cracked-in-less-than-60-minutes

K12SIX-project-Doug_Levin-Eric_Lankford-threat_intel-edusec-p2

For context, we at the K12 Security Information Exchange (K12 SIX) are a relatively new K12-specific ISAC – launched to help protect the US K12 sector from emerging cybersecurity risk. One of our signature accomplishments in our first year was the development and release of our ‘essential protections’ series – an effort to establish baseline cybersecurity standards for schools. See: https://www.k12six.org/essential-cybersecurity-protections https://www.grf.org/

Global Resilience Federation

We will help your industry develop or enhance a trusted threat information sharing community, obtain actionable intelligence, and support you in emergencies.

We all count on the resiliency of essential services - services from the electricity powering our homes and the connectivity of entertainment apps, to the legal systems and financial pipelines driving the global economy. But this infrastructure faces constant threats from hacktivists, criminals, and rogue states, and they are growing in sophistication.

Leveraging nearly 20 years of ISAC and ISAO expertise, GRF is a non-profit created to connect sharing communities, for mutual defense.  

https://static1.squarespace.com/static/5e441b46adfb340b05008fe7/t/611d5fceff375d79ff4507c7/1629315022292/K12+SIX+Essential+Cybersecurity+Protections+2021+2022.pdf

https://theconversation.com/cybercriminals-use-pandemic-to-attack-schools-and-colleges-167619

https://edscoop.com/texas-school-paid-547k-ransomware-jam/ 

https://statescoop.com/ransomware-allen-texas-school-district-email-parents/ 

https://www.toptal.com/insights/innovation/cybersecurity-in-higher-education

https://www.highereddive.com/spons/inside-higher-educations-ransomware-crisis-how-colleges-and-universities/609688/

https://www.cnn.com/2022/01/07/politics/ransomware-schools-website/index.html

https://www.13abc.com/2021/02/22/toledo-public-school-students-seeing-effects-of-massive-data-breach/

2020 report: https://k12cybersecure.com/wp-content/uploads/2021/03/StateofK12Cybersecurity-2020.pdf

85-89% are underneath 2,500 students

Omg: https://www.edweek.org/leadership/education-statistics-facts-about-american-schools/2019/01

https://www.youtube.com/watch?v=otv0KzkfLSc –Florida mom, daughter accused of rigging homecoming queen votes break silence l GMA

There are 130,930 public and private K-12 schools in the U.S., according to 2017-18 data from the National Center for Education Statistics (NCES). Here’s how they break down:

• All: 130,930
• Elementary schools: 87,498
• Secondary schools: 26,727
• Combined schools: 15,804
• Other: 901

What are some of the ways you go about addressing the challenge of even reaching smaller schools? Does the isac help?

How do you communicate major security events like log4j? Do you keep track of complications with certain software stacks?

Someone listening might say “hey, I’d love to help…” what/if any opportunities can the larger infosec community do to help your org?

K12SIX's Eric Lankford and Doug Levin on helping schools get added security -p1

The K12 Security Information Exchange (K12 SIX) are a relatively new K12-specific ISAC – launched to help protect the US K12 sector from emerging cybersecurity risk. One of our signature accomplishments in our first year was the development and release of our ‘essential protections’ series – an effort to establish baseline cybersecurity standards for schools. See: https://www.k12six.org/essential-cybersecurity-protections

https://www.grf.org/

Global Resilience Federation

We will help your industry develop or enhance a trusted threat information sharing community, obtain actionable intelligence, and support you in emergencies.

We all count on the resiliency of essential services - services from the electricity powering our homes and the connectivity of entertainment apps, to the legal systems and financial pipelines driving the global economy. But this infrastructure faces constant threats from hacktivists, criminals, and rogue states, and they are growing in sophistication.

Leveraging nearly 20 years of ISAC and ISAO expertise, GRF is a non-profit created to connect sharing communities, for mutual defense.  

https://static1.squarespace.com/static/5e441b46adfb340b05008fe7/t/611d5fceff375d79ff4507c7/1629315022292/K12+SIX+Essential+Cybersecurity+Protections+2021+2022.pdf

https://theconversation.com/cybercriminals-use-pandemic-to-attack-schools-and-colleges-167619

https://edscoop.com/texas-school-paid-547k-ransomware-jam/ 

https://statescoop.com/ransomware-allen-texas-school-district-email-parents/ 

https://www.toptal.com/insights/innovation/cybersecurity-in-higher-education

https://www.highereddive.com/spons/inside-higher-educations-ransomware-crisis-how-colleges-and-universities/609688/

https://www.cnn.com/2022/01/07/politics/ransomware-schools-website/index.html

https://www.13abc.com/2021/02/22/toledo-public-school-students-seeing-effects-of-massive-data-breach/

2020 report: https://k12cybersecure.com/wp-content/uploads/2021/03/StateofK12Cybersecurity-2020.pdf

85-89% of school systems have 2,500 students or fewer

Omg: https://www.edweek.org/leadership/education-statistics-facts-about-american-schools/2019/01

https://www.youtube.com/watch?v=otv0KzkfLSc –Florida mom, daughter accused of rigging homecoming queen votes break silence

There are 130,930 public and private K-12 schools in the U.S., according to 2017-18 data from the National Center for Education Statistics (NCES). Here’s how they break down:

• All: 130,930
• Elementary schools: 87,498
• Secondary schools: 26,727
• Combined schools: 15,804
• Other: 901

What are some of the ways you go about addressing the challenge of even reaching smaller schools? Does the isac help?

How do you communicate major security events like log4j? Do you keep track of complications with certain software stacks?

Someone listening might say “hey, I’d love to help…” what/if any opportunities can the larger infosec community do to help your org?

April Wright and Alyssa Miller - IoT platforms, privacy and security, embracing standards

Alyssa Milller (@AlyssaM_InfoSec)

April Wright (@Aprilwright)

1. Open Source issues (quick discussion, because I value your opinions, and supply chain is important in the IoT world too.)

Log4j and OSS software management and profitability

Free as in beer, but you pay for the cup… (license costs $$, not the software). 

“If you make money using our software, you must buy a license” - not an end-user license

Open source conference at Whitehouse:

https://www.zdnet.com/article/log4j-after-white-house-meeting-google-calls-for-list-of-critical-open-source-projects/

https://www.wsj.com/articles/white-house-convenes-open-source-security-summit-amid-log4j-risks-11642119406

“For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems,” said Kent Walker, chief legal officer at Google in a blog post published after the meeting. “But in fact, while some projects do have many eyes on them, others have few or none at all.” 

Show was inspired by this Twitter conversation:

https://twitter.com/aprilwright/status/1461724712455782400?t=Fv2tmSTXrn-SSjPCka3gxg&s=19

https://twitter.com/AlyssaM_InfoSec/status/1464661807751213056?t=CFy-hgcHo2a8NwowKYo0hg&s=19

1. IOT architecture (https://www.avsystem.com/blog/iot-ecosystem/)

Open source IoT platforms: https://www.record-evolution.de/en/open-source-iot-platforms-making-innovation-count/

Cloud services - processing messages, register/de-register devices, pass messages to other devices/gateways

Gateways - 

Devices - 

Mobile apps -

SDKs - 

integrations

Cloud services DO go offline, point of failure:
https://www.datacenterdynamics.com/en/news/aws-us-east-1-outage-brings-down-services-around-the-world/

Connectivity and sharing mesh networks assumes you like your neighbors.

Sidewalk Whitepaper: https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf

network vulnerabilities: https://fractionalciso.com/why-you-should-not-be-using-xfinitywifi-hotspots/

1.  Stalking/privacy vs. tracking/surveillance

Fine GPS locations

Nearby devices triangulate (via BLE, wifi, or 900mhz)

We want to find our lost devices, but devices can be used for stalking

https://www.autoevolution.com/news/police-claim-apple-has-unwillingly-created-the-most-convenient-stalking-device-179228.html

Just have an iPhone and you’ll be able to find a stalking device, just install a 100MB app (Ring, Alexa, etc) to detect all devices in the area, or use the right ecosystem to find these items (or know every possible device that could be used to track someone)

What do companies want with that information?

What is a ‘happy medium’ to allow you to find your dog, but not to track people?

Device controls? Buzzers? (how loud can you make a noise in a small device?) Size issues, battery life, beaconing, self-identification (“Hi, I am a lost device…”)

Is what Airtags doing enough to reduce the fear?

Are we designing to edge cases? There are cheaper/easier ways to track someone (phones have a longer standby time than fetch/airtag/tile)

How often do you lose your keys? Why is your dog not on a leash or properly trained?

What will it take to make these kinds of devices more secure? 

https://spectrum.ieee.org/why-iot-sensors-need-standards
Will it take privacy protections to motivate IoT devices to design a better IoT device? Or force standards to be followed, like https://www.ioxtalliance.org/get-ioxt-certified?

Or NIST standards: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213-draft.pdf

https://csrc.nist.gov/publications/detail/sp/800-213a/final - detailed specs

1. Threat modeling, vulnerabilities in IoT networks and platforms

Does your Iot Platform give out SDKs for integrations or allowing 3rd party products or apps? https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/

https://www.avsystem.com/blog/iot-ecosystem/

Old and outdated libraries, like TCP vulnerabilities (RIPPLE20)

https://www.businessinsider.com/iot-security-privacy

https://www.eurofins-cybersecurity.com/news/security-problems-iot-devices/

https://arxiv.org/ftp/arxiv/papers/1302/1302.0939.pdf - Security and Privacy Issues in Wireless Mesh

Networks: A Survey

https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/

https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK

Opt-out of Amazon sidewalk

Amazon Sidewalk discussion: https://www.silabs.com/support/training/amazon-sidewalk-development/amz-103-amazon-sidewalk-technology-architecture-and-infrastructure

Fetch:
As one example, this week we announced Fetch, a compact, lightweight device that will clip to your pet’s collar and help ensure they’re safe. If your dog wanders outside a perimeter you’ve set using the Ring app, Fetch will let you know. In the future, expanding the Amazon Sidewalk network will provide customers with even more capabilities like real-time location information, helping you quickly reunite with your lost pet. For device makers, Fetch also serves as a reference design to demonstrate the potential that devices connected to a broad, reliable network can provide to their customers.

https://www.aboutamazon.com/news/devices/introducing-amazon-sidewalk

Alyssa Miller, April Wright, on IoT Privacy & Security, using tech for stalking, what could be done? Part1

Alyssa Milller (@AlyssaM_InfoSec)

April Wright (@Aprilwright)

Talk about side projects, podcasts, speaking events, etc (if you want to)

1. Open Source issues (quick discussion, because I value your opinions, and supply chain is important in the IoT world too.)

