DiscoverRisky Business
Risky Business
Claim Ownership

Risky Business

Author: Patrick Gray

Subscribed: 9,518Played: 149,085
Share

Description

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.
286 Episodes
Reverse
In this edition of Snake Oilers we’ll be hearing from three very different vendors who’ve all been doing interesting stuff. Greynoise: An infosec startup darling, Greynoise can tell you when an attack you’ve detected is internet-wide, automated activity. Very useful for de-prioritising entire alert sets. MergeBase: Software Composition Analisys (SCA) with two key differentiators. MergeBase says it gives users MUCH better remediation advice than competitors, and also offers a “in prod” dynamic SCA product that feeds Java app telemetry back to app/security teams. Very cool, and getting popular. Votiro: Regular listeners would know about CDR company Votiro. They’ve spent the last little while updating their product to better deal with macro-based threats. There’s some site-specific machine learning pixie dust as well as some more generic static detections and re-writes.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: Ubiquiti insider blows whistle on breach Cyber insurer ransomwared Project Zero burned a Western counterterrorism operation Australian parliament, media, politicians all under attack Executive Order would require vendors to notify US government of incidents Much, much more… This week’s sponsor guest is a special one. Metasploit creator and Rumble.run founder HD Moore will join us to talk all about his new venture, the Rumble asset discovery tool. It’s an absolutely fantastic interview, as you’d expect from HD. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: REvil demands US$50m from Acer in ransomware attack Shell added to Accellion victim list Governments banding together to tackle ransomware BEC theft hits $1.8bn in 2021: FBI Exchange tyre fire is, surprisingly, almost under control MORE Remediant’s Paul Lanzi will pop along in this week’s sponsor interview to talk about how they’ve integrated their PAM solution with Carbon Black. It’s an integration that is actually somewhat obvious in hindsight: if a box has been popped then some accounts have, too, so tying these things together does make sense. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
This is a wholly sponsored podcast brought to you by Okta. In this interview we chat with Marc Rogers, the executive director of Cybersecurity at Okta. The question that we’re exploring in this interview is whether or not we’ve managed to move the infosec needle since the Chinese government hacked Google back during the Operation Aurora attacks of 2009. There are some real echoes of Operation Aurora in today’s headlines, like the SVR’s Solarwinds hack and Chinese APT crews using Exchange 0day. Google did learn from Aurora and rearchitected its whole approach to minimise the chances of that sort of things happening again. They moved to their implementation of Zero Trust, Beyondcorp, and so far that looks like a good decision. The rest of the world has been slow to follow, and that leads us to the question: have we actually made things better since Operation Aurora hit the headlines back in 2009?
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: The latest on the Exchange tyre fire Lawmakers in the USA have had enough of Microsoft’s ridiculous licensing tiers White House mulls software security rating system Joseph Cox’s SMS adventures Things didn’t quite work out for APT6920 Arson Cats Much, much more This week’s show is brought to you by VMRay. They asked us to interview one of their customers in this week’s sponsor segment so Brad Marr, the CISO of Life Fitness, pops in to walk through his VMRay use case. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
This podcast was made possible thanks to the support of the Hewlett Foundation’s Cyber Initiative. They’ve provided us with grant funding so we can do feature podcasts that will be of interest to people working in policy roles. The idea is educate people working in policy about issues that they’re in a position to do something about. In this interview we spoke with Kim Grauer, the head of research at Chainalysis. Chainalysis makes software that cryptocurrency exchanges, regulators, law enforcement and intelligence services use to get insight into what’s happening in terms of bitcoin and other cryptocurrencies moving around. You would have heard us talk about their reports in the news segment of Risky Biz a few times because they have a habit of publishing really interesting insights into things like the ransomware economy.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: All the Exchange boxes on the planet have pretty much been owned lol See above Someone’s hacking Russian crime forums The Accellion scandal keeps on truckin’ Dependency confusion attacks are going berserk in the wild Gab got owned. Again. John McAfee is in all sorts of trouble Much, much more This week’s show is brought to you by Nucleus Security. Its director of APAC operations, Gil Azaria, joins us in this week’s sponsor interview to talk about how he became a Nucleus customer before he joined the vendor as its APAC guy. