The BlueHat Podcast

Ryen Macababbad, Principal Security Program Manager at Microsoft joins Nic Fillingham on this week's episode of The BlueHat Podcast. Ryen discusses their career journey, including the return to Microsoft after working in security architecture and customer trust engineering. Ryen shares insights from their time at Hacker Summer Camp 2024 in Las Vegas, emphasizing the importance of creating frictionless security measures that don't hinder productivity. They explain that when security becomes a barrier, users will find workarounds, potentially compromising security. The conversation touches on the evolving relationship between security and productivity teams, highlighting the need for security to be an enabler rather than an obstacle.      In This Episode You Will Learn:       How investing in security helps maintain customer trust and protects revenue  Why security should be built-in by default so users don't need to be security experts  The importance of incorporating feedback and diverse viewpoints to enhance security      Some Questions We Ask:        How is a seamless security and productivity experience provided for end users?  Can security researchers contribute to identifying gaps and improving product security?  What motivated the shift from a focus on identity and program management to defensive security?    Resources:   View Ryen Macababbad on LinkedIn      View Wendy Zenone on LinkedIn   View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Michael Howard, Senior Director at Microsoft joins Nic Fillingham on this week's episode of The BlueHat Podcast. Michael shares his journey at Microsoft, starting from his early days in New Zealand as part of a small team of ten. He discusses his extensive career, his contributions to cybersecurity, and his role in the development of essential security books like "Writing Secure Code" and "The Security Development Lifecycle." Michael reflects on the importance of fundamental security principles and how they remain relevant today. He also touches on his recent move within Microsoft to John Lambert's team, where he continues to focus on security culture and education. The conversation delves into the origins of the Blue Hat conference, Michael's experiences at the first event, and the ongoing significance of secure coding practices and mitigations.      In This Episode You Will Learn:     Critical aspects of secure software development and pivotal moments in Microsoft's security  The importance of using specific coding constructs and libraries to improve security  Findings on vulnerabilities that spurred significant security improvements in SQL Server    Some Questions We Ask:       How do you deploy security patches effectively while minimizing disruptions?  What coding constructs and compiler flags did you recommend for better security?  How did external researchers at Blue Hat conferences impact Microsoft's culture?    Resources:   View Michael Howard on LinkedIn     View Wendy Zenone on LinkedIn   View Nic Fillingham on LinkedIn    The Microsoft Azure Security Podcast   Michael Howard (@michael_howard) on X (twitter.com)  Latest book: Designing and Developing Secure Azure Solutions (Developer Best Practices): Howard, Michael, Simone, Curzi, Heinrich, Gantenbein: 9780137908752: Amazon.com: Books    Related Microsoft Podcasts:    Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks     Discover and follow other Microsoft podcasts at microsoft.com/podcasts   The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

Yonatan Zunger, CVP of AI Safety & Security at Microsoft joins Nic Fillingham and Wendy Zenone on this week's episode of The BlueHat Podcast. Yonatan explains the distinction between generative and predictive AI, noting that while predictive AI excels in classification and recommendation, generative AI focuses on summarizing and role-playing. He highlights how generative AI's ability to process natural language and role-play has vast potential, though its applications are still emerging. He contrasts this with predictive AI's strength in handling large datasets for specific tasks. Yonatan emphasizes the importance of ethical considerations in AI development, stressing the need for continuous safety engineering and diverse perspectives to anticipate and mitigate potential failures. He provides examples of AI's positive and negative uses, illustrating the importance of designing systems that account for various scenarios and potential misuses.      In This Episode You Will Learn:       How predictive AI anticipates outcomes based on historical data  The difficulties and strategies involved in making AI systems safe and secure from misuse  How role-playing exercises help developers understand the behavior of AI systems    Some Questions We Ask:        What distinguishes predictive AI from generative AI?  Can generative AI be used to improve decision-making processes?  What is the role of unit testing and test cases in policy and AI system development?    