Log4j and OSS software management and profitability

Free as in beer, but you pay for the cup… (license costs $$, not the software). 

“If you make money using our software, you must buy a license” - not an end-user license

Open source conference at Whitehouse:

https://www.zdnet.com/article/log4j-after-white-house-meeting-google-calls-for-list-of-critical-open-source-projects/

https://www.wsj.com/articles/white-house-convenes-open-source-security-summit-amid-log4j-risks-11642119406

“For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems,” said Kent Walker, chief legal officer at Google in a blog post published after the meeting. “But in fact, while some projects do have many eyes on them, others have few or none at all.” 

Show was inspired by this Twitter conversation:

https://twitter.com/aprilwright/status/1461724712455782400?t=Fv2tmSTXrn-SSjPCka3gxg&s=19

https://twitter.com/AlyssaM_InfoSec/status/1464661807751213056?t=CFy-hgcHo2a8NwowKYo0hg&s=19

1. IOT architecture (https://www.avsystem.com/blog/iot-ecosystem/)

Open source IoT platforms: https://www.record-evolution.de/en/open-source-iot-platforms-making-innovation-count/

Cloud services - processing messages, register/de-register devices, pass messages to other devices/gateways

Gateways - 

Devices - 

Mobile apps -

SDKs - 

integrations

Cloud services DO go offline, point of failure:
https://www.datacenterdynamics.com/en/news/aws-us-east-1-outage-brings-down-services-around-the-world/

Connectivity and sharing mesh networks assumes you like your neighbors.

Sidewalk Whitepaper: https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf

network vulnerabilities: https://fractionalciso.com/why-you-should-not-be-using-xfinitywifi-hotspots/

1.  Stalking/privacy vs. tracking/surveillance

Fine GPS locations

Nearby devices triangulate (via BLE, wifi, or 900mhz)

We want to find our lost devices, but devices can be used for stalking

https://www.autoevolution.com/news/police-claim-apple-has-unwillingly-created-the-most-convenient-stalking-device-179228.html

Just have an iPhone and you’ll be able to find a stalking device, just install a 100MB app (Ring, Alexa, etc) to detect all devices in the area, or use the right ecosystem to find these items (or know every possible device that could be used to track someone)

What do companies want with that information?

What is a ‘happy medium’ to allow you to find your dog, but not to track people?

Device controls? Buzzers? (how loud can you make a noise in a small device?) Size issues, battery life, beaconing, self-identification (“Hi, I am a lost device…”)

Is what Airtags doing enough to reduce the fear?

Are we designing to edge cases? There are cheaper/easier ways to track someone (phones have a longer standby time than fetch/airtag/tile)

How often do you lose your keys? Why is your dog not on a leash or properly trained?

What will it take to make these kinds of devices more secure? 

https://spectrum.ieee.org/why-iot-sensors-need-standards
Will it take privacy protections to motivate IoT devices to design a better IoT device? Or force standards to be followed, like https://www.ioxtalliance.org/get-ioxt-certified?

Or NIST standards: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213-draft.pdf

https://csrc.nist.gov/publications/detail/sp/800-213a/final - detailed specs

1. Threat modeling, vulnerabilities in IoT networks and platforms

Does your Iot Platform give out SDKs for integrations or allowing 3rd party products or apps? https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/

https://www.avsystem.com/blog/iot-ecosystem/

Old and outdated libraries, like TCP vulnerabilities (RIPPLE20)

https://www.businessinsider.com/iot-security-privacy

https://www.eurofins-cybersecurity.com/news/security-problems-iot-devices/

https://arxiv.org/ftp/arxiv/papers/1302/1302.0939.pdf - Security and Privacy Issues in Wireless Mesh

Networks: A Survey

https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/

https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK

Opt-out of Amazon sidewalk

Amazon Sidewalk discussion: https://www.silabs.com/support/training/amazon-sidewalk-development/amz-103-amazon-sidewalk-technology-architecture-and-infrastructure

Fetch:
As one example, this week we announced Fetch, a compact, lightweight device that will clip to your pet’s collar and help ensure they’re safe. If your dog wanders outside a perimeter you’ve set using the Ring app, Fetch will let you know. In the future, expanding the Amazon Sidewalk network will provide customers with even more capabilities like real-time location information, helping you quickly reunite with your lost pet. For device makers, Fetch also serves as a reference design to demonstrate the potential that devices connected to a broad, reliable network can provide to their customers.

https://www.aboutamazon.com/news/devices/introducing-amazon-sidewalk

Bit of news, Belarus train system hack, VMware Horizon vulns, edge network device vulns

News articles we covered this week:

https://www.wired.com/story/belarus-railways-ransomware-hack-cyber-partisans/

https://www.hackingarticles.in/linux-privilege-escalation-polkit-cve-2021-3560/

https://old.reddit.com/r/msp/comments/s48iji/vmware_horizon_servers_being_actively_hit_with/

https://www.bleepingcomputer.com/news/security/over-20-000-data-center-management-systems-exposed-to-hackers/

Whimmery's Walkthroughs: Join @whimmery on her twitch or on the @brakesec Youtube channel for walkthroughs on Burp Suite training and more!

Twitter handles:
Official Podcast: @brakesec

Brian Boettcher: @boettcherpwned

Amanda Berlin: @infosystir @hackersHealth @infosecroleplay

Bryan Brake: @bryanbrake

April Wright and Alyssa Miller- Open Source sustainabilty

Alyssa Milller (@AlyssaM_InfoSec)
April Wright (@Aprilwright)

0. Open Source issues (quick discussion, because I value your opinions, and supply chain is important in the IoT world too.)
Log4j and OSS software management and profitability
Free as in beer, but you pay for the cup… (license costs $$, not the software). 
“If you make money using our software, you must buy a license” - not an end-user license

Open source conference at Whitehouse:
https://www.zdnet.com/article/log4j-after-white-house-meeting-google-calls-for-list-of-critical-open-source-projects/
https://www.wsj.com/articles/white-house-convenes-open-source-security-summit-amid-log4j-risks-11642119406
“For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems,” said Kent Walker, chief legal officer at Google in a blog post published after the meeting. “But in fact, while some projects do have many eyes on them, others have few or none at all.” 

Show was inspired by this Twitter conversation:

https://twitter.com/aprilwright/status/1461724712455782400?t=Fv2tmSTXrn-SSjPCka3gxg&s=19

https://twitter.com/AlyssaM_InfoSec/status/1464661807751213056?t=CFy-hgcHo2a8NwowKYo0hg&s=19

IOT architecture (https://www.avsystem.com/blog/iot-ecosystem/)
Open source IoT platforms: https://www.record-evolution.de/en/open-source-iot-platforms-making-innovation-count/

Cloud services - processing messages, register/de-register devices, pass messages to other devices/gateways
Gateways - 
Devices - 
Mobile apps -
SDKs - 
integrations

Cloud services DO go offline, point of failure:
https://www.datacenterdynamics.com/en/news/aws-us-east-1-outage-brings-down-services-around-the-world/
Connectivity and sharing mesh networks assumes you like your neighbors.
Sidewalk Whitepaper: https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf

network vulnerabilities: https://fractionalciso.com/why-you-should-not-be-using-xfinitywifi-hotspots/

 Stalking/privacy vs. tracking/surveillance

Fine GPS locations
Nearby devices triangulate (via BLE, wifi, or 900mhz)
We want to find our lost devices, but devices can be used for stalking
https://www.autoevolution.com/news/police-claim-apple-has-unwillingly-created-the-most-convenient-stalking-device-179228.html

Just have an iPhone and you’ll be able to find a stalking device, just install a 100MB app (Ring, Alexa, etc) to detect all devices in the area, or use the right ecosystem to find these items (or know every possible device that could be used to track someone)

What do companies want with that information?

What is a ‘happy medium’ to allow you to find your dog, but not to track people?
Device controls? Buzzers? (how loud can you make a noise in a small device?) Size issues, battery life, beaconing, self-identification (“Hi, I am a lost device…”)
Is what Airtags doing enough to reduce the fear?
Are we designing to edge cases? There are cheaper/easier ways to track someone (phones have a longer standby time than fetch/airtag/tile)
How often do you lose your keys? Why is your dog not on a leash or properly trained?
What will it take to make these kinds of devices more secure? 

https://spectrum.ieee.org/why-iot-sensors-need-standards
Will it take privacy protections to motivate IoT devices to design a better IoT device? Or force standards to be followed, like https://www.ioxtalliance.org/get-ioxt-certified?
Or NIST standards: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213-draft.pdf
https://csrc.nist.gov/publications/detail/sp/800-213a/final - detailed specs

Threat modeling, vulnerabilities in IoT networks and platforms

Does your Iot Platform give out SDKs for integrations or allowing 3rd party products or apps? https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/

https://www.avsystem.com/blog/iot-ecosystem/
Old and outdated libraries, like TCP vulnerabilities (RIPPLE20)

https://www.businessinsider.com/iot-security-privacy

https://www.eurofins-cybersecurity.com/news/security-problems-iot-devices/

https://arxiv.org/ftp/arxiv/papers/1302/1302.0939.pdf - Security and Privacy Issues in Wireless Mesh
Networks: A Survey

https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/

https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK
Opt-out of Amazon sidewalk

Amazon Sidewalk discussion: https://www.silabs.com/support/training/amazon-sidewalk-development/amz-103-amazon-sidewalk-technology-architecture-and-infrastructure

Fetch:
As one example, this week we announced Fetch, a compact, lightweight device that will clip to your pet’s collar and help ensure they’re safe. If your dog wanders outside a perimeter you’ve set using the Ring app, Fetch will let you know. In the future, expanding the Amazon Sidewalk network will provide customers with even more capabilities like real-time location information, helping you quickly reunite with your lost pet. For device makers, Fetch also serves as a reference design to demonstrate the potential that devices connected to a broad, reliable network can provide to their customers.
https://www.aboutamazon.com/news/devices/introducing-amazon-sidewalk

Amélie Koran and Adam Baldwin discuss OSS sustainability, supply chain security,, governance, and outreach for popular applications - part2

Adam Baldwin (@adam_baldwin)
Amélie Koran (@webjedi)

https://logging.apache.org/log4j/2.x/license.html

https://www.theregister.com/2021/12/14/log4j_vulnerability_open_source_funding/

https://www.zdnet.com/article/security-firm-blumira-discovers-major-new-log4j-attack-vector/

F/OSS developer deliberately bricks his software in retaliation for big companies not supporting OSS.
https://twitter.com/BleepinComputer/status/1480182019854327808

https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

https://developers.slashdot.org/story/22/01/09/2336239/open-source-developer-intentionally-corrupts-his-own-widely-used-libraries

Faker.js - https://www.npmjs.com/package/faker  Generate massive amounts of fake contextual data
Colors.js - https://www.npmjs.com/pafaker  - npm package/colors get color and style in your node.js console

https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/

Should OSS teams expect payment for giving their time/code away for free? What are their expectations

Should open source projects be aware of how popular they are? What happens when they reach a certain level of popularity?

