SEC.co Podcast

Eric Lamanna

A podcast about latest trends, techniques and learnings in cybersecurity and cyberdefense.

  1. 10h ago

    Identity Federation vs. Zero Trust: Choosing the Right Cloud Security Model

    Cloud security strategy often stalls the moment two phrases collide in the same room: "Identity Federation" and "Zero Trust." This episode of Cybersecurity cuts through the jargon and the whiteboard wars to lay out exactly what separates these two models, what trade-offs each demands, and why the real danger may have nothing to do with which one you pick. The discussion draws directly from this in-depth cloud security model comparison published by SEC. Here's what the episode covers: How Identity Federation works — centralized Identity Providers (IdPs), protocols like OAuth 2.0, SAML, and OpenID Connect, and the Single Sign-On experience that makes federated identity so appealing for SaaS-heavy organizations.The critical vulnerability baked into federation — trading many small keys for one master key means a compromised IdP can expose every connected application at once.The Zero Trust philosophy — "verify always, trust never" assumes breach is inevitable and responds with continuous, contextual verification rather than one-time login approval.What Zero Trust actually looks like in practice — persistent MFA challenges, device posture checks, network micro-segmentation, least-privilege access, and behavioral analytics running throughout every session.The real cost of Zero Trust — significant operational complexity, user friction, and a high margin for error that can produce security theater if the rollout is careless.Why most mature organizations land on a hybrid model — using federated SSO for everyday access while layering Zero Trust controls onto sensitive systems, privileged workflows, and high-risk assets.Implementation quality as the deciding factor — misconfigured token scopes, leaky MFA policies, and improperly segmented networks are what attackers actually exploit, making deployment discipline more consequential than model selection alone.The episode closes with a point worth carrying into any security planning conversation: the Identity Federation versus Zero Trust debate is valuable because it forces organizations to articulate their risk tolerance and surface hidden assumptions — but the choice itself is only the starting line. Rigorous, ongoing implementation is what separates genuine security posture from a framework that looks good on a slide deck. For more on building the human side of a security culture, check out the episode Strengthening Your Human Firewall: Building a Real Cybersecurity Culture. SEC

  2. 10h ago

    Insider Risk Modeling: Moving Beyond Trust but Verify

    The perimeter-based security model was built for a world that no longer exists. Today's enterprises span cloud environments, remote workforces, and third-party contractors — a landscape where the most damaging threats can come from people who already have legitimate access. This episode of Cybersecurity examines why the classic "trust but verify" approach consistently fails to catch insider threats, and what a modern, behavior-driven risk program looks like in practice. The discussion draws on this in-depth look at insider risk modeling to walk through both the strategic framework and the practical first steps organizations can take right now. Here's what the episode covers: Why the old model breaks down: Periodic log reviews and audits leave dangerous detection gaps — measured in days or weeks — while the sheer volume of enterprise events makes manual verification impossible at scale.Continuous behavioral scoring: Instead of trusting first and checking later, modern programs assign dynamic risk ratings to users in real time, drawing on identity context, device signals, application behavior, and geographic data.Key analytics techniques: Baseline comparison, peer-group benchmarking, and sequence analysis each surface anomalies that look routine in isolation — but tell a very different story in combination.Static vs. dynamic risk signals: Fixed attributes like privilege level matter, but high-risk windows — such as the period after an employee hands in notice — require models that weight transient circumstances appropriately.Layered response actions: From automated controls and real-time contextual prompts to human analyst triage, the episode maps out how risk scores should translate into actual intervention, not just dashboard noise.Ethics, privacy, and legal guardrails: Effective insider risk programs require transparent employee policies, role-based data masking, and early involvement from legal and HR — because a monitoring program perceived as surveillance damages the culture it's meant to protect.The episode closes with practical advice on where to start without a dedicated data science team: inventory critical data assets, unify identity and endpoint logs, and pilot a basic model against a single high-value dataset before scaling. Insider risk modeling isn't a one-time deployment — it's a living system that must evolve alongside the business. For more on building a security-aware workforce from the inside out, check out the episode Strengthening Your Human Firewall: Building a Real Cybersecurity Culture. SEC