Resources:   View Yonatan Zunger on LinkedIn      View Wendy Zenone on LinkedIn   View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Craig Nelson, leader of Microsoft's Red Team joins Nic Fillingham and Wendy Zenone on this week's episode of The BlueHat Podcast. Craig explains how the Red Team simulates attacks on Microsoft's infrastructure to identify vulnerabilities and protect customer data stored in the cloud. He emphasizes the importance of these simulated attacks in preparing for real threats and describes the collaborative efforts with other security teams at Microsoft, such as the Azure penetration testing team and the Microsoft Security Response Center. Craig shares his personal journey into cybersecurity, highlighting his early fascination with cryptography and computer security. He also discusses the unique challenges and strategies of Red Teaming at Microsoft, including the need to influence engineering teams and the importance of systemic thinking to create durable security solutions.    In This Episode You Will Learn:     The need for early detection of vulnerabilities during the development lifecycle  Why a mix of technical and persuasive skill build successful red teams  Significance of internal security education and training initiatives    Some Questions We Ask:      What projects are you pursuing in AI and security?  How do you have conversations with engineers to influence their security decisions?  What skills are important for someone aspiring to join the Red Team?     Resources:   View Craig Nelson on LinkedIn    View Wendy Zenone on LinkedIn   View Nic Fillingham on LinkedIn  Related Microsoft Podcasts:    Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Dmitrijs Trizna, Security Researcher at Microsoft joins Nic Fillingham on this week's episode of The BlueHat Podcast. Dmitrijs explains his role at Microsoft, focusing on AI-based cyber threat detection for Kubernetes and Linux platforms. Dmitrijs explores the complex landscape of securing AI systems, focusing on the emerging challenges of Trustworthy AI. He delves into how threat actors exploit vulnerabilities through techniques like backdoor poisoning, using gradual benign inputs to deceive AI models. Dmitrijs highlights the multidisciplinary approach required for effective AI security, combining AI expertise with rigorous security practices. He also discusses the resilience of gradient-boosted decision trees against such attacks and shares insights from his recent presentation at Blue Hat India, where he noted a strong interest in AI security.       In This Episode You Will Learn:       The concept of Trustworthy AI and its importance in today's technology landscape  How threat actors exploit AI vulnerabilities using backdoor poisoning techniques  The role of frequency and unusual inputs in compromising AI model integrity      Some Questions We Ask:        Could you elaborate on the resilience of gradient-boosted decision trees in AI security?  What interdisciplinary approaches are necessary for effective AI security?  How do we determine acceptable thresholds for AI model degradation in security contexts?       Resources:   View Dmitrijs Trizna on LinkedIn   View Wendy Zenone on LinkedIn   View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   The BlueHat Podcast is produced by Microsoft and distributed as part of N2K media network.

Shawn Hernan, Partner Security Engineering Group Manager at Microsoft joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Shawn leads Microsoft Cloud & AI Security Assurance, overseeing an international team of security professionals dedicated to proactively addressing security challenges through vulnerability research, penetration testing, and threat modeling. Drawing from his extensive experience in early cybersecurity, Shawn shares valuable insights into the evolving landscape, stressing the significance of academic knowledge and practical experience. From navigating intricate technical terrains to fostering a growth mindset, this episode provides a compelling glimpse into the ongoing pursuit of security excellence in today's digital era.      In This Episode You Will Learn:       Addressing root causes of vulnerabilities reported by third parties or found internally  Developing tools and a deep understanding of specific classes of vulnerabilities  Research on areas like crypto hygiene and missing integrity vulnerabilities    Some Questions We Ask:        How does your team handle variant hunting for critical cases?  When researchers find issues in Azure, how does your team get involved?  How do you foster a security culture within Microsoft and your team?    