OSS Sustainability - https://github.blog/2019-01-17-lets-talk-about-open-source-sustainability/

https://webjedi.net/2022/01/03/security-puppy/

Apparently, “Hobbyists” were the bane of a young Bill Gates: (can you https://en.wikipedia.org/wiki/Open_Letter_to_Hobbyists

https://en.wikipedia.org/wiki/History_of_free_and_open-source_software
History of open source

Licensing Overview: https://youtu.be/Eu_GvrSlShI  (this was a talk I gave for Splunk on this --AK)

Event-stream = https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets

https://libraries.io/
Libraries.io monitors 5,039,738 open source packages across 32 different package managers, so you don't have to.

OSS sustainability, log4j fallout, developer damages own code-p1

Adam Baldwin (@adam_baldwin)

Amélie Koran (@webjedi)

Log4j vulnerability

https://logging.apache.org/log4j/2.x/license.html

https://www.theregister.com/2021/12/14/log4j_vulnerability_open_source_funding/

https://www.zdnet.com/article/security-firm-blumira-discovers-major-new-log4j-attack-vector/ 

F/OSS developer deliberately bricks his software in retaliation for big companies not supporting OSS. 

https://twitter.com/BleepinComputer/status/1480182019854327808

https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

https://developers.slashdot.org/story/22/01/09/2336239/open-source-developer-intentionally-corrupts-his-own-widely-used-libraries

Faker.js -  https://www.npmjs.com/package/faker Generate massive amounts of fake contextual data

Colors.js -  https://www.npmjs.com/pafaker - npmckage/colors get color and style in your node.js console

https://abc7ny.com/suspicious-package-queens-astoria-fire/6425363/

Should OSS teams expect payment for giving their time/code away for free? What are their expectations

Should open source projects be aware of how popular they are? What happens when they reach a certain level of popularity? 

OSS Sustainability - https://github.blog/2019-01-17-lets-talk-about-open-source-sustainability/

https://webjedi.net/2022/01/03/security-puppy/

Apparently, “Hobbyists” were the bane of a young Bill Gates: (can you https://en.wikipedia.org/wiki/Open_Letter_to_Hobbyists

https://en.wikipedia.org/wiki/History_of_free_and_open-source_software

History of open source

Licensing Overview: https://youtu.be/Eu_GvrSlShI (this was a talk I gave for Splunk on this)

Event-stream = https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets

https://libraries.io/

• Libraries.io monitors 5,039,738 open source packages across 32 different package managers, so you don't have to. 

2021-046-Mick Douglas, Log4j vulnerabilities, egress mitigations- part2

Introduction

Overview of Log4j vuln (as of 16 December 2021)

Why is it a big deal? (impact/criticality/risk)

Talk about patching vs. mitigation

why wasn’t this given the same visibility in 2009? Because it’s Oracle or Java?

Good callout is building slides to brief org leadership, detections, and other educational tools.

Vuln fatigue (Java vulns in 2009 and pretty much forever cause us fatigue)

Are there other technologies like log4j that prop up the entire world, and we just don’t know?

Egress traffic (discussed at length on twitter, what problems it solve?)

https://twitter.com/mubix/status/1470430085169745920

Latest: https://www.theregister.com/2021/12/14/apache_log4j_v2_16_jndi_disabled_default/ - apache removed JDNI functionality

https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/ <- great aggregation

https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/

https://issues.apache.org/jira/plugins/servlet/mobile#issue/LOG4J2-313

Lots of discussion about “SBOM solving the issue”. @K8em0 weighs in https://twitter.com/k8em0/status/1469437490691932164

https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 -list of advisories for log4j

Mitigation: https://twitter.com/brunoborges/status/1469186875608875011
https://twitter.com/DannyThomas/status/1469709039911129088 (holy hell, 2009?!?)

2009 in fact, #CVE-2009-1094, then a bypass was fixed in CVE-2018-3149: https://bugzilla.redhat.com/show_bug.cgi?id=1639834. That's when the JDK was fully protected, but other implementations remained vulnerable

https://bugzilla.redhat.com/show_bug.cgi?id=1639834

OpenJDK… 

https://twitter.com/ThinkstCanary/status/1469439743905697797?s=20 

You can use a point & click canarytoken from https://canarytokens.org to help test for the #log4j  / #Log4Shell issue.

1) visit https://canarytokens.org;

2) choose the Log4shell token;

3) enter the email address you wish to be notified at;

4) copy/use the returned string...

Discussed in 2016 at Blackhat: https://twitter.com/th3_protoCOL/status/1469644923028656130

The #Log4Shell attack vector was known since 2016… 

https://twitter.com/bettersafetynet/status/1469470284977745932

Just got off phone with a client. Log4j is in their network. Vendor claims patch will be available next release... which is multiple months from now. Here's what you do if you're in this situation. 1. Keep calm. There's no need to panic. 2. Carefully read this thread.

When dealing with attacks like this you should remember the acronym IMMA. 

I = Isolate 

M = Minimize 

M = Monitor 

A = Active Defense

https://github.com/MarkBaggett/srum-dump

“SRUM Dump extracts information from the System Resource Utilization Management Database and creates a Excel spreadsheet.

The SRUM is one of the best sources for applications that have run on your system in the last 30 days and is invaluable to your incident investigations!

To use the tool you will need a copy of the SRUM (located in c:\windows\system32\sru\srudb.dat, but locked by the OS).

This tool also requires a SRUM_TEMPLATE that defines table and field names. You can optionally provide the SOFTWARE registry hive and the tool will tell you which wireless networks were in use by applications.

If you are looking for a version of this tool that creates CSV files instead of an Excel spreadsheet, dumps targeted tables or processes any ese then check out ese2csv. ese2csv.exe is designed specifically for csv files with the CLI user in mind.”

https://support.microsoft.com/en-us/office/digitally-sign-your-macro-project-956e9cc8-bbf6-4365-8bfa-98505ecd1c01

2021-045-Mick Douglas, Log4j vulnerabilities, egress mitigations- part1

Introduction

Overview of Log4j vuln (as of 16 December 2021)

Why is it a big deal? (impact/criticality/risk)

Talk about patching vs. mitigation

why wasn’t this given the same visibility in 2009? Because it’s Oracle or Java?

Good callout is building slides to brief org leadership, detections, and other educational tools.

Vuln fatigue (Java vulns in 2009 and pretty much forever cause us fatigue)

Are there other technologies like log4j that prop up the entire world, and we just don’t know?

Egress traffic (discussed at length on twitter, what problems it solve?)

https://twitter.com/mubix/status/1470430085169745920

Latest: https://www.theregister.com/2021/12/14/apache_log4j_v2_16_jndi_disabled_default/ - apache removed JDNI functionality

https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/ <- great aggregation

https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/

https://issues.apache.org/jira/plugins/servlet/mobile#issue/LOG4J2-313

Lots of discussion about “SBOM solving the issue”. @K8em0 weighs in https://twitter.com/k8em0/status/1469437490691932164

https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 -list of advisories for log4j

Mitigation: https://twitter.com/brunoborges/status/1469186875608875011
https://twitter.com/DannyThomas/status/1469709039911129088 (holy hell, 2009?!?)

2009 in fact, #CVE-2009-1094, then a bypass was fixed in CVE-2018-3149: https://bugzilla.redhat.com/show_bug.cgi?id=1639834. That's when the JDK was fully protected, but other implementations remained vulnerable

https://bugzilla.redhat.com/show_bug.cgi?id=1639834

OpenJDK… 

https://twitter.com/ThinkstCanary/status/1469439743905697797?s=20 

You can use a point & click canarytoken from https://canarytokens.org to help test for the #log4j  / #Log4Shell issue.

1) visit https://canarytokens.org;

2) choose the Log4shell token;

3) enter the email address you wish to be notified at;

4) copy/use the returned string...

Discussed in 2016 at Blackhat: https://twitter.com/th3_protoCOL/status/1469644923028656130

The #Log4Shell attack vector was known since 2016… 

https://twitter.com/bettersafetynet/status/1469470284977745932

Just got off phone with a client. Log4j is in their network. Vendor claims patch will be available next release... which is multiple months from now. Here's what you do if you're in this situation. 1. Keep calm. There's no need to panic. 2. Carefully read this thread.

When dealing with attacks like this you should remember the acronym IMMA. 

I = Isolate 

M = Minimize 

M = Monitor 

A = Active Defense

https://github.com/MarkBaggett/srum-dump

“SRUM Dump extracts information from the System Resource Utilization Management Database and creates a Excel spreadsheet.

The SRUM is one of the best sources for applications that have run on your system in the last 30 days and is invaluable to your incident investigations!

To use the tool you will need a copy of the SRUM (located in c:\windows\system32\sru\srudb.dat, but locked by the OS).

This tool also requires a SRUM_TEMPLATE that defines table and field names. You can optionally provide the SOFTWARE registry hive and the tool will tell you which wireless networks were in use by applications.

If you are looking for a version of this tool that creates CSV files instead of an Excel spreadsheet, dumps targeted tables or processes any ese then check out ese2csv. ese2csv.exe is designed specifically for csv files with the CLI user in mind.”

https://support.microsoft.com/en-us/office/digitally-sign-your-macro-project-956e9cc8-bbf6-4365-8bfa-98505ecd1c01

2021-044-Litmoose discusses stalking and protecting yourself

New $3 patron! 🎉Thank you John K.!

