SEC.co Podcast

Eric Lamanna

A podcast about latest trends, techniques and learnings in cybersecurity and cyberdefense.

  1. 12h ago

    Post-Exploitation Tactics That Still Work in 2025

    Sophisticated breaches rarely hinge on novel zero-days. More often, they succeed because a handful of well-worn post-exploitation techniques continue to find gaps in enterprise defenses — year after year. This episode of Cybersecurity draws on this in-depth look at post-exploitation tactics still working in 2025 to examine exactly which methods attackers keep reaching for, why they remain effective, and what defenders can do beyond just alerting. The episode walks through six tactics — each paired with actionable defensive guidance — covering the full arc from initial foothold to cloud-native lateral movement: Living-off-the-Land Binaries (LOLBins): Attackers are chaining pre-installed, code-signed Windows tools — including WSL and IPv6-aware utilities — to blend into normal admin activity and bypass legacy egress filters. Defenders need behavioral baselines and auto-containment, not just alerting. Kerberoasting in hybrid identity environments: Syncing on-premises Active Directory with Azure AD gives attackers a bridge from an offline-cracked ticket straight into cloud control — often bypassing MFA entirely. Group Managed Service Accounts and Azure AD risk policies are the core mitigations. Cloud control-plane token theft: Cached CLI credentials and buried token files on developer workstations open a window for rapid cloud resource abuse and exfiltration before billing alerts fire. Near-real-time log streaming and just-in-time role assignment close the lag attackers depend on. Bring-Your-Own-Driver EDR tampering: Sideloading a legitimately signed but vulnerable kernel driver can blind or crash EDR agents without triggering OS-level warnings. Kernel Mode Code Signing enforcement and automated vulnerable-driver hash checking are essential countermeasures. Adversary-in-the-Middle phishing against MFA: Modern AiTM kits proxy real authentication sessions to harvest valid post-MFA cookies — some now using vision APIs to self-correct in real time. FIDO2/passkey adoption and device-posture-aware Conditional Access policies are the most durable defenses. SaaS-to-SaaS lateral movement via OAuth: Over-permissive OAuth grants between sanctioned apps let attackers hop from a low-value marketing tool to a financial data warehouse through calls that look entirely legitimate on the wire. Full OAuth inventory, least-privilege scope enforcement, and SaaS Security Posture Management (SSPM) provide the needed visibility. The episode closes by identifying the common thread across all six tactics: attackers exploit organizational gaps — between cloud and on-premises, between identity stores, between telemetry and analytics — not just technical vulnerabilities. The key takeaways center on response speed over tooling sophistication, unified telemetry with identity context, and automating repetitive security hygiene so teams can focus on hunting and strategy. For more on defending against advanced evasion techniques, listen to Payload Detonation in Cloud Sandboxes: Evasion Tactics and Defenses, a related episode exploring how attackers bypass cloud-based analysis environments. SEC

  2. 1d ago

    Payload Detonation in Cloud Sandboxes: Evasion Tactics and Defenses

    Cloud sandboxes are one of the most powerful tools in a defender's arsenal — but they come with a critical blind spot. Threat actors have systematically reverse-engineered how sandbox detonation works, embedding evasion logic directly into production malware to slip past automated analysis undetected. This episode of Cybersecurity examines the ongoing arms race between sandbox technology and the adversaries who exploit its limitations, drawing on the cloud sandbox evasion and defense analysis published by SEC. Here's what the episode covers: How cloud sandboxes work — isolated, short-lived virtual machines that detonate suspicious files or URLs, log every system call and network event, and score behavior before anything reaches a production environment. Time-based evasion — malware families that exploit short detonation windows using sleep loops, exponential back-off timers, and CPU-tick checks to stay dormant until the sandbox gives up. Environment fingerprinting — pre-execution checks that look for hypervisor driver signatures, minimal hardware profiles, generic MAC addresses, sequential hostnames, and the absence of real user artifacts like browser history or open documents. Staged payload delivery — lightweight loaders that appear benign during detonation, only pulling down the actual malicious second stage after the sandbox window has closed — often over HTTPS or legitimate cloud storage APIs. Defensive countermeasures — rotating across multiple VM templates and hypervisor backends, hardening sandbox images with realistic hardware specs and user artifacts, and injecting human-like mouse and keyboard activity to defeat fingerprinting checks. Closing the intelligence loop — cross-referencing sandbox telemetry against threat intelligence feeds and routing enriched signals into a TIP, SIEM rules, and endpoint detection policies in near real time. The episode's central argument is that sandboxes remain indispensable — but treating them as a definitive clean bill of health is the exact assumption attackers rely on. Continuous tuning, layered analysis, and a commitment to VM realism are what separate security teams that stay ahead of the evasion curve from those that don't. For more on protecting critical infrastructure from ransomware-class threats, check out the earlier episode Object Lock and Air-Gapped Backups: Building Ransomware-Proof Storage. SEC

