Claim OwnershipRisky Business
Subscribed: 10,428Played: 246,563
Subscribe
© Copyright 2007-2024 Patrick Gray
Description
Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
489 Episodes
Reverse
On this week’s show, Patrick Gray and Adam Boileau discusses the week’s security news, including:
Telegram founder’s arrest in France
Volt Typhoon 0days some SD-WAN gear
Russia frets about Ukraine all up in Kursk’s webcams
Cybercriminals social engineer payment card NFC relay attacks in the wild
The slow burn of Active Directory name collisions
And much, much more.
This week’s episode is sponsored by Nucleus Security. Aaron Unterberger joins to discuss how vulnerability management starts out easy, but gets serious very quickly.
You can also watch this week’s show on Youtube.
Mike Burgess is the director general of ASIO. But the thing about Mike is he’s actually a cybersecurity guy. He joined ASD, Australia’s NSA, back in 1995 when it was still the Defence Signals Directorate. He was there for 18 years before he bounced out to the private sector for a while to work as the CISO for Australia’s largest telco, Telstra. In 2017 he returned to ASD to run it, and in 2019 he was appointed director general of ASIO.
Back in April, Burgess made a series of comments on the topic of encrypted messaging during a Press Club speech in Canberra. Our right to privacy, he said, is not absolute, and he implied that if certain providers didn’t start helping Australian authorities out a little more, he’d use some of the provisions in Australia’s Assistance and Access bill to force them to provide access to certain content.
So I reached out to organise this interview to get some more detail from him about exactly what sort of cooperation he’s seeking and why.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news including:
Microsoft did a good thing! Soon all Azure admins will require MFA
The three billion row National Public Data breach mess, courtesy Florida Man
US govt confirms that it was Iran that hacked the Trump campaign
Is TP-Link the next Huawei, or just not very good at computers?
Major Chinese RFID card maker has hardcoded backdoors
And much, much more.
This week’s episode is sponsored by Specter Ops, makers of Bloodhound Enterprise. VP of Products Justin Kohler joins to talk about how they’ve joined their on-prem AD and cloud Entra attack path graphs, so you can map out that juicy, real-world attack surface.
In this conversation Risky Business host Patrick Gray speaks with SentinelOne’s Chris Krebs and Alex Stamos about what sort of cyber enabled interference we can expect in the 2024 US presidential race.
Alex was the CISO at Facebook during the 2016 election, and Chris Krebs was responsible for US election security as the director of CISA in 2020.
Watch the video version of this episode on Youtube.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news and recap the best research presented at Black Hat and DEF CON in Las Vegas last week. They cover:
Iran tries an election hack’n’leak like its still 2016
Crowdstrike takes home the Pwnie for Epic Fail at DEF CON
UK healthcare SaaS faces six million pound fine for lack of MFA
US circuit courts disagree on geofence warrants
Our roundup of juicy Blackhat/DEF CON research
And much, much more.
This week’s episode is sponsored by Trail of Bits. CEO Dan Guido is fresh back from the DARPA AI Cyber Challenge at DEF CON, where the Trail of Bits team moved through into the finals. Dan talks through the challenge of finding, reporting and fixing bugs with AI systems.
You can also watch this week’s show on Youtube.
In this sponsored Soap Box edition of the show we talk to Proofpoint’s Chief Strategy Officer Ryan Kalember about making security tech more people centric.
We often talk about how we can use signals from users to drive some of our security tech. But what about using our security tech to drive user behaviour?
Ryan thinks there are some opportunities here, particularly around identity security.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
Crowdstrike talks loud in its postmortem, but says very little
Digicert fears the CA-Browser Forum, gets lawsuit from a customer
Dmitri Alperovitch joins the show to talk about the Russian prisoner swap
Cloudflare continues to harbour scum and villainy
Professional ransomware crew … is an improvement?
And much, much more.
This week’s episode is sponsored by Thinkst Canary. Marko Slaviero joins to discuss the unfashionable choice they made in hosting their platform one-VM-per-customer.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
The insurance industry’s reaction to CrowdStrike’s mess
Google’s Workspace email validation flaw and its consequences for OAuth’d applications
Is the VMWare ESX group membership feature a CVE or an FYI?