• National Domestic Violence Hotline at 1-800-799-7233, or by online chat.
• National Sexual Assault Hotline at 1-800-656-4673, or by online chat.

https://www.stalkingawareness.org/wp-content/uploads/2019/01/SPARC_StalkngFactSheet_2018_FINAL.pdf

TALKING VICTIMIZATION 

An estimated 6-7.5 million people are #stalked in a one year period in the United States. 
Nearly 1 in 6 women and 1 in 17 men have experienced stalking victimization at some point in their lifetime. 
Using a less conservative definition of stalking, which considers any amount of fear (i.e., a little fearful, somewhat fearful, or very fearful), 1 in 4 women and 1 in 13 men reported being a victim of stalking in their lifetime.
About half of all victims of stalking indicated that they were stalked before the age of 25. 
Stalkers use many tactics including: 
Approaching the victim or showing up in places when the victim didn’t want them to be there; 
making unwanted telephone calls; leaving the victim unwanted messages (text or voice); 
watching or following the victim from a distance
spying on the victim with a listening device, camera, or #GPS.  (or #IOT device)

https://www.vice.com/en/article/d3akpk/smart-home-technology-stalking-harassment

https://www.ucl.ac.uk/steapp/sites/steapp/files/giot-report.pdf - Tech Abuse Gender and IoT Research Report 

https://www.researchgate.net/publication/260867980_TRAPPED_TECHNOLOGY_AS_A_BARRIER_TO_LEAVING_AN_ABUSIVE_RELATIONSHIP

Center to End Technical #Abuse (CETA) https://www.ceta.tech.cornell.edu/resources

https://82beb9a6-b7db-490a-88be-9f149bafe221.filesusr.com/ugd/c4e6d5_20fe31daffd74b2fb4b4735d703dad6a.pdf -disconnect checklist

Tw: stalking resulting in death: 

A pattern of fixation and obsession’: How the #pandemic exacerbated stalking cases in the UK

https://www.independent.co.uk/life-style/women/stalking-cases-pandemic-gracie-spinks-b1956589.html

https://pathwaystosafety.org/staying-safe/

https://www.techsafety.org/

https://static1.squarespace.com/static/51dc541ce4b03ebab8c5c88c/t/61674c082419497a370af990/1634159630368/2021_T2E+Needs+Assessment+Report.pdf 

“Smart” or connected devices often referred to as the Internet of Things (IoT) turn up in cases “all the time” or “often” for a third of advocates and 1 in 5 #legal systems professionals. While this is rather low, people are increasingly using these types of technology. With additional use we may see increases in abuse through them. Additionally, advocates and legal systems professionals are often not aware of how these technologies can be misused, so they may not ask about them.

2021-043- Fred Jennings, Vuln Disclosure policy, VEP, and 0day disclosure - p2

https://twitter.com/Esquiring - Fred Jennings

Vulnerabilities Equity program (VEP), vuln disclosure program (VDP), and what is the a way for disclosure of 0day? (‘proper’ is different and dependent)

This show was inspired by this Tweet thread from @k8em0 and @_MG_
https://twitter.com/k8em0/status/1459715464691535877

https://twitter.com/_MG_/status/1459718518346174465

Legal Safe Harbor? Copy-left for security researchers…?

What is a VEP? Not a new concept (2014)

https://obamawhitehouse.archives.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities

Context: Was written when Heartbleed came out.

About transparency, but within reason

From the blogpost:
“We have also established a disciplined, rigorous and high-level decision-making process for vulnerability disclosure. This interagency process helps ensure that all of the pros and cons are properly considered and weighed. While there are no hard and fast rules, here are a few things I want to know when an agency proposes temporarily withholding knowledge of a vulnerability:

How much is the vulnerable system used in the core internet infrastructure, in other critical infrastructure systems, in the U.S. economy, and/or in national security systems?

Does the vulnerability, if left unpatched, impose significant risk?

How much harm could an adversary nation or criminal group do with knowledge of this vulnerability?

How likely is it that we would know if someone else was exploiting it?

How badly do we need the intelligence we think we can get from exploiting the vulnerability?

Are there other ways we can get it?

Could we utilize the vulnerability for a short period of time before we disclose it?

How likely is it that someone else will discover the vulnerability?

Can the vulnerability be patched or otherwise mitigated?”

Gov orgs involved in VEP: https://en.wikipedia.org/wiki/Vulnerabilities_Equities_Process

Assessing the Vulnerabilities Equities Process, Three Years After the VEP Charter

Companies have VEP (every time they issue a patch), but they aren’t always transparent about it. Embargoes a plenty. https://www.redhat.com/en/blog/security-embargoes-red-hat

https://xenproject.org/developers/security-policy/  (creates a caste system of ‘haves and not-haves’... important vs. not important) bad guys will target people not on the inside.

0day benefit from non-transparent VEP. https://www.randori.com/blog/why-zero-days-are-essential-to-security/

Randori had 365day… https://twitter.com/_MG_/status/1459024603263557633

https://twitter.com/JimSycurity/status/1459152870490574854

Preferred patch 8.1.17, issued october 2020

VEP does not always have to be 0day… can be solutions to issues: https://www.techdirt.com/articles/20210922/17095747614/fbi-sat-ransomware-decryption-key-weeks-as-victims-lost-millions-dollars.shtml

“The FBI refrained for almost three weeks from helping to unlock the computers of hundreds of businesses and institutions hobbled by a major ransomware attack this summer, even though the bureau had secretly obtained the digital key needed to do so, according to several current and former U.S. officials.

The key was obtained through access to the servers of the Russia-based criminal gang behind the July attack. Deploying it immediately could have helped the victims, including schools and hospitals, avoid what analysts estimate was millions of dollars in recovery costs.

In a perfect world, what does disclosure look like?

Communication (easy, secure, detailed… pick 1)

Separating wheat from chaff - ‘lol, i got root, pay me plz’

Fear of NDAs and gag clauses

Do people expect to be paid?

Setup of a ‘cheap’ program? What if you don’t have a budget to pay out (or more accurately, mgmt won’t pay out)? People won’t disclose? Should you pay? Use a 3rd party?

2021-042- Fred Jennings, VDP, Vuln Equity, And 0day disclosure - p1

https://twitter.com/Esquiring - Fred Jennings

Vulnerabilities Equity program (VEP), vuln disclosure program (VDP), and what is the best way for disclosure of 0day? (‘proper’ is different and dependent)

This show was inspired by this Tweet thread from @k8em0 and @_MG_
https://twitter.com/k8em0/status/1459715464691535877

https://twitter.com/_MG_/status/1459718518346174465

Legal Safe Harbor? Copy-left for security researchers…?

What is a VEP? Not a new concept (2014)

https://obamawhitehouse.archives.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities

Context: Was written when Heartbleed came out.

About transparency, but within reason

From the blogpost:
“We have also established a disciplined, rigorous and high-level decision-making process for vulnerability disclosure. This interagency process helps ensure that all of the pros and cons are properly considered and weighed. While there are no hard and fast rules, here are a few things I want to know when an agency proposes temporarily withholding knowledge of a vulnerability:

How much is the vulnerable system used in the core internet infrastructure, in other critical infrastructure systems, in the U.S. economy, and/or in national security systems?

Does the vulnerability, if left unpatched, impose significant risk?

How much harm could an adversary nation or criminal group do with knowledge of this vulnerability?

How likely is it that we would know if someone else was exploiting it?

How badly do we need the intelligence we think we can get from exploiting the vulnerability?

Are there other ways we can get it?

Could we utilize the vulnerability for a short period of time before we disclose it?

How likely is it that someone else will discover the vulnerability?

Can the vulnerability be patched or otherwise mitigated?”

Gov orgs involved in VEP: https://en.wikipedia.org/wiki/Vulnerabilities_Equities_Process

Assessing the Vulnerabilities Equities Process, Three Years After the VEP Charter

Companies have VEP (every time they issue a patch), but they aren’t always transparent about it. Embargoes a plenty. https://www.redhat.com/en/blog/security-embargoes-red-hat

https://xenproject.org/developers/security-policy/  (creates a caste system of ‘haves and not-haves’... important vs. not important) bad guys will target people not on the inside.

0day benefit from non-transparent VEP. https://www.randori.com/blog/why-zero-days-are-essential-to-security/

Randori had 365day… https://twitter.com/_MG_/status/1459024603263557633

https://twitter.com/JimSycurity/status/1459152870490574854

Preferred patch 8.1.17, issued october 2020

VEP does not always have to be 0day… can be solutions to issues: https://www.techdirt.com/articles/20210922/17095747614/fbi-sat-ransomware-decryption-key-weeks-as-victims-lost-millions-dollars.shtml

“The FBI refrained for almost three weeks from helping to unlock the computers of hundreds of businesses and institutions hobbled by a major ransomware attack this summer, even though the bureau had secretly obtained the digital key needed to do so, according to several current and former U.S. officials.

The key was obtained through access to the servers of the Russia-based criminal gang behind the July attack. Deploying it immediately could have helped the victims, including schools and hospitals, avoid what analysts estimate was millions of dollars in recovery costs.

In a perfect world, what does disclosure look like?

Communication (easy, secure, detailed… pick 1)

Separating wheat from chaff - ‘lol, i got root, pay me plz’

Fear of NDAs and gag clauses

Do people expect to be paid?

Setup of a ‘cheap’ program? What if you don’t have a budget to pay out (or more accurately, mgmt won’t pay out)? People won’t disclose? Should you pay? Use a 3rd party?

Blumira Sponsor #3 - Emily Eubanks, more actionable events, incident response help, and more

In this sponsored BDS episode, Bryan Brake and Amanda Berlin interview Emily Eubanks, a Security Operations Analyst for #Blumira. We discuss common business risks like IT staff turnover, a lack of Incident Response procedures, choosing not to follow PowerShell best practices, and MFA use for critical or sensitive applications. We also discuss ways to improve security posture to mitigate these risks as well as how Blumira can help organizations in light of these common business challenges.

