Claim OwnershipRisky Business
Subscribed: 10,526Played: 254,774
Subscribe
© Copyright 2007-2024 Patrick Gray
Description
Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
509 Episodes
Reverse
In this sponsored Soap Box edition of the show Patrick Gray talks to Island CEO Michael Fey about some of the cool tricks in the Island enterprise browser. You can use it to tick off so many compliance boxes, and not just cybersecurity boxes.
This is largely a conversation about compliance, but it’s actually interesting and fun. These are words we never thought we’d type!
You can find Island at https://island.io/
This episode is also available on Youtube.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
The SEC’s cyber incident reporting isn’t very exciting after all
China Telecom on the way to being thrown out of the US
The NSA/Cybercom might get two separate hats
The Cl0p ransomware crew are back and taking responsibility for the Cleo hacks
(Yet another) File upload bug in Struts makes Java admins weep
And much, much more.
This episode is sponsored by SpecterOps, who run a pretty top notch offsec/pentest team when they’re not busy making the Bloodhound Enterprise identity attack path enumeration software. SpecterOps’ Robby Winchester joins to talk about how pentest has changed, and how their customers get value from their testing.
This episode is also available Youtube.
In this edition of the Wild World of Cyber podcast Patrick Gray sits down with SentinelOne’s Chief Intelligence and Public Policy Officer Chris Krebs to talk all about Chinese cyber operations.
They look at the Salt Typhoon and Volt Typhoon campaigns, the last 20 years of Chinese operations, and the evolution of the cyber roles of China’s Ministry of State Security and People’s Liberation Army.
It’s a very dense hour of conversation!
This podcast was recorded in front of an audience at the Museum of Contemporary Art in Sydney.
This episode is also available on Youtube.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
Cleo file transfer products have a remote code exec, here we go again!
Snowflake phases out password-based auth
Chinese Sophos-exploit-dev company gets sanctioned
Romania’s election gets rolled back after Tiktok changed the outcome
AMD’s encrypted VM tech bamboozled by RAM with one extra address bit
Some cool OpenWRT research
And much, much more.
This week’s episode is sponsored by Thinkst, who love sneaky canary token traps. Jacob Torrey previews an upcoming Blackhat talk filled with interesting operating system tricks you can use to trigger canaries in your environment. You wont believe the third trick! Attackers hate him!
This episode is also available on Youtube.
In this interview Patrick Gray talks to Yubico’s COO and President Jerrod Chong about a new Yubikey feature: pre-registration.
You can now ship pre-registered Yubikeys to your staff so you don’t need to rely on your staff to enrol them. They’ve achieved this with really slick Okta and Entra ID integrations.
Jerrod also talks about a recent trip to Singapore and concerns he has about the cybersecurity of critical infrastructure in the energy sector.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
The FTC decides its time to take another look at Microsoft
Exxon’s opponents targeted by hackers
Russian hackers keep getting sentenced and it confuses us
The Feds recommend Signal, because throwing hackers out of telcos ain’t gonna happen
A South Korean set-top-box manufacturer shipped a DDoS client for corpo-combat
And much, much more.
This week’s sponsor interview with Vijit Nair from Corelight. We talk to him about doing detection in cloud environments, and how the varied nature of cloud systems makes the old ways - network monitoring - useful in new and interesting ways.
If you’re in Sydney, Pat is recording a live episode of the Wide World of Cyber with Chris Krebs on 5 December. There might still be tickets left!
This episode is also available on Youtube.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
A ransomware attack has crippled US supply chain software provider Blue Yonder
Russian spies hack nearby wifi to get to their targets, but that doesn’t seem surprising?
Salt Typhoon’s attacks on telcos are hard to solve and big on impact
China’s surveillance state workers sell their access at home
Palo Alto is bad and should feel bad
And much, much more.
In this week’s sponsor interview Patrick Gray chats with Matt Muller from Tines about Gartner’s “spicy take” that the SOAR category is dead. SOAR is dead! Long live SOAR!