Resources:   View Shawn Hernan on LinkedIn      View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn  Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks     Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Tom Gallagher, VP of Engineering and head of MSRC, joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. After nearly 25 years at Microsoft, Tom reflects on his early days at the company, where he started as a penetration tester on SharePoint, offering insights into the evolving landscape of cybersecurity since 1999. Tom shares a few different experiences from his journey, including auditing a local ISP's security in exchange for a job, and his transition from an intern working on Internet Explorer's rendering engine to key roles in Office and eventually MSRC. Through Tom's experiences, you’ll gain a unique perspective on Microsoft's cybersecurity evolution and the broader industry landscape.       In This Episode You Will Learn:       A Clippy vulnerability that exemplifies the importance of external insights  How you can support teams when they find vulnerabilities in their code  Tom's experiences attending early Black Hat and DEFCON conferences      Some Questions We Ask:        How does your experience as a bug hunter influence your role at MSRC?  Can you elaborate on the process of mitigating vulnerabilities quickly within SFI?  Will you explain Trustworthy Computing and its significance in Microsoft's history?     Resources:   View Tom Gallagher on LinkedIn       View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Aaron Tng, a Microsoft Student Ambassador and BlueHat Conference Speaker, joins Nic Fillingham on this week's episode of The BlueHat Podcast. Aaron shares how his curiosity during the pandemic in 2020, sparked by the surge in cyber-attacks, propelled him into the world of cybersecurity. Through dedicated self-learning and leveraging resources like the Microsoft Learn website, Aaron achieved multiple certifications, laying the foundation for his expertise in cybersecurity.  Aaron is also passionate about the impact of Cybersecurity on society and actively promoting K-12 Cybersecurity Awareness and Education. He unveils his comprehensive four-point plan, which encompasses fundamental courses, advanced studies, educator training, and real-life internship opportunities. Aaron emphasizes the importance of moving beyond surface-level internet safety education, advocating for a deeper understanding of secure coding and threat modeling.       In This Episode You Will Learn:       The different resources utilized for Aaron’s cybersecurity education  Aspirations for the future of cybersecurity education  How Aaron founded a student-led nonprofit called Cyber Secure it      Some Questions We Ask:        What challenges did you face presenting to the Washington State Board of Education?  How did you earn multiple cybersecurity certifications while still in high school?  Why do you believe it's crucial to move beyond surface-level internet safety?      Resources:   View Aaron Tng on LinkedIn     View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Dor Dali, Head of Security Research at Cyolo, joins Nic Fillingham on this week's episode of The BlueHat Podcast. They delve into Dor's journey into cybersecurity, from pranking friends as a teenager to his professional roles, including his involvement in the Blue Hat conference through GE, where he helped create the Capture The Flag (CTF) challenge. Dor details the vulnerabilities in the RDP protocol by closely following the protocol specifications and identifying discrepancies that led to security flaws. They detail a vulnerability related to RDP Gateway's UDP cookie authentication process, the implications of Dor's research for other security researchers and hackers and the importance of leveraging available resources, such as protocol specifications and open-source implementations, to understand closed-source systems better and potentially uncover vulnerabilities.      In This Episode You Will Learn:       The unique perspective Dor has with RDP security research  How to approach security research when following the protocol specifications  The importance of clear documentation in preventing security vulnerabilities      Some Questions We Ask:        How did you design and build the Capture the Flag event?  Did you face any unexpected hurdles while researching the RDP protocol's security?  Have you found other security vulnerabilities by closely adhering to protocol specifications?      Resources:   View Dor Dali on LinkedIn    View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Cyber Security Content Creator, Speaker & Ethical Hacker, Katie Paxton-Fear, joins Nic Fillingham on this week's episode of The BlueHat Podcast. Katie holds a PhD in defense and security AI plus cybersecurity and works as an academic, teaching undergraduate students cybersecurity topics. She also runs a popular YouTube channel focused on bug bounty hunting, hacking, and pen testing. Katie shares her journey into cybersecurity, reflects on her initial interest in undeciphered languages and how it parallels her approach to cybersecurity, both involving a fascination with solving mysteries and uncovering hidden meanings.     In This Episode You Will Learn:       Approaching AI systems with caution when translating less-documented languages  Concerns surrounding the use of copyrighted training data in AI systems  Recognizing and addressing AI system limitations and biases in real-world deployments.    