ADDITIONAL RESOURCES

OUR REDDIT AMA

https://www.reddit.com/r/cybersecurity/comments/qao73j/we_are_a_security_team_with_20_years_of_ethical/ 

MFA

https://attack.mitre.org/mitigations/M1032/ 

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/your-pa-word-doesn-t-matter/ba-p/731984 

https://www.yubico.com/blog/otp-vs-u2f-strong-to-stronger/ 

INCIDENT RESPONSE

https://www.nist.gov/cyberframework/respond 

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf 

POWERSHELL BEST PRACTICES

https://www.blumira.com/analysis-of-a-threat-powershell-malicious-activity/ 

https://docs.microsoft.com/en-us/mem/configmgr/apps/deploy-use/learn-script-security 

https://devblogs.microsoft.com/powershell/secrets-management-module-vault-extensions/ 

https://www.reddit.com/r/PowerShell/comments/g3b9h5/how_are_you_managing_secrets/ 

RISK: A lack of MFA where available or using SMS based MFA for critical applications.
Please do not use SMS based MFA for critical applications. [6] [7]
This is an easy layer of defense that has historically been very effective [5]
One-Time Passwords (OTP) good but [8] FIDO U2F better
Consider hardware tokens (e.g. Yubico YubiKey, Google Titan Security Key).
MITIGATION: 
Blumira requires use of MFA
MFA related detections (e.g. AWS, Duo)
BLUMIRA HELPS:

Incident Response Procedures

RISK: A lack of Incident Response Procedures or the decision to postpone incident response procedures because they would result in a disruption in service typically results in unfavorable outcomes.
A written plan that identifies the roles, responsibilities, and procedures that should be set in motion once an incident has been declared. 
If this is overwhelming to conceptualize, know there are a good amount of free and openly available resources already in existence to help with creations of new IR plans >> I highly recommend looking at NIST documentation to get an idea of what is possible and then scale to what is appropriate for your organization [4]
The plan should be reviewed at a minimum once annually with everyone who is responsible for responding to incidents present. If anybody is unclear with their role, responsibilities or procedures then the Incident Response lead should work with them to get them there. 
Incident Response procedures should be like a fire drill so that when there is a real fire, the team can work together to quickly put that fire out and minimize impact to the company and their customers. (Shoutout to the BDS podcast on drawing connections from fire fighting to Incident Response procedures with Dr. Catherine J. Ullman (@investigatorchi))
MITIGATION:
Workflows
Blumira helps with this by providing built-in guidance with workflows.
Workflows ask direct questions and provide specific options to record responses to security findings to guide practitioners towards a conclusion.
provides additional details to help operators make informed decisions in response to new findings.
Finding analysis 
BLUMIRA HELPS:

Recent or Frequent IT Staff Turnover

RISK: impedes troubleshooting logflow and/or investigations due the a lack of familiarity with the network environment
Prevention might be the best solution? Giving your workers time during the work week to improve a work related skill can help identify when a team is reaching or exceeding their resource capacity. If your team is overworked they are more likely to make mistakes, will be less prepared to go the extra mile when it is needed because they’ll already be tapped out of energy, and may be more likely to consider opportunities elsewhere.
You want to limit keystone employees, meaning that if an employee leaves for whatever reason you do not want that employee’s absence to cause a breakdown in processes for others. Redundancy is best here in most cases IMO.
MITIGATION:
Blumira works hard to create fewer, more actionable findings. 
We strive to keep our alerts simple to provide the information that operators need to make informed decisions.
We try to focus on findings that require action and provide workflows to provide additional guidance to help share recommendations on what to investigate next to evaluate the impact of a security event
BLUMIRA HELPS: 

PowerShell Scripting Best Practices

RISK:
Detections will be less helpful if staff are frequently dismissing events in response to approved administrative behavior like maintenance scripts.
Follow the PowerShell recommendations shared by Microsoft [1] including:
Sign your scripts (lol Microsoft has this bolded by the way hint hint wink wink) “another method for keeping scripts security is vetting and signing your scripts
Do not store secrets in PoSH scripts; if you are doing this you’re gonna want to google “secrets management” [2] and learn more about how to secure store and access secrets across an enterprise environment 
Briefly, there is a powershell module for vault secret extensions [3] some vault extensions include KeePass, LastPass, Hashicorp Vault, Azure KeyVault, KeyChain, and CredMan
Use a recent version of Powershell (we are on version 7, but this article recommends 5+)
Enable and collect powershell logs
MITIGATION:
Blumira detects on malicious powershell usage.
BLUMIRA HELPS:

ADDITIONAL LINKS AND SOURCES: 

[1] https://docs.microsoft.com/en-us/mem/configmgr/apps/deploy-use/learn-script-security 

[2] https://www.reddit.com/r/PowerShell/comments/g3b9h5/how_are_you_managing_secrets/ 

[3] https://github.com/PowerShell/SecretManagement 

[3] https://devblogs.microsoft.com/powershell/secrets-management-module-vault-extensions/ 

[4] https://www.nist.gov/cyberframework/respond 

[5] https://attack.mitre.org/mitigations/M1032/ 

[6] https://techcommunity.microsoft.com/t5/azure-active-directory-identity/your-pa-word-doesn-t-matter/ba-p/731984 

[7] https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/

[8] https://www.yubico.com/blog/otp-vs-u2f-strong-to-stronger/ 

https://www.blumira.com/analysis-of-a-threat-powershell-malicious-activity/

2021-041-0day disclosure, Randori, FBI email server pwnage

https://www.bleepingcomputer.com/news/security/us-education-dept-urged-to-boost-k-12-schools-ransomware-defenses/

https://securityaffairs.co/wordpress/124570/cyber-crime/fbi-hacked-email-server.html

https://www.zdnet.com/article/security-company-faces-backlash-for-waiting-12-months-to-disclose-palo-alto-0-day/

https://www.randori.com/blog/why-zero-days-are-essential-to-security/

https://twitter.com/_MG_/status/1459024603263557633

“Hey... did anyone notice that PAN 0day was fixed in a version that was released over a year ago? 

Guess it wasn't easy to notice under all the loud opinions about ethics.”

https://twitter.com/_MG_/status/1459038747807285253/photo/1

2021-040-Sweden's parents rebel over poor App design, US government forcing patching of systems, and Vuln chaining

News stories covered this week, as well as links of note:

https://www.wired.co.uk/article/sweden-stockholm-school-app-open-source

https://curtbraz.medium.com/a-konami-code-for-vuln-chaining-combos-1a29d0a27c2a 

https://docs.google.com/presentation/d/17gISafUZzEyjV7wkdHaTQZmtxstBqECa/edit#slide=id.p4

https://www.securityweek.com/braktooth-new-bluetooth-vulnerabilities-could-affect-millions-devices

https://offsec.almond.consulting/intro-to-file-operation-abuse-on-Windows.html

https://searchsecurity.techtarget.com/news/252509040/CISA-cracks-the-whip-on-patching-vulnerabilities

https://cyber.dhs.gov/bod/22-01/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

2021-039-Minimum Viable vendor security sheet, Federal logging requirements, and more!

https://securityaffairs.co/wordpress/123948/security/2021-list-of-most-common-hardware-weaknesses.html?

https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf  

https://www.darkreading.com/application-security/tech-companies-create-security-baseline-for-enterprise-software

https://security.googleblog.com/2021/10/launching-collaborative-minimum.html

https://mvsp.dev/mvsp.en/index.html

https://www.standardfusion.com/blog/assessing-vendor-risk-with-questionnaires/

SPONSOR-Blumira's Nato Riley on Log Classification, Security Maturity,

 From Nato’s email:

Hi Bryan,

Discussing the challenges that come with not having good logging in place could be a great topic!  We could make it partly about how security maturity works, in the idea that security generally starts with awareness and visibility.

The topic sort of gets into the idea that knowing is half the battle, so logging can be transformative for helping a company properly secure themselves from online risks!

What do you think of this topic idea?

https://www.blumira.com/careers/

https://thenewstack.io/logging-and-monitoring-why-you-need-both/

https://prometheus.io/

https://www.sentinelone.com/blog/the-10-commandments-of-logging/

https://towardsdatascience.com/why-should-you-care-about-logging-442a195b80a1

https://www.g2.com/products/blumira-automated-detection-response/reviews#survey-response-4908309

(wouldn’t you know it… a couple additional google searches, and I find this -brbr)
https://www.executivegov.com/2021/08/omb-creates-maturity-framework-for-event-log-management/)
https://insidecybersecurity.com/sites/insidecybersecurity.com/files/documents/2021/may/cs2021_0089c.pdf

Logging maturity in the US gov (OMB policy doc): https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf

Are there examples of devices that don’t give out logs? What if your vendor does not allow you to have logs? Can you create logs based on the activity of the device? What would that look like?

Types of logs:

Application logs

Network logs

Endpoint security logs

OS logs

IDS/IPS logs

Vuln scanner logs

2021-038-Liz Saling, 5 pillars of building a good team

Blog post that inspired this episode:

https://lizsaling.com/SWE-team-five-pillars/

Liz Saling  (@lizsaling)

https://www.mindtools.com/pages/article/newLDR_86.htm

http://www.mspguide.org/tool/tuckman-forming-norming-storming-performing

https://michaelhyatt.com/3-roadblocks-to-avoid-for-optimal-team-performance

Erin meyer is the one who did the netflix study!

https://bigthink.com/the-present/high-performing-teams/

https://alicedartnell.com/blog/why-smart-goals-are-stupid/

NEWS:

Unlocking ‘god’ mode on windows 11: https://www.bleepingcomputer.com/news/microsoft/how-to-unlock-windows-11s-god-mode-to-access-advanced-settings/

https://www.reddit.com/r/netsec/comments/q9f63y/creating_a_basic_python_reverse_shell_listener/

NFT malware (NFTs that empty wallets): https://www.theregister.com/2021/10/17/in_brief_security/

2021-037-Tony Robinson, leveraging your home lab for job success - Part2

Tony Robinson (@da_667)

Thought we’d put in a little news to round out the show

https://www.bbc.com/news/world-us-canada-58863678 - nuclear secrets hidden in a peanut butter sandwich

https://www.theregister.com/2018/04/20/rsa_security_conference_insecure_mobile_app/

https://www.vice.com/en/article/jg8w9b/the-twitch-hack-is-worse-for-streamers-than-for-twitch

https://nakedsecurity.sophos.com/2021/10/08/apache-patch-proves-patchy-now-you-need-to-patch-the-patch/

https://www.securityweek.com/fontonlake-linux-malware-used-targeted-attacks

https://securityaffairs.co/wordpress/123182/breaking-news/medtronic-recalled-insulin-pumps-controllers.html

Similar device on ebay: https://www.ebay.com/itm/324762812721

https://www.zdnet.com/article/brewdog-exposed-data-of-200000-shareholders-for-over-a-year/

https://tpetersonkth.github.io/cve/2021/10/02/Analysis-of-CVE-2019-9053.html

https://0xdf.gitlab.io/

www.leanpub.com/avatar2  MSRP = $30 USD

Book changes

What is the end goal?

 Upskill?

Independent consultant?

Promotion?

Bug bounties?

Lab setup - 

Lab setup types

Cloud based - 

Desktop/laptop/NUC - 

Server - 

Good VMs to  

https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ - 90 day WIndows machines

What other home lab equipment have would be helpful?

Testing IoT/embedded devices?

Car hacking?

Malware analysis?
https://bazaar.abuse.ch/

Virus Total Intelligence

Honeypots

@malware_traffic - https://twitter.com/malware_traffic/status/1446627364147023877

Analyzing binaries?

Patch analysis (patch tuesday, print nightmare, etc)?

https://wumb0.in/extracting-and-diffing-ms-patches-in-2020.html

https://www.netresec.com/?page=networkminer

Soldering?

