Claim OwnershipSubscribed: 0Played: 0
Subscribe
Description
Episodes
Reverse
A subset of security orchestration, the management of identities across an organization's set of digital islands.
CyberWire Glossary link: https://thecyberwire.com/glossary/identity-orchestration
A cyber threat intelligence analysis model that defines relationship pairs between four core components in the shape of a diamond of adversary playbook activity across the intrusion kill chain: the adversary, their capability, the infrastructure used or attacked, and the victim.
CyberWire Glossary link: https://thecyberwire.com/glossary/diamond-model
Audio reference link: “Diamond Presentation v2 0: Diamond Model for Intrusion Analysis – Applied to Star Wars’ Battles,” Andy Pendergrast and Wade Baker, ThreatConnect, YouTube, 4 February 2020.
A knowledge base of adversary tactics, techniques, and procedures established and maintained by the MITRE Corporation.
CyberWire Glossary link: https://thecyberwire.com/glossary/mitre-attck
Audio reference link: “Attack Frameworks - SY0-601 CompTIA Security+ : 4.2,” Professor Messer, YouTube, 29 April 2021.
The set of people, process, technology, and cultural norms that integrates software development and IT operations into a system-of-systems.
CyberWire Glossary link: https://thecyberwire.com/glossary/devops
Audio reference link: "10+ Deploys Per Day: Dev and Ops Cooperation at Flickr," by John Allspaw and Paul Hammond, Velocity 09, 25 July 2009.
A software development model that relies on a series of sequential steps that flow into each other, like a series of waterfalls.
CyberWire Glossary link: https://thecyberwire.com/glossary/waterfall-software-development
Audio reference link: “Creating Video Games - Agile Software Development,” by Sara Verrilli, MIT OpenCourseWare, YouTube, 10 December 2015
A software development philosophy that emphasizes incremental delivery, team collaboration, continual planning, and continual learning
CyberWire Glossary link: https://thecyberwire.com/glossary/agile-software-development
Audio reference link: "Velocity 09: John Allspaw and Paul Hammond, "10+ Deploys Pe," John Allspaw and Paul Hammond, 2009 Velocity Conference, YouTube, 25 June 2009.
The flagship product of the controversial Israeli spyware vendor, the NSO Group, use for remotely hacking mobile devices, most notably iPhones, via zero-click exploits.
CyberWire Glossary link: https://thecyberwire.com/glossary/pegasus
Audio reference link:“Cybersecurity beyond the Headlines: A Conversation with Journalist Nicole Perlroth,” Kristen Eichensehr, and Nicole Perlroth, University of Virginia School of Law, YouTube, 14 February 2022
An open source email authentication protocol designed to prevent emails, spoofing in phishing, business email compromise or BEC, and other email-based attacks.
CyberWire Glossary link.
Audio reference link:"Global Cyber Alliance's Phil Reitinger talks DMARC adoption" “Global Cyber Alliance’s Phil Reitinger Talks DMARC Adoption.” YouTube Video. YouTube, April 27, 2018
A condition announced by the US Cybersecurity and Infrastructure Security Agency (CISA) to draw attention to a temporary period of high alert, associated with expectation of a connected wave of cyberattacks prompted by either a widespread vulnerability or an unusually active and capable threat actor.
A prescriptive open source software security maturity model designed to guide strategies tailored to an organization’s specific risks.
Audio reference link: "OWASPMSP - Pravir Chandra: Software Assurance Maturity Model (OpenSAMM)." by Pravir Chandra, OWASP MSP, 2009.
An open standard for hardware authentication tokens that use the universal serial bus, or USB, near-field communications, or NFCs, or Bluetooth to communicate one factor in a two-factor authentication exchange.
Cyberwire Glossary link: https://thecyberwire.com/glossary/u2f
Audio reference link: “Rise of the Machines: A Cybernetic History,” by Thomas Rid, Published by W. W. Norton Company, 21 November 2017.
A cyber threat intelligence best practice of assigning arbitrary labels to collections of hacker activity across the intrusion kill chain.
A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops.
Software libraries, frameworks, packages, and other components, and their dependencies (third-party code that each component uses) that have inherent security weaknesses, either through newly discovered vulnerabilities or because newer versions have superseded the deployed version.
Audio reference Link: "The Panama Papers: A Closer Look," Late Night with Seth Meyers, YouTube, 12 April 2016
Code and data repositories that don't protect against unauthorized changes.
An attack technique that leverages an unprotected web server as a proxy for attackers to send commands through to other computers.
The absence of telemetry that could help network defenders detect and respond to hostile attempts to compromise a system.
Ineffectual confirmation of a user's identity or authentication in session management.
An open source Java-based software tool available from the Apache Software Foundation designed to log security and performance information.
Software users are allowed access to data or functionality contrary to the defined zero trust policy by bypassing or manipulating the installed security controls.
Comments
Download from Google Play
Download from App Store
United States