Some Questions We Ask:        Can fine-tuning AI models prevent degradation and improve performance?  What are the ethical implications of putting sensitive information into AI systems  How does relying on niche or obscure training data impact AI models?    Resources:   View Katie Paxton-Fear on LinkedIn   View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Luke Jennings, VP of Research & Development at Push Security joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Luke explains his recent presentation on a new SaaS cyber kill chain, exploring how attackers might target modern organizations heavily reliant on cloud and SaaS services, even when traditional infrastructure is minimal. The latest kill chain involves developing attack techniques specific to this environment, covering topics like lateral movement without conventional network infrastructure and adapting known techniques such as password guessing attacks to the SaaS landscape. Luke, Wendy, and Nic discuss the complexities of SaaS security, the intricacies of evil twin integrations, detection challenges, mitigation strategies, and the overall impact of these security issues on organizations.       In This Episode You Will Learn:       Identifying malicious activities and understanding normal application behavior  The importance of having structured methodologies for approving SaaS app usage  Challenges organizations face in detecting and preventing SaaS application threats      Some Questions We Ask:        How can an organization create alerts for new, unknown SaaS app integrations?  What happens when a SaaS app integration is duplicated by an attacker?  Would having a structured methodology for SaaS app usage help minimize risk?    Resources:   View Luke Jennings on LinkedIn   View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn      Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks         Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Lea Snyder, Principal Security Engineer at Microsoft joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Lea is a security leader focused on security strategy and helping organizations mature their security posture and security programs, focusing on areas including IAM, product security, and risk management. Lea explains her unique role as a security architect, highlighting problem-solving across various domains within Microsoft. She shares her unconventional path to cybersecurity, starting with a background in economics and an MBA, and how she transitioned from IT roles to security. Lea, Wendy, and Nic discuss the importance of diverse backgrounds in the industry and offer advice on entering the cybersecurity field. Lea also discusses her involvement in community-driven conferences, particularly B-sides, highlighting their diverse and unique content.       In This Episode You Will Learn:       Tips for submitting conference proposals  Challenges when balancing anonymity during a submission  The importance of a supportive approach in the conference submission process    Some Questions We Ask:        Is there a typical anonymization process to ensure fairness and inclusivity?  What are some challenges when selecting talks that resonate with an audience?  Can you elaborate on the value behind B-sides conferences and the unique atmosphere?     Resources:   View Lea Snyder on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn      Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks         Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Dustin Heywood, Hacker, Researcher, and Senior Leader at IBM, joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Dustin provided a live demonstration of cracking NTLM version 1 during his BlueHat presentation, showcasing the process of responding to challenges, using coercion techniques, and ultimately extracting and cracking the NTLM hash. Dustin, Nic, and Wendy discuss checking group policies, auditing every object, ensuring relevant systems, and managing IT assets effectively. They emphasize the importance of IT asset management and recommend quarantining legacy systems with restricted access.       In This Episode You Will Learn:       Why security professionals need business skills for effective communication  Advice for auditing legacy systems with vulnerable protocols   Extracting DPAPI keys and decrypting browser session history      Some Questions We Ask:        How do you manage risk for legacy systems deemed necessary for business?  Can you discuss some of the outdated protocols in current IT environments?  What guidance would you offer to IT professionals looking to audit their systems?    