Oscillators for voltage checks?

Wireless?

Old cellphones (mobile apps, don’t need cellular)

Personal assistant devices (used IoT devices?)

Accessing data stored on devices

Specific software licenses? 

Burp?

If I’m trying to break into infosec, how do I use my lab to sell myself to an employer?

Does the employer care? 

How can someone show what they’ve learned in a way that shows the value?

2021-036-Tony Robinson, twtich breach, @da_667 lab setup new book edition! -part1

Tony Robinson (@da_667)

Thought we’d put in a little news to round out the show

https://www.bbc.com/news/world-us-canada-58863678 - nuclear secrets hidden in a peanut butter sandwich

https://www.theregister.com/2018/04/20/rsa_security_conference_insecure_mobile_app/

https://www.vice.com/en/article/jg8w9b/the-twitch-hack-is-worse-for-streamers-than-for-twitch

https://nakedsecurity.sophos.com/2021/10/08/apache-patch-proves-patchy-now-you-need-to-patch-the-patch/

https://www.securityweek.com/fontonlake-linux-malware-used-targeted-attacks

https://securityaffairs.co/wordpress/123182/breaking-news/medtronic-recalled-insulin-pumps-controllers.html

Similar device on ebay: https://www.ebay.com/itm/324762812721

https://www.zdnet.com/article/brewdog-exposed-data-of-200000-shareholders-for-over-a-year/

https://tpetersonkth.github.io/cve/2021/10/02/Analysis-of-CVE-2019-9053.html

https://0xdf.gitlab.io/

www.leanpub.com/avatar2  MSRP = $30 USD

Book changes

What is the end goal?

 Upskill?

Independent consultant?

Promotion?

Bug bounties?

Lab setup - 

Lab setup types

Cloud based - 

Desktop/laptop/NUC - 

Server - 

Good VMs to  

https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ - 90 day WIndows machines

What other home lab equipment have would be helpful?

Testing IoT/embedded devices?

Car hacking?

Malware analysis?
https://bazaar.abuse.ch/

Virus Total Intelligence

Honeypots

@malware_traffic - https://twitter.com/malware_traffic/status/1446627364147023877

Analyzing binaries?

Patch analysis (patch tuesday, print nightmare, etc)?

https://wumb0.in/extracting-and-diffing-ms-patches-in-2020.html

https://www.netresec.com/?page=networkminer

Soldering?

Oscillators for voltage checks?

Wireless?

Old cellphones (mobile apps, don’t need cellular)

Personal assistant devices (used IoT devices?)

Accessing data stored on devices

Specific software licenses? 

Burp?

If I’m trying to break into infosec, how do I use my lab to sell myself to an employer?

Does the employer care? 

How can someone show what they’ve learned in a way that shows the value?

2021-035-GRC selection discussion, TechSecChix, and the 'job description problem'

GRC tools  (Governance Risk and Compliance)

@ki_twyce_

@TechSecChix

INfosec unplugged

Security Happy Hour

Eric’s cyberpoppa show

Cyber Insight show - cohost

Blumira is hiring

https://www.blumira.com/careers/ 

https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html

https://www.pwc.ch/en/insights/fs/10-pitfalls-when-implementing-grc-technology-and-how-to-avoid-them.html

https://www.oxial.com/all/how-to-go-about-choosing-your-grc-solution/

Why do we need a GRC tool?

https://resilience.acoss.org.au/the-six-steps/managing-your-risks/risk-register

What are our business goals? (to make money... :D )

Are we mature enough to be measuring ourselves?

How can we use this to be more efficient?

https://www.standardfusion.com/blog/the-future-of-grc-7-things-to-look-out-for/

• Centralized Controls. ...
• Support for Future Standards. ...
• Automation
• Integrations (my add… helpdesk integrations,  3rd party)
• Scalability. ...
• Customizable Reporting. ...
• Flexibility. ...
• Task Delegation

GRC tool use in other areas

IT - makes more informed budget decisions, determines directions in business goals, asset mgmt

Finance - Make better financial decisions, profitability

Infosec-  vuln mgmt, 

Compliance

HR - determine hiring requirements

Legal - ensures ethical management of the organization, reduces breach, 

How do you implement GRC?

https://www.crowe.com/insights/6-steps-for-a-successful-grc-implementation

1. Step 0: everyone’s input and use cases 
2. Determine the total value gained by using a centralized GRC platform
   1. Missing data 
   2. Duplicate processes
   3. Duplicate data
   4. Manual steps that can be removed or automated
   5. Workflows to assist heavily manual areas such as communications, emails, approvals, and reporting
3. Identify operational gaps to prioritize the areas you need to improve.
4. Get your team on board with an effectively communicated plan.
5. Build a strong foundation to support your GRC program
6. Deploy a standardized GRC implementation across the board.
7. Let the GRC framework evolve and grow after it's implemented.

2021-034-Khalilah Scott, good GRC tool practices - part1

GRC tools  (Governance Risk and Compliance)

@ki_twyce_

@TechSecChix

INfosec unplugged

Security Happy Hour

Eric’s cyberpoppa show

Cyber Insight show - cohost

Blumira is hiring

https://www.blumira.com/careers/ 

https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html

https://www.pwc.ch/en/insights/fs/10-pitfalls-when-implementing-grc-technology-and-how-to-avoid-them.html

https://www.oxial.com/all/how-to-go-about-choosing-your-grc-solution/

Why do we need a GRC tool?

https://resilience.acoss.org.au/the-six-steps/managing-your-risks/risk-register

What are our business goals? (to make money... :D )

Are we mature enough to be measuring ourselves?

How can we use this to be more efficient?

https://www.standardfusion.com/blog/the-future-of-grc-7-things-to-look-out-for/

• Centralized Controls. ...
• Support for Future Standards. ...
• Automation
• Integrations (my add… helpdesk integrations,  3rd party)
• Scalability. ...
• Customizable Reporting. ...
• Flexibility. ...
• Task Delegation

GRC tool use in other areas

IT - makes more informed budget decisions, determines directions in business goals, asset mgmt

Finance - Make better financial decisions, profitability

Infosec-  vuln mgmt, 

Compliance

HR - determine hiring requirements

Legal - ensures ethical management of the organization, reduces breach, 

How do you implement GRC?

https://www.crowe.com/insights/6-steps-for-a-successful-grc-implementation

1. Step 0: everyone’s input and use cases 
2. Determine the total value gained by using a centralized GRC platform
   1. Missing data 
   2. Duplicate processes
   3. Duplicate data
   4. Manual steps that can be removed or automated
   5. Workflows to assist heavily manual areas such as communications, emails, approvals, and reporting
3. Identify operational gaps to prioritize the areas you need to improve.
4. Get your team on board with an effectively communicated plan.
5. Build a strong foundation to support your GRC program
6. Deploy a standardized GRC implementation across the board.
7. Let the GRC framework evolve and grow after it's implemented.

2021-033-Kim_Crawley, 8 steps to better security-Part2

8 Steps to Better Security: A Simple Cyber Resilience Guide to Business is done all final editing and will be published by @WileyTech on October 5th. 

Pre-orders are available now via Amazon, Barnes & Noble, and other retailers.

Sponsored Link: https://amzn.to/3k3pDAN

Amazon teaser:
“Harden your business against internal and external cybersecurity threats with a single accessible resource. 

In 8 Steps to Better Security: A Simple Cyber Resilience Guide for Business, cybersecurity researcher and writer Kim Crawley delivers a grounded and practical roadmap to cyber resilience in any organization. Offering you the lessons she learned while working for major tech companies like Sophos, AT&T, BlackBerry Cylance, Tripwire, and Venafi, Crawley condenses the essence of business cybersecurity into eight steps.  

Written to be accessible to non-technical businesspeople as well as security professionals, and with insights from other security industry leaders, this important book will walk you through how to: 

• Foster a strong security culture that extends from the custodial team to the C-suite 
• Build an effective security team, regardless of the size or nature of your business 
• Comply with regulatory requirements, including general data privacy rules and industry-specific legislation 
• Test your cybersecurity, including third-party penetration testing and internal red team specialists 

Perfect for CISOs, security leaders, non-technical businesspeople, and managers at any level, 8 Steps to Better Security is also a must-have resource for companies of all sizes, and in all industries. 

“

SPONSOR: Blumira's Patrick Garrity

Blumira- 

Per crunchbase:
“Blumira's end-to-end platform offers both automated threat detection and response, enabling organizations of any size to more efficiently defend against cybersecurity threats in near real-time. It eases the burden of alert fatigue, complexity of log management and lack of IT visibility. Blumira's cloud SIEM can be deployed in hours with broad integration coverage across cloud, endpoint protection, firewall and identity providers including Office 365, G Suite, Crowdstrike, Okta, Palo Alto, Cisco FTD and many others.”

Contact [email protected]

Patrick Garrity, VP of Operations.

Patrick has years of experience in the security industry building and scaling usable security products. He currently leads Blumira’s product, sales and marketing teams. Prior to joining Blumira, he led sales engineering, product marketing and international expansion for Duo Security.

Twitter = @Thisisnottap

https://www.ibm.com/cloud/blog/top-5-advantages-of-software-as-a-service

https://www.outsource2india.com/software/articles/software-as-a-service.asp

5 Advantages of SaaS

Reduced time to benefit. Software as a service (SaaS) differs from the traditional model because the software (application) is already installed and configured. ...

Lower costs. ...

Scalability and integration. ...

New releases (upgrades) ...

Easy to use and perform proof-of-concepts.

5 Disadvantages of SaaS

Insufficient Data Security.

SaaS-based application model.

Difficulty with Regulations Compliance. 

Cumbersome Data Mobility. 

Low Performance. 

Troublesome Software Integration.

Limit Attack Surface

https://www.wallix.com/blog/top-10-ways-to-limit-attack-surface

https://www.okta.com/identity-101/what-is-an-attack-surface/

https://securityscorecard.com/blog/what-is-cyber-attack-surface-management

2021-032--Author_Kim_crawley-8-Simple_Rules_for_Cybersecurity

8 Steps to Better Security: A Simple Cyber Resilience Guide to Business is done all final editing and will be published by @WileyTech on October 5th. 

It is available now via Kindle. 

Pre-orders are available now via Amazon, Barnes & Noble, and other retailers.

Sponsored Link: https://amzn.to/3k3pDAN

Amazon teaser:
“Harden your business against internal and external cybersecurity threats with a single accessible resource. 