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: Chinese APT crew goes berserk with Exchange 0day Russia hacks Ukraine and USA, India hacks China, China hacks India The NYTimes got something big wrong again (shock horror) CANVAS exploit pack leaks, including their sweet, sweet Spectre exploit Atlantic Council report into offensive capability vendors/contractors Your vCentre gear it probably already on fire: find out why! Much, much more This week’s show is brought to you by Yubico, the makers of the Yubikey. Yubico Chief Solutions Officer Jerrod Chong will be along in this week’s sponsor interview to talk about “passwordless authentication”. Some organisations have a pretty bad understanding of what passwordless is, while other organisations are running into the mountains to avoid even thinking about it. But with hardware supported WebAuthn becoming pretty much ubiquitous, Jerrod thinks a tipping point is coming. Also, they’ve launched passwordless auth for AzureAD. NOTE: This podcast introduces Jerrod Chong as the CTO of Yubico. He’s actually the Chief Solutions Officer. It was our mistake, apologies! Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
This is a sponsored podcast featuring ExtraHop’s co-founder and CTO Jesse Rothstein. ExtraHop is a Network Detection and Response (NDR) vendor that started out offering network health and monitoring tools before being pulled into the security space by its own customers. Jesse joined host Patrick Gray to talk about the SolarWinds compromise from a Network Detection and Response vendor’s perspective, about cloud security and monitoring, some of ExtraHop’s backstory and more. Enjoy!
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: USA floats new sanctions against Russia TikTok, WeChat get stay of execution Dependency confusion is ugh US indicts Lazarus crypto-thieves France ties Sandworm crew to Centreon intrusion MORE This week’s show is brought to you by Thinkst Canary. Thinkst’s founder Haroon Meer is this week’s sponsor guest and he joins us to have a very Haroon-style conversation. We talk about how security controls and detections often fall over when things happen that take place outside of our assumptions: trojaned software updates, attackers hiding in unconventional places like monitors, things like that. That’s a great conversation. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
Recent attacks by SVR against US targets have mostly been written up under the moniker of the “SolarWinds campaign”. In our view, that’s inaccurate. The defining characteristic of this campaign wasn’t the SolarWinds supply chain stuff, it’s was the abuse of Microsoft cloud services. My understanding of how contemporary cloud services work isn’t actually as good as it should be. And that got me thinking – if my understanding isn’t that great, then there’s probably a lot of other people out there who don’t quite grok this stuff, particularly on the policy side. So, I set out to prepare a primer on Microsoft cloud security. Our guest in this podcast is Dirk-Jan Mollema. He works at Fox-IT in the Netherlands and is one of their core researchers on Azure AD and Active Directory Security. What you’re about to listen to, essentially, is me picking his brain so I can wrap my own head around this stuff. The hope is that some of you will learn along with me!
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: The latest on the attempted Florida water poisoning incident How to abuse Google Sync services for great victory Why Signal’s TLS proxies for Iranians are probably a bad idea OG username brokers targeted by social media legal army Much, much more This week’s sponsor interview is with Dan Guido of Trail of Bits. They’ve released an enterprise version of their iVerify tool. It’s a security tool for iOS (an Android version is in beta) that lets organisations monitor things like patch levels and passcode compliance without actually requiring the installation of MDM profiles. It’s an enterprise mobile security tool for orgs that don’t need or want full MDM. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: Emotet is… gone? Accellion FTAs were owned everywhere, not just in ANZ US courts air-gap sensitive filings in wake of Holiday Bear attacks iOS 14 brings iMessage security improvements Much, much more Proofpoint’s Sherrod DeGrippo is this week’s sponsor guest. She joins the show to talk about Emotet’s demise, Trickbot’s survival, BEC, ransomware and more. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
These Soap Box editions of the show are wholly sponsored, which means everyone you hear in one of these editions, paid to be here. This edition of the show is brought to you by Material Security. Basically what they do is lock up your cloud-based email. They use Google and Microsoft’s APIs to redact sensitive information from your mail spool – or even redact entire messages from your spool, like, say, anything over a month old – and then kick you up to an auth challenge when you want to access that mail. It’s a product that recognises that email isn’t just a vector – often it’s an attacker’s target.