Resources:   View Dustin Heywood on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn      Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks     Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Microsoft Principal Security Engineering, Tera Joyce and Senior Security Program Manager at Microsoft, Tina Zhang-Powell join Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. As we celebrate International Women's Day and Women's History Month, Tina and Tera join the show to discuss the importance of allies in promoting inclusivity and diversity within the industry. They both  provide valuable perspectives on assumptions made about women in cybersecurity and offer guidance on fostering an inclusive environment. They highlight the importance of leaders being aware of representation and ensuring diverse perspectives are considered in the decision-making processes and share internal resources like mentoring programs and external opportunities such as conferences to support women in the field. Tina and Tera also offer advice to allies, encouraging them to actively include diverse voices and how they can contribute to creating a more inclusive cybersecurity community.      In This Episode You Will Learn:       The significance of allies in promoting diversity and inclusivity  How we can address small instances of unconscious bias  The importance of discovering one's calling within the security field      Some Questions We Ask:        Can you share any resources or ways to support women in cybersecurity?  How can allies better support women in the cybersecurity industry?  Any advice for women or individuals interested in entering the tech and cybersecurity field?    Resources:   View Tera Joyce on LinkedIn  View Tina Zhang-Powell on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Microsoft Security Technical Program Manager Devin Price and Sr. Program Manager Derrick Love join Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. The discussion delves into the experience of being Black in the cybersecurity field. Derrick and Devin share their thoughts on the representation of Black individuals in tech, noting the underrepresentation in the field. The significance of representation and allyship is also discussed while emphasizing the importance of paying it forward, mentoring others, and highlighting the responsibility to support those coming up in the field. Devin and Derrick share the importance of involvement with events that promote the black community, black businesses, and black-led nonprofits. These events aim to create a supportive network within the community, particularly for those working in the technology sector. It underlines the significance of adopting a growth mindset, fostering a sense of community, and actively contributing to the empowerment of individuals within the cybersecurity landscape.       In This Episode You Will Learn:       How mentorship can help the growth of underrepresented individuals in security  Actionable advice for fostering diversity in the industry  Why representation and allyship is so vital for Cybersecurity    Some Questions We Ask:        What challenges and rewards come with working in cybersecurity?  How can we positively affect and support the Black community in tech?  Can you share actionable advice for fostering diversity in the industry?    Resources:   View Devin Price on LinkedIn   View Derrick Love on LinkedIn   View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn  Beam Foundation   Sync Seattle     The Talking Tech Podcast   BAM Scholarship    Related Microsoft Podcasts:     Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks      Discover and follow other Microsoft podcasts at microsoft.com/podcasts Hosted on Acast. See acast.com/privacy for more information.

Katelyn Falk, Principal Security TPM at Zoom, joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Katelyn is a security technical program manager with 11+ years of experience across IT and security, both cyber and physical, and is also co-founder of Zoom's Women in Security group. Katelyn, Wendy, and Nic discuss the growth of Zoom, the challenges of fostering a sense of community in a rapidly expanding organization, and the importance of diversity and representation in the cybersecurity industry. Katelyn explains the inspiration behind her Blue Hat conference lightning talk, "No Women in Security Group, No Problem," and her role in creating the Women in Security Group.  In This Episode You Will Learn:   Practical steps for starting a Women in Security employee resource group Advice on overcoming self-doubt when considering a leadership role Examples of allyship, offering resources and support in meetings Some Questions We Ask:    How important is executive sponsorship, and how did you navigate securing it? Can you outline the process of establishing a group leadership team? How do you keep the members engaged and connected in a virtual setting? Resources:  View Katelyn Falk on LinkedIn View Wendy Zenone on LinkedIn View Nic Fillingham on LinkedIn katelynfalk.com Related Microsoft Podcasts:  Microsoft Threat Intelligence Podcast  Afternoon Cyber Tea with Ann Johnson  Uncovering Hidden Risks  Discover and follow other Microsoft podcasts at microsoft.com/podcasts  Hosted on Acast. See acast.com/privacy for more information.