This episode is also available on Youtube.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
Microsoft introduces some sensible sounding post-Crowdstrike changes
Palo Alto patches hella-stupid bugs in its firewall management webapp
CISA head Jen Easterly to depart as Trump arrives
AI grandma tarpits phone scammers in family-tech-support hell
Academic research supports your gut-reaction; phishing training doesn’t work
And much, much more.
This week’s episode is sponsored by Greynoise. The always excitable Andrew Morris joins to remind us that the edge-device vulnerabilities Pat and Adam complain about on the show are in fact actually even worse than we make them out to be. Andrew also tells us about a zero-day Greynoise’ AI system truffle-pigged out of their data set.
This episode is also available on Youtube.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
Apple frustrates law enforcement with iOS auto-reboot
CISA says most KEV vulnerabilities in 2023 were first used as zero days
Russians roll incident response on some sweet Linux spookware
Regular users can create mailboxes in M365?
Tor tracks down the source of its joe-job abuse complaints
And much, much more.
This week’s feature guest is former FBI agent Chris Tarbell, who arrested Silk Road operator Ross Ulbricht way back in 2013. As suggestions swirl that an incoming Trump administration might release Ulbricht, Chris talks about the reality of the Dread Pirate Roberts.
This episode is sponsored by software supply chain security firm Socket.dev. Founder Feross Aboukhadijeh thinks that we need a CVE-like catalogue for supply-chain attacks, and he makes a solid argument.
The show is also available on Youtube.
1In this edition of the Risky Business Soap Box we’re talking all about email security with Sublime Security co-founder Josh Kamdjou.
Email security is one of the oldest product categories in security, but as you’ll hear, Josh thinks the incumbents are just doing it wrong. He joins Risky Business host Patrick Gray for this interview about Sublime’s origin story and its new approach to email security.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
Sophos drops implants on Chinese firewall exploit devs
Microsoft workshops better just-in-time Windows admin privileges
Snowflake hacker arrested in Canada
Okta has a fun, but not very impactful auth-bypass bug
Russians bring dumb-but-smart RDP client attacks
And much, much more.
Special guest Sophos CISO Ross McKerchar joined us to talk about its “hacking back” campaign. The full interview is
available on Youtube for those who want to really live vicariously through Sophos doing what every vendor probably wants to do.
This week’s episode is sponsored by attack surface mapping vendor runZero. Founder and CEO HD Moore joins to talk about marrying up the outside and inside views of your network.
You can also watch this episode on Youtube
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
CSRB to investigate China’s telco-wiretapping hacks
Euro law enforcement takes down the Redline infostealer
Someone steals Fed crypto… and then tries to quietly sneak it back in
Russia sentences REvil guys to … jail? Really?
Apple private cloud compute gets a proper bug bounty program
And much, much more.
This week’s episode is sponsored by Material Security, who help navigate the mess of cloud productivity data security. Daniel Ayala - Chief Security and Trust Officer at Dotmatics - is a Material customer, and joins Pat and Material Security’s Rajan Kapoor to talk about how to wrangle securing data that ends up in corporate cloud email and file stores.
This episode is also available on Youtube.
In this Soap Box edition of the podcast Patrick Gray chats with Thinkst Canary founder Haroon Meer about his “decade of deception”, including:
A history of Thinkst Canary including a recap of what they actually do
A look at why they’re still really the only major player in the deception game
A look at what companies like Microsoft are doing with deception
Why security startups should have conference booths
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:
SEC fines tech firms for downplaying the Solarwinds hacks
Anonymous Sudan still looks and quacks like a Russian duck
Apple proposes max 10 day TLS certificate life
Oopsie! Microsoft loses a bunch of cloud logs
Veeam and Fortinet are bad and should feel bad
North Koreans are good (at hacking)
And much, much more.
This week’s episode is sponsored by Proofpoint. Chief Strategy Officer Ryan Kalember joins to talk about their work keeping up with prolific threat actor SocGholish.