Secureboot continues to under-deliver
North Korea’s revenue neutral intelligence services
And much, much more
This episode is sponsored by allowlisting software vendor Airlock Digital. Airlock uses a kernel driver on Windows, so Chief Executive David Cottingham joined to discuss what the CrowdStrike kernel driver bug drama means for security vendors.
This episode is also available on Youtube. If you want to ruin the magic of radio and see the faces behind the show, well, now you can!
1In this episode of Wide World of Cyber, Risky Business host Patrick Gray discusses the recent CrowdStrike incident and its implications for security software that operates in kernel space with Chris Krebs and Alex Stamos of SentinelOne, a CrowdStrike Competitor. The conversation also delves into Microsoft’s role in this whole disaster and the potential changes it could make to its operating system to prevent similar incidents in the future.
A video version of this episode is also available on Youtube!
The Risky Biz main show returns from a break to the traditional internet-melting mess that happens whenever Patrick Gray takes a holiday. Pat and Adam Boileau talk through the week’s security news, including:
Oh Crowdstrike, no, oh no, honey, no
AT&T stored call records on Snowflake and you’ll never guess what happened next
Squarespace buys Google Domains and makes a hash of it
Some but not all of the SECs case against Solarwinds gets thrown out
Pity the incident responders digging through a terabyte of Disney Slack dumps
Internet Explorer rises from the grave, and it wants SHELLS RAAAAARGH SSHHEEELLLS
And much, much more.
This week’s show is brought to you by Sublime Security, a flexible and modern email security platform. If you’re sick of using a black box email security solution, Sublime is a terrific option for you.
This Soap Box edition of the show is with Mike Wiacek, the CEO and Founder of Stairwell.
Stairwell is a platform that creates something similar to an NDR, but for file analysis instead of network traffic. The idea is you get a copy of every unique file in your environment to the Stairwell platform, via a file forwarding agent. You get an inventory that lists where these files exist in your environment, at what times, and from there you can start doing analysis.
If you find a dodgy file you can do all the usual malware analysis type stuff, but you can also do things like immediately find out where else that file is in your organisation, or even where else it was. From there you can identify other files that are similar – variants of those files – and search for those. And you can unpack all this very, very quickly.
This is the type of tool that EDR companies use internally to do threat hunting, but it’s just for you and your org – you can drive it. And as you’ll hear, the idea of a transparent, customisable and programmable security stack is something that’s on-trend at the moment. Mike lays out the case that doing this sort of file analysis in your organisation makes a whole lot of sense.
In this podcast Alex Stamos, Chris Krebs and Patrick Gray discuss the relationship between cybercrime and the state, which is often more complicated than it should be.
While the US Government and its allies fight the scourge of ransomware, other governments are using it to either raise revenue or irritate their foes. North Korea sees ransomware as a money spinner, while the Kremlin enjoys poking the west in the eye with it.
Join us for a breakdown of the relationships between governments who should know better and the worst types of people on the planet.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
Widely used polyfill javascript gets hijacked by its new owners
MacOS supply chain disaster bullet dodged
That OpenSSH remote code exec OH MY <3
Entrust gets its CA business kicked to the kerb by Google
South Korean telco intentionally viruses 600k customers
Microsoft continues to deeply underwhelm
And much, much more.
This week’s episode is sponsored by Greynoise. Founder Andrew Morris joins to talk about ways to track attackers across NAT and VPNs, as well as how you can join in the fun of running an internet-scale honeypot network.
This is a sponsored Soap Box edition of the Risky Business podcast.
Abhishek Agrawal is the CEO and co-founder of Material Security, an email security company that locks down cloud email archives. Attackers have been raiding mailspools since hacking has existed, and with those mailspools now in the cloud with services like o365 and Google Workspace, guess where the attackers are going?
Material built a product that helps you lock up your email data, to archive and redact sensitive information. The idea is to really just limit what an attacker can do with email data if they pop an account.
Abhishek joined me to talk about a few things, like how non phishing resistant MFA is basically dead, how email content is very useful to security programs, and about how the gen AI won’t really change much on the defensive control side.
On this week’s show, Patrick Gray and Adam Boileau discuss the week’s security news, including:
Julian Assange finally cuts a deal, pleads guilty, and goes free
USA to ban Kaspersky - even updates
Car dealer SaaS provider CDK contemplates paying a ransom
Intolerable healthcare ransomware attacks continue
We revisit Windows proximity bugs via wifi and bluetooth
And much, much more.