Leading Threat Intelligence at InQuest, Darren Spruell joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Darren explains InQuest's focus on Deep File Inspection® technology to identify malicious traits in files and talks about their role in serving public and private sector companies. Darren shares his cybersecurity journey, passion for combating malware and criminal activities, and his presentation at BlueHat. Wendy, Nic, and Darren highlight the evolution of threat information sharing over the years and the value of intelligence advantage over adversaries. The conversation delves into the significance of threat indicators such as IP addresses, file hashes, domain names, and much more!     In This Episode You Will Learn:       The challenges of exchanging threat intelligence and person-to-person sharing  Balancing technical expertise and leadership responsibilities  The importance of evolving manual threat intelligence sharing practices    Some Questions We Ask:       How can practitioners enhance the effectiveness of threat intelligence?  What types of security roles are sharing IOCs back and forth?  Why is community engagement in the cybersecurity industry so necessary?    Resources:   View Darren Spruell on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:   Microsoft Threat Intelligence Podcast   Afternoon Cyber Tea with Ann Johnson   Uncovering Hidden Risks       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Thinkst Canary, Cyber Security Researcher Casey Smith joins Nic Fillingham on this week's episode of The BlueHat Podcast. Nic and Casey discuss his background in security, his experience presenting at Blue Hat, and his session on building a Canary token to monitor Windows process execution. The Canary token project is an open-source initiative that creates artifacts on a network to alert defenders when an attacker interacts with them. The tokens can take various forms, such as documents, cloud credentials, QR codes, or executables, providing an early warning system for potential breaches. They also cover the importance of failure in the research process and the evolution of the canary token project to adapt to new attack techniques.      In This Episode You Will Learn:       The need for defenders to explore new features in the Windows operating system  Challenges of keeping ahead of more sophisticated adversaries  The use of legitimate binaries for malicious activities      Some Questions We Ask:       How do you balance curiosity-driven research with practical security concerns?  What challenges do you see in the current state of endpoint security?  How do you navigate working with customers and using what you learn for research?    Resources:   View Casey Smith on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:                  Afternoon Cyber Tea with Ann Johnson  Uncovering Hidden Risks     The Microsoft Threat Intelligence Podcast       Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Senior Principal Security Researcher Nestori Syynimaa joins Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Nestori is an ICT professional with a strong practical and academic background. Since April 2021, Nestori has worked as a Senior Principal Security Researcher at Secureworks' Counter Threat Unit. Before joining Secureworks, he worked as a joint CIO for eight cities and municipalities surrounding Tampere, the largest inland city in Scandinavia. Nestori, Wendy, and Nic discuss the importance of understanding the dynamics between researchers and organizations in addressing security concerns, Nestori's journey as a researcher, his academic background, and his experiences speaking at various conferences worldwide.      In This Episode You Will Learn:       Challenges and successes in the bug bounty process  The importance of researchers confirming fixes to make the process more efficient   Ethical considerations for researchers and motivations within the hacking community      Some Questions We Ask:       What challenges do many organizations face running bug bounty programs?  How can you find a trustworthy peer or seasoned researcher to get feedback on your work?  Has encountering different cases shaped your understanding of bug bounty programs?     Resources:   View Nestori Syynimaa on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:                  Afternoon Cyber Tea with Ann Johnson  Uncovering Hidden Risks     The Microsoft Threat Intelligence Podcast         Discover and follow other Microsoft podcasts at microsoft.com/podcasts   Hosted on Acast. See acast.com/privacy for more information.

Senior Data Scientist Emily Yale and Senior Threat Hunt Analyst at Microsoft Chris Bukavich join Wendy Zenone and Nic Fillingham on this week's episode of The BlueHat Podcast. Chris focuses on incident response, investigation, and detection of major incidents, while Emily works on developing and improving detections for Microsoft's internal security. Emily and Chris were co-presenters at this year's BlueHat conference. They discussed unmasking Azure-based adversaries with an emphasis on monitoring service principles,  how their respective expertise in data science and cybersecurity contributed to the session, and the challenges of monitoring service principles in Azure. This concept has evolved from traditional service accounts.      In This Episode You Will Learn:       The importance of monitoring spikes in activity  Criteria for identifying malicious behavior targeting service principles  Historical context of service principles and their increasing relevance    Some Questions We Ask:       How can you proactively monitor and detect anomalies related to service principles?  What challenges arise when profiling service principles based on past behavior?  When can service principles be tied to user authentication?    Resources:   View Emily Yale on LinkedIn  View Chris Bukavich on LinkedIn  View Wendy Zenone on LinkedIn  View Nic Fillingham on LinkedIn    Related Microsoft Podcasts:  Microsoft Threat Intelligence Podcast  Afternoon Cyber Tea with Ann Johnson  Uncovering Hidden Risks         Discover and follow other Microsoft podcasts at microsoft.com/podcasts  Hosted on Acast. See acast.com/privacy for more information.