  3. 2d ago

    Object Lock and Air-Gapped Backups: Building Ransomware-Proof Storage

    Ransomware's most reliable kill shot isn't encryption — it's destroying your ability to recover without paying. This episode of Cybersecurity tackles the two storage controls that directly neutralize that strategy: Object Lock and air-gapped backups. Drawing on this in-depth guide to immutable storage and ransomware resilience, the episode walks through how these controls work together, where teams most commonly get them wrong, and what a real recovery workflow looks like when they're implemented correctly. Here's what the episode covers: What immutability actually means — enforcement at the storage layer, not in a policy document, so compromised credentials and tired administrators hit the same wall as attackers. Object Lock modes explained — the difference between compliance mode (an absolute, administrator-proof retention window) and governance mode (auditable exceptions for documented business needs), and when to choose each. Retention period design — why setting the window too short can leave you with no clean restore points if ransomware was quietly lurking before it detonated, and how to find the right balance between recovery objectives and storage costs. Legal holds as a noisy safeguard — why holds need clear start events, documented owners, and clean close-outs, or they become a compliance liability of their own. Air gaps — physical and logical — how offline tape vaults and isolated cloud accounts with one-way data flow both achieve the same goal: forcing an attacker to cross a heavily monitored boundary before reaching your clean copies. Chain of custody from write to restore — authenticated writes into locked buckets, controlled cross-boundary transfers, tamper-evident logging at every hop, and why rehearsing a real recovery (not a slide deck) is the only way to build the muscle memory that matters on an actual incident day. The episode also covers practical pitfalls: why snapshots alone aren't a strategy, how small infrastructure-as-code misconfigurations can silently undermine retention modes, the case for dual-control approvals on any change that could weaken backup posture, and how to frame these investments clearly for leadership. If your incident response plan still relies on backups that a compromised administrator account could wipe, this episode is a direct challenge to fix that before it's tested under fire. For more on detecting adversary infrastructure, check out the episode Mapping C2 Tunnels Without Deep Packet Inspection. More resources and the full written companion to this episode are available at SEC.

  4. 3d ago

    Mapping C2 Tunnels Without Deep Packet Inspection

    Command-and-control traffic increasingly hides in plain sight — riding unusual ports, masquerading inside encrypted sessions, and deliberately blending into the background noise of modern cloud-heavy networks. This episode of Cybersecurity draws on this detailed guide to detecting C2 tunnels on non-standard ports and protocols to explain how defenders can map covert channels without ever performing deep packet inspection. The core argument is both practical and empowering: you don't need to read the message to identify the messenger. The episode walks through why attackers favor non-standard ports — buying time for lateral movement and exfiltration — and then lays out a layered detection methodology built entirely on behavioral and metadata signals. Here's what's covered: Flow record analysis: How NetFlow and IPFIX act as compact conversation summaries, revealing session timing, byte asymmetry, and repeating endpoint pairs without touching payload content. Beaconing and timing fingerprints: Why consistent check-in intervals — even with jitter applied — are statistically hard to disguise, and how simple summary statistics can surface them at scale. Packet and flow size patterns: How small, rhythmic client-to-server bursts paired with sporadic large return flows can indicate command pull and result push activity. TLS handshake metadata: Using JA3/JA4 fingerprinting and certificate characteristics (short validity, self-signed chains) to flag unusual encrypted sessions before any content is examined. DNS and QUIC telemetry: How query volume spikes, randomized subdomain patterns, and NXDOMAIN storms sketch the outline of a tunnel — and why QUIC still leaves detectable breadcrumbs despite early encryption. Correlation, asset context, and triage workflow: Why a single clue is a lead but three agreeing clues form a case — and how tagging endpoints by business role separates genuine threats from benign automation. The episode also covers visualization techniques for turning flow logs into graph-based anomaly maps, guidance on maintaining baselines that don't rot over time, and a controlled containment approach that lets analysts prove or disprove a C2 hypothesis through behavior rather than payload analysis. Common pitfalls — over-fitting on a single signal type, mistaking approved automation for malware, and under-labeling assets — each get their own treatment. Looking ahead, the discussion addresses how encrypted client hello and the continued spread of QUIC will raise the bar, and why the most durable defensive advantage is a disciplined habit of adapting telemetry collection and cross-team correlation to whatever comes next. More from the show: if you're working through governance and compliance alongside your detection engineering, our episode on NIST 800-53 vs. ISO 27001: Choosing the Right Security Framework pairs well with this one. SEC