This week’s episode is sponsored by enterprise browser maker Island. Crowdstrike co-founder Dmitri Alperovitch is an investor in Island, and joins on its behalf to discuss why an enterprise browser is really starting to make sense.
On this week’s retreat special, the entire Risky Business team is together in a tropical paradise for the first time. The team takes a break from the infinity pool to discuss the week’s security news:
Microsoft recalls Recall, but why did it have to be such a mess
And a Windows kernel wifi code-exec, really?
Passkeys and identity are hard
Scattered Spider bigwig arrested in Spain
The pentagon runs a deeply flawed info-op
Is it time E2E crypto nerds accept their place in the world?
And much, much more.
This week’s show is brought to you by Corelight… Corelight’s CEO Brian Dye will be along in this week’s sponsor interview to make a really compelling case for something that shouldn’t exist… which is NDR in cloud environments.
On this week’s show Patrick Gray and Adam Boileau are joined by long-time NSA boffin Rob Joyce. Now Rob’s left the government service, he’s hobnobbing with us pundits, talking through the week’s news:
Apple announces a big leap for confidential cloud computing into the mass market
While at the same time, letting you just mosey around your iPhone from your Mac
Mandiant reports in about the Snowflake breach
Moody’s say credit ratings might consider cyber incidents
Microsoft fixes an Azure flaw with a… “comprehensive documentation update”
And much, much more.
This week’s show is sponsored by Yubico, maker of the Yubikey hardware authentication token. Jerrod Chong, Yubico’s COO and President joins to talk about the challenges of the passkey and hardware authenticator ecosystem.
On this week’s show Patrick Gray and Mark Piper discuss the week’s security news, including:
What on earth happened at Snowflake?
A look at operation Endgame
Check Point’s hilarious adventures with dot dot slash
Report says the FTC is looking at Microsoft’s security product bundling
More ransomware hits Russia
Much, much more
404 Media co-founder Joseph Cox is this week’s feature guest. He joins us to talk about his new book, Dark Wire, which is all about the FBI’s Anom sting.
This week’s show is brought to you by Resourcely. If your Terraform is a mess or your CSPM dashboards are lighting up with insane and stupid things, you should check out Resourcely. Its founder and CEO Travis McPeak will be along in this week’s sponsor interview to talk about all things Terraform.
On this week’s show Patrick and Adam discuss the week’s security news, including:
Russian delivery company gets ransomware-wiper’d
A supply-chain attack targets video software used in US courts
Checkpoint firewalls get hacked, details as clear as mud
Microsoft Recall delights hackers
Aussie telco Optus gets told its IR report isn’t legal advice
Cyber insurer says you’re 5x more likely to get rekt if you have a Cisco ASA
And much, much more.
This week’s episode is sponsored by Kroll Cyber. Alex Cowperthwaite, Kroll’s technical director research and development for offence joins to talk about how his team attacks AI models, in ways both classic and new.
This week’s episode was recorded in front of a live audience at AusCERT’s 2024 conference. Pat and Adam talked through:
Google starts using security as a marketing tool against Microsoft, along with steep discounts
Microsoft announces a creepy desktop recording AI
UK govt proposes ransom payment controls
Arizona woman runs a laptop farm for North Korea
Julian Assange just keeps on with his malarky
And much, much more
This week’s episode is sponsored by Tines. Its CEO Eoin Hinchy joins the show to talk about how AI can be genuinely useful in automation.
Top Podcasts
The Best New Comedy Podcast Right Now – June 2024The Best News Podcast Right Now – June 2024The Best New Business Podcast Right Now – June 2024The Best New Sports Podcast Right Now – June 2024The Best New True Crime Podcast Right Now – June 2024The Best New Joe Rogan Experience Podcast Right Now – June 20The Best New Dan Bongino Show Podcast Right Now – June 20The Best New Mark Levin Podcast – June 2024
Download from Google Play
Download from App Store
United States
🔴💚Really Amazing ️You Can Try This💚WATCH💚ᗪOᗯᑎᒪOᗩᗪ👉https://co.fastmovies.org
More Dimitry please, that was fun!