This episode is also available on Youtube.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s infosec news, including:
Chinese spooks all up in western telco lawful intercept
Jerks ruin the Internet Archive’s day
Microsoft drops a great report with a bad chart
The feds make their own crypto currency and get it pumped
Forti-, Palo- and Ivanti-fail
And much, much more.
This week’s episode is sponsored by detection-as-code vendor Panther. Casey Hill, Panther’s Director Product Management joins to discuss why the old “just bung it all in a data lake and… ???… “ approach hasn’t worked out, and what smart teams do to handle their logs.
This episode is also available on [Youtube].(https://youtu.be/86zy6DcwtbE)
In this edition of Snake Oilers we hear pitches from three security vendors:
Sandfly Security: An agentless Linux security platform that actually sounds very cool
Permiso: An identity security platform founded by ex FireEye folks
Wiz: The cloud security giant is getting in on code security scanning
You can watch this edition of Snake Oilers on YouTube here.
Patrick Gray and Adam Boileau discuss the week’s infosec news with everyone’s favourite ex-NSA big-brain, Rob Joyce. They talk through:
Musk and Durov bow to government pressure
Tiktok rushes to ban authoritarian propagandists
The US doesn’t want Chinese software in its cars
Kaspersky replaces itself with an AV no one has ever heard of
Aussie police chalk up another crimephone takedown
Press Win-R Ctrl-V to prove you’re human
And much, much more.
This week’s show is brought to you by Stairwell, and Stairwell’s founder Mike Wiacek will be along to talk about how people are using their platform to hunt down detection resistant malware.
A video version of this episode is also available on Youtube.
On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:
Hezbollah’s attempts to avoid SIGINT with pagers ends in explosions
The US shines many bright lights on RT’s disinfo role
Australia counters Chinese bullying in the Pacific
Valid accounts are the most prevalent entry point, says CISA’s data
Ivanti and Fortinet vie for worst vendor of the week
Krebs writes up the shift towards charging The Com with terrorism
And much, much more…
This week’s episode is sponsored by Push Security, who bring security visibility to where it needs to be these days – the browser. Luke Jennings joins this week’s show to discuss how phish-kit crews are driving the arms race forward, and how detection has to adapt and go where the users are.
This episode is also available on Youtube.
On this week’s show, Patrick Gray and Adam Boileau discuss the weeks security news, including:
Russia’s disinformation peddlers face multifaceted sternness from the DoJ
Telegram is now law enforcement’s bestest new pal, all of a sudden
Iran’s banking industry arranges a payment plan for a ransom
Columbia investigates how it sent private jets full of cash to pay for Pegasus
Microsoft innovates with Un-Patch Tuesday
And much, much more.
This week’s sponsor is Kroll Cyber, and one of their incident responders Paul Wells joins to discuss that one weird trick that actually helps - preparing for an incident before hand, rather than learning all those hard lessons in the middle of a crisis.
This week’s episode is also available on Youtube.
In this edition of Snake Oilers Patrick Gray gets pitches from three cybersecurity companies:
Authentik, an open source identity provider that a lot of large organisations are deploying on prem as an alternative to cloud-based IDPs
Dropzone AI, an LLM-based agent that can do the work of a Tier 1 SOC analyst
SlashID, an identity security company that can crunch your logs to find attackers
You can watch this edition of Snake Oilers on YouTube here.
Top Podcasts
The Best New Comedy Podcast Right Now – June 2024The Best News Podcast Right Now – June 2024The Best New Business Podcast Right Now – June 2024The Best New Sports Podcast Right Now – June 2024The Best New True Crime Podcast Right Now – June 2024The Best New Joe Rogan Experience Podcast Right Now – June 20The Best New Dan Bongino Show Podcast Right Now – June 20The Best New Mark Levin Podcast – June 2024
Download from Google Play
Download from App Store
United States
🔴💚Really Amazing ️You Can Try This💚WATCH💚ᗪOᗯᑎᒪOᗩᗪ👉https://co.fastmovies.org
More Dimitry please, that was fun!