In 8 Steps to Better Security: A Simple Cyber Resilience Guide for Business, cybersecurity researcher and writer Kim Crawley delivers a grounded and practical roadmap to cyber resilience in any organization. Offering you the lessons she learned while working for major tech companies like Sophos, AT&T, BlackBerry Cylance, Tripwire, and Venafi, Crawley condenses the essence of business cybersecurity into eight steps.  

Written to be accessible to non-technical businesspeople as well as security professionals, and with insights from other security industry leaders, this important book will walk you through how to: 

• Foster a strong security culture that extends from the custodial team to the C-suite 
• Build an effective security team, regardless of the size or nature of your business 
• Comply with regulatory requirements, including general data privacy rules and industry-specific legislation 
• Test your cybersecurity, including third-party penetration testing and internal red team specialists 

Perfect for CISOs, security leaders, non-technical businesspeople, and managers at any level, 8 Steps to Better Security is also a must-have resource for companies of all sizes, and in all industries. 

2021-031- back in the saddle, conference discussion, company privacy

"bel paese, ma più caldo del buco del culo di Satana"

https://www.theverge.com/22648265/apple-employee-privacy-icloud-id

https://mysudo.com/

https://arstechnica.com/information-technology/2021/09/npm-package-with-3-million-weekly-downloads-had-a-severe-vulnerability/

https://www.bleepingcomputer.com/news/security/bluetooth-braktooth-bugs-could-affect-billions-of-devices/

www.infoseccampout.com

www.log-md.com

@infosystir

@bryanbrake

@brakesec

@hackershealth

@boettcherpwned

2021-030-incident response, business goal alignment, showing value in IR -p2

https://blog.teamascend.com/6-phases-of-incident-response

https://www.securitymetrics.com/blog/6-phases-incident-response-plan

Recent vulnerabilities got Bryan thinking about incident response. 

Are organizations speedy enough to keep up?

If the spate of vulns continue, what can we do to ensure we are dealing with the most important issues?

How do we communicate those issues to management?

How should we handle the workload?

Testing of your IR costs money, do you have budget for that? (verodin, red-team)

Restoring backups, extra VPC or azure environment

Incidents occur

You have to minimize issues, right? But is there a good way of doing that?

Simplify your environment? 

Spend time working on the CIS 20? You gotta plan for that and show value vs effort.

Incident response is an ever changing landscape. 

What is the goal of IR?

Minimize damage

Identify affected systems

Recover gracefully and quickly?

Does your environment allow for quick recovery?

What does ‘return to normal’ look like?

The goal of business

Make money

Incidents should just be considered part of doing business (risks)

The more popular, the more likely the attack

Incident timeframe = criteria for getting back to normal.

PICERL is a cycle, and one of continual improvement. Incident response is not ‘one and done’. 

2021-029- incident response, PICERL cycle, showing value in IR, aligning with business goals -p1

https://blog.teamascend.com/6-phases-of-incident-response

https://www.securitymetrics.com/blog/6-phases-incident-response-plan

Recent vulnerabilities got Bryan thinking about incident response. 

Are organizations speedy enough to keep up?

If the spate of vulns continue, what can we do to ensure we are dealing with the most important issues?

How do we communicate those issues to management?

How should we handle the workload?

Testing of your IR costs money, do you have budget for that? (verodin, red-team)

Restoring backups, extra VPC or azure environment

Incidents occur

You have to minimize issues, right? But is there a good way of doing that?

Simplify your environment? 

Spend time working on the CIS 20? You gotta plan for that and show value vs effort.

Incident response is an ever changing landscape. 

What is the goal of IR?

Minimize damage

Identify affected systems

Recover gracefully and quickly?

Does your environment allow for quick recovery?

What does ‘return to normal’ look like?

The goal of business

Make money

Incidents should just be considered part of doing business (risks)

The more popular, the more likely the attack

Incident timeframe = criteria for getting back to normal.

PICERL is a cycle, and one of continual improvement. Incident response is not ‘one and done’. 

2021-028-Rebekah Skeete - social engineering techniques and influences

BlackGirlsHack was created to share knowledge and resources to help black girls and women breakthrough barriers to careers in information security and cyber security. The vision for Black Girls Hack (BGH) is to provide resources, training, mentoring, and access to black girls and women and increase representation and diversity in the cyber security field and in the executive suites. 

Rebekah Skeete CyberBec @rebekahskeete

Tennisha Martin ~@misstennish

https://blackgirlshack.org/

https://www.twitter.com/blackgirlshack - black girls hack 

https://www.twitter.com/thefluffy007 - jasmine jackson

 Background

https://hitz.com.my/trending/trending-on-hitz/people-that-walk-fast-are-reported-to-be-less-happ

Vegas conference - Blacks in Cyber Village

https://forum.defcon.org/node/236946

https://www.blacksincyberconf.com/bic-village

https://www.youtube.com/c/BlacksInCybersecurity

https://www.blacksincyberconf.com/ctf

https://www.marketwatch.com/story/retired-black-nfl-players-and-their-families-call-for-race-norming-practice-to-end-01621018741

https://en.wikipedia.org/wiki/Blind_men_and_an_elephant

https://fuzzcon.forallsecure.com/

https://www.dianainitiative.org/

Social Engineering topics

Misophonia - or phonophobic

https://www.washingtonpost.com/national/health-science/misophonia-is-a-newly-identified-condition-for-people-hypersensitive-to-sound/2014/12/01/7c392782-69ba-11e4-a31c-77759fc1eacc_story.html

https://thecyberwire.com/podcasts/8th-layer-insights

https://terranovasecurity.com/examples-of-social-engineering-attacks/

How all either are directly influenced by.

News, and cool links to read.

https://chubk.com/youtuber-who-specializes-in-unmasking-scammers-ended-up-being-tricked-even-deleting-his-own-youtube-channel/ -LOL

SE write-up of a legitimate company (archive.org) 

https://web.archive.org/web/20190124114926/https://medium.com/@0xf3d/dissecting-arbitraging-co-in-depth-youve-been-scammed-again-21306de00fe5

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-027-Black Girls Hack COO Rebekah Skeete!

BlackGirlsHack was created to share knowledge and resources to help black girls and women breakthrough barriers to careers in information security and cyber security. The vision for Black Girls Hack (BGH) is to provide resources, training, mentoring, and access to black girls and women and increase representation and diversity in the cyber security field and in the executive suites. 

Rebekah Skeete CyberBec @rebekahskeete

Tennisha Martin ~@misstennish

https://blackgirlshack.org/

https://www.twitter.com/blackgirlshack - black girls hack 

https://www.twitter.com/thefluffy007 - jasmine jackson

 Background

https://hitz.com.my/trending/trending-on-hitz/people-that-walk-fast-are-reported-to-be-less-happ

Vegas conference - Blacks in Cyber Village

https://forum.defcon.org/node/236946

https://www.blacksincyberconf.com/bic-village

https://www.youtube.com/c/BlacksInCybersecurity

https://www.blacksincyberconf.com/ctf

https://www.marketwatch.com/story/retired-black-nfl-players-and-their-families-call-for-race-norming-practice-to-end-01621018741

https://en.wikipedia.org/wiki/Blind_men_and_an_elephant

https://fuzzcon.forallsecure.com/

https://www.dianainitiative.org/

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-026-Triaging threat research, Jira vulns, Serious Sam vuln, Systemd vulns, and HiveNightmare

https://www.mindtools.com/pages/article/newHTE_95.htm

https://www.infoq.com/news/2021/07/microsoft-linux-builder-mariner/

https://www.productplan.com/glossary/action-priority-matrix/

More PrintNightmare issues:
https://www.bleepingcomputer.com/news/microsoft/windows-10-july-security-updates-break-printing-on-some-systems/

“"After installing updates released July 13, 2021 on domain controllers (DCs) in your environment, printers, scanners, and multifunction devices that are not compliant with section 3.2.1 of RFC 4556 spec might fail to print when using smart card (PIV) authentication," Microsoft explained.”

https://www.crowdstrike.com/blog/shlayer-malvertising-campaigns-still-using-flash-update-disguise/

 “Shlayer, discovered in 2018, is constantly maintained and also evolving. The graph below is representative of Shlayer continually being a go-to piece of malware that attackers use to compromise the victim’s machine. We observed an uptick in Shlayer detections occurring before the release of CVE-2021-30657 (the Gatekeeper bypass) that was being exploited by Shlayer. This vulnerability was subsequently patched on April 26, 2021.”

https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/

https://access.redhat.com/security/cve/cve-2021-33910

“It works by enabling attackers to misuse the alloca() function in a way that would result in memory corruption. This, in turn, allows a hacker to crash systemd and hence the entire operating system. Practically speaking, this can be done by a local attacker mounting a filesystem on a very long path. This causes too much memory space to be used in the systemd stack, which results in a system crash.” 
There's no way to remedy this problem. While it's not present in all current Linux distros, you'll find it in most distros such as the Debian 10 (Buster) and its relatives like Ubuntu and Mint. Therefore, you must, if you value keeping your computers working, patch your version of systemd as soon as possible. You'll be glad you did.

https://www.bleepingcomputer.com/news/security/atlassian-asks-customers-to-patch-critical-jira-vulnerability/

https://redmondmag.com/articles/2021/07/21/serioussam-windows-flaw.aspx

https://securityaffairs.co/wordpress/120576/security/apple-cve-2021-30807-zero-day.html? 

https://github.com/GossiTheDog/HiveNightmare

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-025-Dan Borges, Author of Adversarial Techniques from Packt Publishing

Dan Borges - Author @1njection

Buy the book on Amazon: https://www.amazon.com/Adversarial-Tradecraft-Cybersecurity-real-time-computer-ebook-dp-B0957LV496/dp/B0957LV496?_encoding=UTF8&me=&qid=&linkCode=ll1&tag=bdspod-20&linkId=8f2daf0b3563cbbc2cee6a2d2138149d&language=en_US&ref_=as_li_ss_tl

https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/amp/

Cool near real time updates on the hack: https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident

https://twitter.com/DAlperovitch/status/1412033278081708034

https://github.com/ahhh/Cybersecurity-Tradecraft/tree/main/

https://www.amazon.com/Network-Attacks-Exploitation-Matthew-Monte/dp/1118987128

https://en.wikipedia.org/wiki/Best_response

https://labs.bishopfox.com/tech-blog/sliver

https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164

Www.Globalcptc.org

Virtual CCDC: 

How easy was the process working with Packt? 

Did they approach you or vice versa?