On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: DPRK offers free 0day to researchers, with a pretty significant catch SonicWall gets owned because it runs SonicWall gear. Big mistake. Chinese trains didn’t stop running because Flash died :( Dominion to sue Rudy Giuliani for $1.3bn over insecurity claims The sudo bug. Lol. This week’s show is brought to you by Cmd Security, the Linux security company. Its focus has traditionally been on restricting the type of bash commands users can enter. It’s like a control plane for Linux systems. But some of its customers manage their Linux endpoints through different, non-bash entry points. So they’ve added some features to their product to deal with that, which has also resulted in them having an IDR capability. It’s all pretty sensible stuff though, and Cmd co-founder and CEO Jake King will be along to talk us through all of that. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
On this week’s show Dmitri Alperovitch, Sherrod DeGrippo and Joe Slowik join host Patrick Gray to talk through the week’s news: MalwareBytes the latest victim in the increasingly poorly-named “SolarWinds campaign” FireEye issues helpful guidance, tools, to help orgs detect “golden SAML” and related techniques Rob Joyce, Anne Neuberger, Michael Sulmeyer all get promoted! Wooo! Much, much more This week’s show is brought to you by Airlock Digital. They make what we’re calling an execution control platform. Its central feature is easy-to-use and hard-to-bypass allowlisting. It’s a bunch of sensible and useable controls packaged up into a 7Mb. It slices, it dices, it slays lolbins and user powershell rights, and it comes in a beautiful suede pouch! It’s the endpoint protection you get when it’s built by practitioners in concert with people who actually understand windows internals. That’s right! Patrick is drinking the Kool-Aid on this one! Airlock founders Dave Cottingham and Daniel Schell join in this week’s sponsor interview to talk through allow-listings second wave of popularity. Links to everything are below!
Joe Slowik and Katie Nickels are guest co-hosts in this week’s edition of the show. They join Patrick Gray to talk about: Mimecast having some stolen certificate, errr, “problems” The confusing reports about JetBrains Analysis of the malware used in the SolarWinds campaign Australian man arrested in Germany and charged with running DarkMarket The Great Deplatforming of 2021 This week’s show is brought to you by Gigamon. If you’re a Gigamon shop you should really take a look at their ThreatInsight platform, that’s a no brainer. Even if you’re not, they’re real players in the network detection and response space. Joining us in this week’s sponsor interview is Jason Tesarz, a senior product manager for Gigamon ThreatInsight. He joined the show to talk about a few things, like how these days the NDR vendors are competing more around their workflows than trying to be the most comprehensive in detection. Links to everything that we discussed are below and you can follow Patrick, Katie or Joe on Twitter if that’s your thing.
These Soap Box editions of the show are wholly sponsored. If that’s not your thing and you’re looking for the weekly news edition of the show, just scroll one show back in your feed. This soap box edition is brought to you by AttackIQ. They make a Breach and Attack Simulation platform that’s designed to test the effectiveness of your security controls by simulating bad things in your environment. Carl Wright and Jonathan Reiber are joining us in this edition of the show. These days he’s AttackIQ’s senior director of cybersecurity and strategy but he previously served as a former Chief Strategy Officer for Cyber Policy in the Office of the Secretary of Defense. They joined the show to talk through their work in mapping NIST 800-53 to the MITRE ATT&CK framework. Enjoy!
On this week’s show, Patrick Gray talks to Joe Slowik and Dmitri Alperovitch about the APT campaign that impacted the US government and FireEye via SolarWinds’ supply chain. Alex Stamos also joins the show to chime in more generally on supply chain interference before discussing some other news, like: Apple losing (most of) its case against Corellium Assange won’t be extradited… yet Adobe has finally killed Flash, and killed it good This week’s show is brought to you by Signal Sciences. In this week’s sponsor interview we’ll be talking to a Signal Sciences customer, Doug DePerry. He heads product security at the Gemini cryptocurrency exchange. We’ll be talking to him about what that’s like because those sort of outfits tend to attract decent attackers. Links to everything that we discussed are below and you can follow Patrick on Twitter if that’s your thing.
On this week’s show Patrick and Adam Boileau discuss the week’s security news, including: FireEye’s Very Bad Week Russian bears all up in your VMwares Chris Krebs sues Trump campaign Foxconn ransomware So much more Proofpoint’s Ryan Kalember is this week’s sponsor guest. He joins the show to talk about their rather different approach to DLP and insider threat detection. You may have noticed we don’t really talk about DLP a whole bunch on this show because it’s, well, really boring. But Proofpoint actually has an interesting approach to the problem that’s different enough to be interesting, so do stick around for that. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.
loading
Comments 
Download from Google Play
Download from App Store