  5. 4d ago

    NIST 800-53 vs. ISO 27001: Choosing the Right Security Framework

    When leadership asks whether the organization meets "the standard," the uncomfortable truth is that the answer depends entirely on which standard you're working toward. This episode of Cybersecurity cuts through the confusion surrounding two of the most referenced frameworks in the industry — NIST 800-53 and ISO 27001 — by examining what each one is actually designed to do, who it's designed for, and how to make a defensible choice between them. The discussion draws from this in-depth framework comparison from SEC to give practitioners and decision-makers a structured way to think through the selection process. The episode covers the origins, structure, and practical trade-offs of both frameworks, including: What NIST 800-53 is built for: a U.S. government-rooted catalog of 1,000+ granular security and privacy controls, tiered by low, moderate, and high baselines — and why it's effectively mandatory for federal contractors and agencies. What ISO 27001 brings to the table: a globally recognized Information Security Management System (ISMS) standard that emphasizes governance, risk assessment, and leadership accountability over prescriptive technical checklists. Depth vs. breadth: how NIST 800-53's technical specificity serves security engineers well but can overwhelm smaller teams, while ISO 27001's flexibility demands that organizations define their own controls through a Statement of Applicability. The certification distinction: ISO 27001 offers a third-party-validated certificate with real commercial value in international markets; NIST 800-53 supports compliance audits (like FedRAMP and FISMA) but issues no equivalent credential. Key questions to guide your decision: whether you serve U.S. federal agencies, whether international credibility is a business priority, and whether you're building a top-down management system or a detailed technical control library. Why "both" is a legitimate answer: how mature organizations map the two frameworks together to satisfy government requirements and global client expectations simultaneously. The episode closes with practical guidance on conducting an honest gap analysis before committing to either path — assessing existing controls, regulatory requirements, and where stakeholder pressure is actually coming from. The core takeaway: neither framework is universally superior, and the right fit is determined by your organization's regulatory context, business goals, and internal capacity to sustain a security program over time. More from the show: check out Modern Heap Exploitation: How Attackers Evolved Past the Old Playbook for a deep dive into how offensive techniques have advanced beyond legacy defenses. SEC

  6. 5d ago

    Modern Heap Exploitation: How Attackers Evolved Past the Old Playbook

    Modern heap exploitation looks almost nothing like it did a decade ago. Where early attackers relied on straightforward buffer overflows and well-known flaws, today's adversaries are patient, methodical, and skilled at assembling chains of small weaknesses into devastatingly precise attacks. This episode of Cybersecurity draws on this in-depth look at modern heap exploitation techniques to map out exactly how the threat landscape has shifted — and what defenders need to do about it. The episode walks through the evolution of heap-based attacks from their blunt beginnings to the sophisticated, multi-step campaigns that characterize advanced persistent threat (APT) activity today. Key topics covered include: How the heap works and why it's a target: The dynamic, fluid nature of runtime memory allocation creates opportunities for attackers to manipulate program behavior by controlling what goes in, when, and in what order. Why the old playbook is obsolete: Defenses like Address Space Layout Randomization (ASLR), heap canaries, safe linking, and guard pages have forced attackers to abandon simple, single-vulnerability exploits. Heap spraying and grooming: Attackers flood and reshape memory layouts methodically — lining up malicious data with surgical patience rather than brute force — to set the stage for later exploit phases. Use-After-Free (UAF) and type confusion attacks: Stale memory references and object-type mismatches remain highly exploitable, especially in complex, multithreaded codebases where tracking every pointer is genuinely difficult. Vulnerability chaining: The defining characteristic of modern heap exploitation — stringing three, four, or five separate flaws (a memory leak, an integer overflow, a UAF) into a single coherent attack sequence that individually raises no alarms. Defensive layers that actually matter: From memory-safe coding practices and static analysis to full ASLR, continuous log monitoring, and regular penetration testing by memory-exploitation specialists — no single measure is sufficient on its own. The episode makes clear that the signal of a modern heap attack is often visible in the noise — anomalous allocation patterns, unusual memory spikes, repeated free operations — but only for teams that are actively looking. Understanding how the attack surface has evolved is the prerequisite for building defenses that hold against adversaries who may spend months reverse-engineering a target before striking. For more on threats that exploit what systems unintentionally reveal, check out the episode Model Inversion Attacks: What Your AI Is Unintentionally Exposing. More security research and analysis is available from SEC.