5 D's of Physical Security

The five D's of security seek to do one or more of the following: Deter, Detect, Delay, Deny and Defend.

https://www.securitymagazine.com/articles/82833-the-5-ds-of-outdoor-perimeter-security

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-024-Dan Borges, Author of Adversarial Techniques from Packt Publishing

Dan Borges - Author @1njection

Buy the book on Amazon: https://www.amazon.com/Adversarial-Tradecraft-Cybersecurity-real-time-computer-ebook-dp-B0957LV496/dp/B0957LV496?_encoding=UTF8&me=&qid=&linkCode=ll1&tag=bdspod-20&linkId=8f2daf0b3563cbbc2cee6a2d2138149d&language=en_US&ref_=as_li_ss_tl

https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/amp/

Cool near real time updates on the hack: https://www.huntress.com/blog/rapid-response-kaseya-vsa-mass-msp-ransomware-incident

https://twitter.com/DAlperovitch/status/1412033278081708034

https://github.com/ahhh/Cybersecurity-Tradecraft/tree/main/

https://www.amazon.com/Network-Attacks-Exploitation-Matthew-Monte/dp/1118987128

https://en.wikipedia.org/wiki/Best_response

https://labs.bishopfox.com/tech-blog/sliver

https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164

Www.Globalcptc.org

Virtual CCDC: 

How easy was the process working with Packt? 

Did they approach you or vice versa?

5 D's of Physical Security

The five D's of security seek to do one or more of the following: Deter, Detect, Delay, Deny and Defend.

https://www.securitymagazine.com/articles/82833-the-5-ds-of-outdoor-perimeter-security

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-023-d3fend framework, DLL injection types, more solarwinds infections

Pihole setup

Conference talk

https://www.reuters.com/technology/microsoft-says-new-breach-discovered-probe-suspected-solarwinds-hackers-2021-06-25/

https://securityaffairs.co/wordpress/119425/apt/solarwinds-nobelium-ongoing-campaign.html

https://www.ehackingnews.com/2021/06/attackers-pummelled-gaming-industry.html

https://www.bleepingcomputer.com/news/microsoft/windows-11-wont-work-without-a-tpm-what-you-need-to-know/

https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows

https://d3fend.mitre.org/

https://www.theregister.com/2021/06/15/zoll_defibrillator_dashboard_vulnerabilities/

https://twitter.com/Hexacorn

https://www.ionos.com/digitalguide/server/configuration/winsxs-cleanup/

https://www.customink.com/fundraising/mental-health-hackers-7816

Buy @infoseccampout tickets: https://www.eventbrite.com/e/infosec-campout-2021-tickets-157561790557

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-022-github policy updates targeting harmful software, Ms. Berlin discusses WWHF, CVSS discussion

Ms. Berlin’s conference report WWFH (reno, NV)

Her next appearances will be at Defcon 2021 and BlueTeam Con 2021!

https://www.infosecurity-magazine.com/news/amazon-prime-day-phishing-deluge/

https://www.ehackingnews.com/2021/06/threat-actors-use-google-drives-and.html

https://www.kennasecurity.com/blog/vulnerability-score-on-its-own-is-useless/

https://portswigger.net/daily-swig/nist-charts-course-towards-more-secure-supply-chains-for-government-software

https://github.blog/2021-04-29-call-for-feedback-policies-exploits-malware/

https://github.com/github/site-policy/pull/397

https://twitter.com/vm_call/status/1405937492642123782?s=20 

https://thenewstack.io/cvss-struggles-to-remain-viable-in-the-era-of-cloud-native-computing/

ZOMG BUY SHIRTS HERE

https://www.customink.com/fundraising/mental-health-hackers-7816

Buy @infoseccampout tickets: https://www.eventbrite.com/e/infosec-campout-2021-tickets-157561790557

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM

#Stitcher Network: https://brakesec.com/BrakeSecStitcher

#TuneIn Radio App: https://brakesec.com/TuneInBrakesec

2021-021-Security Sphynx, ZeroTrust, implementation prep- part2

EO from President Biden asked for a plan to create Zerotrust implementation in the next 90 days (well, 70ish days now… as of 23 May)

https://twitter.com/SecuritySphynx/status/1390475868032618496

@securitySphynx

“CIO: Zero Trust is the way…”

What is the optimal configuration (read: easiest) zero trust config?

Are there different ways to implement Zero Trust?`

https://solutions.pyramidci.com/blog/posts/2021/february/the-swiss-cheese-approach/

https://tulsaworld.com/opinion/columnists/zero-trust-security-assume-that-everyone-and-everything-on-the-internet-is-out-to-get/article_f6bdbfad-1aae-5063-8ac0-6a1faf5a244c.html

https://www.reddit.com/r/devops/comments/bqo6kp/open_source_or_cheap_zero_trust_beyondcorp/

https://opensource.com/article/17/6/4-easy-ways-work-toward-zero-trust-security-model

https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf

What is ZTA?

Who are your users?
What Devices in use?
Device attestation/health checks
Applications exist?
Connections exist?
Not just into/out of the traditional LAN network - do you understand dependencies of applications and databases and how the traffic flows?
Where is the data/traffic? coming from? Going to?
When is this activity occurring and what is expected?
WHY: Need to balance the access to technical resources in a rapidly evolving and dynamic business landscape that ceases to exist within the confines of normal security perimeters.
Mobile workforce - how much work can you get done without ever getting on the VPN?
Blockers
Technical Debt
IT Hygiene
Zero Trust REQUIRES the pre-work of establishing baselines. You cannot detect abnormality in the absence of normality.
Policy should exist to drive what the specifications of a baseline system, server, application, etc will be.
Network traffic, endpoint performance, SIEM tuning, endpoint agent/software accountability
ZTA is less useful if you're not doing basic patching, application updates, and allowing local admin on the system level).
Legacy Systems:
Not designed with this approach in mind, and often costly to modernize.
Asset Management
Where are your assets and how are they used? A “rough estimate” of endpoints is never good enough.
What are you logging? What AREN’T you logging?
User rights auditing
Stale accounts, service accounts, HR Workflows for onboarding/offboarding
Limitations of admin rights
Local admin/password expiration issues for sales/travelling employees
Human resources/talent
Politics: Getting support/$$$/Buy-in for retrofitting applications that are “working just fine” is a huge political/business hurdle.
Where to go from here:
SaaS/PaaS/etc offerings
What can you move from traditional off-prem solutions to cloud-based services (more up to date, regularly reviewed for security vulnerabilities, offloading responsibility of maintenance, SSO capabilities)
AAA requirements
MFA is a MUST. No, it's not perfect, but it is one more layer in efficacy.
Have discussions around REAL RBAC needs BEFORE implementing a solution. It is easier to expand permissions than it is to take them away. Resist the idea that the easy button of broad stroke permissions is always the right choice.
Identify data owners, make them responsible for RBAC development with technical departments.
Quantify risk associated with mishandled resources for crown jewels (see previous section on politics).
Change control around permissions, access
Security as an active participant in the development/acquisition of new products, software, services, or organizations Like remodeling a house, it is much easier to build security into the process than hire someone to retrofit it later..
What auditing are you doing? Have you baselined behavior? Where are your logs going, and WHO IS RESPONSIBLE FOR REVIEWING THEM.
Manage the Endpoint: Stop thinking about the perimeter as your weakest point. The endpoint is critical and increasingly vulnerable, mobile, out of traditional “control”. Real time, actionable data and capabilities are critical to remediation and progress.
Asset Inventory (again)... Then…
HIDS/Firewall
Patch
Applocker/Application Controls
Lather, rinse, repeat.
DLP Classification
It’s hard, it’s time-consuming, and it requires a LOT of support for business unit owners.
Capture metrics, then set KPIs and regular check ins to reduce MTTP/MTTR/MTTD

Would you like to know more?
https://www.beyondtrust.com/blog/entry/why-zero-trust-is-an-unrealistic-security-model

2021-020: Security Sphynx, Preparing for ZeroTrust implementation - Part1

Full show notes are available here: https://docs.google.com/document/d/14dCpXeQ520IcZC3m007zVPhlIPXKgfv0LkqVnbDx0fc/edit?usp=sharing

EO from President Biden asked for a plan to create Zerotrust implementation in the next 90 days (well, 70ish days now… as of 23 May)

https://twitter.com/SecuritySphynx/status/1390475868032618496

@securitySphynx

“CIO: Zero Trust is the way…”

What is the optimal configuration (read: easiest) zero trust config?

Are there different ways to implement Zero Trust?`

https://solutions.pyramidci.com/blog/posts/2021/february/the-swiss-cheese-approach/

https://tulsaworld.com/opinion/columnists/zero-trust-security-assume-that-everyone-and-everything-on-the-internet-is-out-to-get/article_f6bdbfad-1aae-5063-8ac0-6a1faf5a244c.html

https://www.reddit.com/r/devops/comments/bqo6kp/open_source_or_cheap_zero_trust_beyondcorp/

https://opensource.com/article/17/6/4-easy-ways-work-toward-zero-trust-security-model

https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf

1. What is ZTA
2. 1. Who are your users?
      1. Devices in use? 
      2. 1. Device attestation/health checks
      3. Applications exist?
         1. Not just into/out of the traditional LAN network - do you understand dependencies of applications and databases and how the traffic flows?
      4. Connections exist?
   2. What 
   3. Where is the data/traffic? coming from? Going to?
   4. When is this activity occurring and what is expected?
   5. WHY: Need to balance the access to technical resources in a rapidly evolving and dynamic business landscape that ceases to exist within the confines of normal security perimeters.

Mobile workforce - how much work can you get done without ever getting on the VPN? 

• Technical Debt

• AAA requirements

Would you like to know more?

https://www.beyondtrust.com/blog/entry/why-zero-trust-is-an-unrealistic-security-model

Check out our Store on Teepub! https://brakesec.com/store

Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email [email protected]

#AmazonMusic: https://brakesec.com/amazonmusic 

#Spotify: https://brakesec.com/spotifyBDS

#Pandora: https://brakesec.com/pandora 

#RSS: https://brakesec.com/BrakesecRSS

#Youtube Channel:  http://www.youtube.com/c/BDSPodcast

#iTunes Store Link: https://brakesec.com/BDSiTunes

#Google Play Store: https://brakesec.com/BDS-GooglePlay

Our main site:  https://brakesec.com/bdswebsite

#iHeartRadio App:  https://brakesec.com/iHeartBrakesec

#SoundCloud: https://brakesec.com/SoundcloudBrakesec

Comments, Questions, Feedback: [email protected]

Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon

https://brakesec.com/BDSPatreon

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Player.FM : https://brakesec.com/BDS-PlayerFM