Pwned: The Information Security Podcast

Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/All the notes: https://www.nuharborsecurity.com/exim-server-vulnerabilities/Interesting Tid-bits: Known C&C: http://173[.]212.214.137/sFirewall Addresses: https://an7kmd2wp4xo7hpr.tor2web.su https://an7kmd2wp4xo7hpr.tor2web.io https://an7kmd2wp4xo7hpr.onion.sh

Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/IOCs: APT10/Operation Cloud Hopper - Indicators of Compromise v3.csv

Important Links:More Info: https://www.nuharborsecurity.com/4-things-to-know-about-the-ohio-data-protection-act/State of Ohio Data Protection Act Law Text: https://www.legislature.ohio.gov/legislation/legislation-documents?id=GA132-SB-220IAPP Analysis (by Katelyn Burgess): https://iapp.org/news/a/analysis-ohios-data-protection-act/What is the Ohio Data Protection Law (by Jenna Kersten): https://kirkpatrickprice.com/blog/what-is-the-ohio-data-protection-act/Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Important Links:SHA-1 Collision Explanation Page: https://shattered.io/Malicious Hashing: Eve’s Variant of SHA-1 https://link.springer.com/content/pdf/10.1007%2F978-3-319-13051-4_1.pdfFinding SHA-1 Characteristics: General Results and Applications: https://link.springer.com/chapter/10.1007%2F11935230_1Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://www.nuharborsecurity.com/building-a-vulnerability-management-program-with-the-end-in-mind/Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://justinfimlaid.com/quickstart-building-a-security-program-with-the-nist-cybersecurity-framework/hSponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://www.nuharborsecurity.com/red-teaming-vs-penetration-testing/Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/

Sponsor: https://www.nuharborsecurity.comContact Me: https://justinfimlaid.com/contact-me/Twitter: @justinfimlaidLinkedIn: https://www.linkedin.com/in/jfimlaid/My opinion ofsecurity has changed. We are not keeping up. Companies keep getting breached.First things first,the idea and concepts of security have been around for a while.  In the most general terms, truth is we havesenior industry and junior skill set.  Our collectiveindustry is not helping us be better. Security product companies are coming to the market with new halfsolutions and big marketing budgets. Advisory companies are coming to the table with new buzzwords and hollowconcepts.  And "thoughtleaders" and "trusted advisors" are still trying to figure thisout, and probably not giving the best advice yet.  All these things take our collective eye offthe ball, cause us to loose focus, and distract us from doing well at securityfundamentals.For those listeningto this unfamiliar with our space, here's some examples what we're dealingwith:People failing to understand that IT Operations and security are completely different disciplines.  It's like building a house, you need someone to lay out the blueprint, someone to pour the foundation, someone frame house, someone to do the electricity, someone to the plumbing.  These are not the same people.  IT Operations and IT Security professionals are not the same people.  If you want your house built to code like you want good security hygiene you should hire a security professional.Accounting firms pretending internal controls translates to good security operations.  This is a problem.  Internal control is destination, but you need a map and relevant mechanism of transport to get to you destination.  While I'm sure there are some accountants who play in security, articulating the map and which vehicle to use can be a problem and due to CPA independence rules they are sometimes prohibited from providing tactical guidance.Value added resellers (VAR's) being incentivized to push one product over another. I'm pretty sure I'm going to get some hate mail from this, but I don't think anyone would disagree that vendors and resellers push products to maximize their fiscal standing versus seeking best of breed when it might not be the companies best interest.  This creates a ton of confusion in security and really muddies the water, when this happens the only objective measure is price…which is always a bad space to be.Those are someexamples, but it's not all bad.  We needstay focused though. In order for our security industry to get better we needget back to basics of good security hygiene. I admit this is easier said than done, its going to take time to getthere.  Until we do this we can’t startto think about automation because if you do crappy security and automate it,security automation will allow you just do crappy security faster.  You don't need blockchain, if you don'tbelieve it do some research in European Election Security…they use goodold-fashion asymmetric encryption.  Ifyou're getting started, or need a realignment go back the fundamentals, goodpolicy, good security architecture, good security hygiene of accounts,etc.  When you've done this, thenhopefully you have a good handle on requirements for security technology andyou have the expertise on how the technology should work in your environment.