  7. 6d ago

    Model Inversion Attacks: What Your AI Is Unintentionally Exposing

    Deploying a machine-learning model feels nothing like handing over a database — but that distinction may be far less meaningful than most organizations assume. This episode of Cybersecurity digs into model inversion attacks, drawing on this in-depth look at AI data exposure risks to explain how adversaries can reverse-engineer private training data from a model's own outputs — no breach, no stolen drives required. The episode walks through the mechanics of the attack, the landscape of who is most vulnerable, real-world consequences, and — critically — a layered set of defensive measures for technical teams, executives, and everyday users alike. Key topics covered include: How model inversion works: Attackers systematically query a model, analyze confidence scores and gradients, and use optimization algorithms to reconstruct data samples that reflect what the model memorized during training. Who is most at risk: Healthcare providers, financial institutions, retailers with recommendation engines, and academic researchers who share models trained on personal or biometric data all face meaningful exposure. The accessibility of attack tooling: Gradient querying libraries, open-source inversion scripts, and affordable cloud GPU time have dramatically lowered the barrier for would-be attackers. Defensive controls for engineering teams: Differential privacy, regularization, output sanitization, selective layer freezing during fine-tuning, and periodic red-team inversion exercises are all practical options to build into ML workflows. Executive-level responsibilities: Maintaining a model registry, requiring privacy impact assessments before deployment, enabling API audit logging, and integrating model inversion into incident response plans are framed as board-level concerns on par with SOC 2 or ISO 27001 compliance. What individuals can do: Scrutinizing app permissions, exercising data subject rights under GDPR or CCPA, and favoring services that publish independent audits are concrete steps available to everyday users. The central takeaway is a paradigm shift: sharing a model is not a privacy-safe alternative to sharing raw data. Machine-learning assets deserve the same encryption, monitoring, and access controls as the databases that fed them — from the first training run to model retirement. For more on navigating hidden risks in security architecture, listen to Microsegmentation Pitfalls No One Talks About. SEC

  8. Aug 12

    Microsegmentation Pitfalls No One Talks About

    Microsegmentation is widely regarded as one of the sharpest tools in network defense — but the gap between a well-designed implementation and a real-world deployment can be enormous. This episode examines the hidden pitfalls of microsegmentation strategy that practitioners rarely discuss openly: the subtle failures, compounding missteps, and organizational blind spots that can quietly transform a promising investment into a liability. The episode walks through seven distinct failure modes, giving listeners a clear-eyed look at where microsegmentation initiatives go wrong and what disciplined teams do differently: Over-engineering granularity: Pursuing maximum segmentation without operational planning creates unmanageable policy sprawl and raises the risk of misconfiguration. Neglecting people and process: Even the most sophisticated platforms fail when teams lack training, documentation, and clearly defined ownership over policies and alerts. Poor network visibility: Attempting to segment an environment without an accurate, real-time asset inventory leads to either disrupted legitimate traffic or undetected gaps that attackers exploit. Policy drift: Incremental exceptions — approved one at a time and never reviewed — gradually erode the segmentation design; disciplined change management and regular audits are the only reliable countermeasure. The "finished product" mindset: Treating microsegmentation as a completed project rather than an evolving layer of a broader security posture leaves organizations vulnerable as threats and infrastructure change. Underestimating long-term costs: Budget planning that only covers initial rollout, ignoring ongoing retraining, re-evaluation, and policy maintenance, sets segmentation projects up for neglect — which may be more dangerous than no segmentation at all. Big-bang deployment: Rolling out across an entire environment at once, without a phased pilot, invites network disruptions, policy conflicts, and user confusion that are difficult to untangle under pressure. The episode makes clear that microsegmentation's core value proposition — containing lateral movement, enforcing least-privilege access, and limiting breach radius — is real and achievable. But it only delivers when implemented with deliberate planning, sustained operational investment, and integration into a multi-layered security strategy rather than treated as a standalone solution. For more on the network segmentation conversation, check out the related episode Microsegmentation: Shrinking the Attack Surface in Hybrid Cloud Chaos. More from the show and additional resources are available at the link below. SEC

See All (77)

About

A podcast about latest trends, techniques and learnings in cybersecurity and cyberdefense.

Information

  • Creator
    Eric Lamanna
  • Years Active
    2026
  • Episodes
    77
  • Rating
    Clean
  • Copyright
    © 2026 SEC.co
  • Show Website
    SEC.co Podcast