  3. 2d ago

    Strengthening Your Human Firewall: Building a Real Cybersecurity Culture

    Technology can only take enterprise security so far. When nearly three-quarters of all breaches trace back to human error, the most dangerous vulnerability in any organization isn't a misconfigured server — it's an undertrained, culturally disengaged workforce. This episode of Cybersecurity digs into the concept of the human firewall, drawing on this in-depth guide to building a real cybersecurity culture to explain why organizational behavior matters more than almost any tool you can buy. The episode walks through the three pillars that separate a resilient human firewall from a liability — culture, training, and accountability — and covers the practical steps organizations need to take to make security a shared responsibility at every level. Key topics include: Why culture is the foundation: A weak cybersecurity culture produces employees who treat policy as optional, assume IT will catch every mistake, and stay silent when they make one — creating the exact conditions attackers exploit.Leadership's non-negotiable role: When executives bypass MFA or skip training, the message is clear to the rest of the organization; strong security culture starts with leaders who follow the same rules as everyone else.Training that actually changes behavior: Role-specific, frequent, and engaging training — including realistic phishing simulations and gamified incentives — outperforms the annual click-through compliance video by a wide margin.Essential technical hygiene: App-based multi-factor authentication with no carve-outs, organization-wide password managers, and the Principle of Least Privilege for access control are non-negotiable baselines, not nice-to-haves.Incident response as a living process: A response plan that nobody has practiced is not a plan — tabletop exercises are how organizations find gaps before an attacker does.Sustainability over one-time fixes: Security becomes durable only when it's embedded in daily workflows and employees feel like active defenders rather than compliance checkboxes.The episode makes a compelling case that organizations investing in people — not just tools — are the ones that turn cybersecurity from a cost center into a competitive advantage. If you're also thinking about modernizing authentication across your organization, the episode Rolling Out Passkeys in the Enterprise: Patterns, Recovery, and Failure Modes is a natural companion listen. SEC

  4. 3d ago

    Secrets in Build Artifacts: How They Leak and How to Stop Them

    Secret leakage through build artifacts is one of the most underestimated risks in modern software development — not because it's sophisticated, but because it's so easy to miss. This episode of Cybersecurity digs into a problem that affects nearly every engineering team: sensitive credentials quietly bundled into compiled packages, container images, and release binaries, then distributed far and wide before anyone notices. The discussion draws on this in-depth breakdown of how secrets leak into build artifacts and how to stop them, covering the full lifecycle from root cause to recovery. The episode walks through three distinct phases of defense — prevention, detection, and containment — and explains why none of them alone is sufficient. Key topics include: Why leaks happen: Hardcoded tokens, debug output swept into final packages, and committed config files are the usual culprits — almost always the result of human habit rather than malicious intent.Architectural prevention: Secrets should never be baked into build artifacts at all; pulling credentials at runtime from a dedicated secrets management system is the foundational fix.Pipeline automation: Pre-commit hooks, CI/CD scanners, and automated merge blockers catch secrets early — the earlier in the pipeline, the cheaper and easier the remediation.Artifact scanning and behavioral monitoring: Specialized tools can detect known secret patterns in binaries and container images; anomaly detection in access logs and API traffic can signal an active compromise when scanning alone isn't enough.Rapid containment: When a secret is found in a distributed artifact, assume it's already been discovered — rotate the credential immediately, pull every copy of the artifact, and audit recent access without delay.Postmortems as process improvement: Documenting not just what happened but what in the pipeline allowed it to happen is the only way to turn a containment event into lasting prevention.The episode also addresses the friction between developer velocity and security controls, arguing that better automation — not more friction — is how teams close the gap. Third-party dependencies as a frequently overlooked vector for secret exposure round out the conversation. More from the show: if you're interested in how trust is established at the hardware level, check out the episode Hardware Root of Trust: Beyond the TPM Hype. SEC

  5. 4d ago

    Rolling Out Passkeys in the Enterprise: Patterns, Recovery, and Failure Modes

    Replacing passwords with passkeys is one of the most meaningful security upgrades an enterprise can make — but the gap between "this works in a demo" and "this works for 10,000 employees across three continents" is vast. This episode of Cybersecurity examines the enterprise passkey deployment guide from SEC, translating its detailed analysis into an honest account of what deployment actually looks like: the groundwork required before a single user enrolls, the rollout patterns that earn adoption, and the silent failure modes that can unravel even a well-intentioned rollout. The episode covers the full lifecycle of an enterprise passkey deployment, including: Why the threat model shifts: phishing and credential stuffing shrink, but social engineering around recovery, device theft, and shared-machine abuse fill the void — and your alerting needs to move with that shift.The three prerequisites: a thorough identity inventory, an honest assessment of device fleet posture, and a deliberate reset of the policies (like 90-day rotations) that made sense in a password world but now become liabilities.Rollout patterns that work: starting with high-friction apps to generate visible user wins, expanding via progressive cohort enrollment rather than company-wide cutovers, and anchoring recovery to two independent factors with dual-bind design.Patterns that struggle: all-or-nothing cutover dates that one forgotten warehouse app can derail, shadow federation that fragments identity telemetry across SaaS tools, and BYOD policies that turn a lost phone into an identity landmine.The failure modes to anticipate: enrollment loops caused by stale sessions and mixed browser profiles, roaming key confusion when cloud sync lags or platform boundaries block key delivery, and the predictable help-desk surge in the first week of any identity transition.Measurement and governance: what metrics actually signal progress (phishing reach, MFA fatigue alerts, median sign-in time by platform), how to structure assertion log retention, and the blunt vendor questions that reveal how much you can actually trust a given implementation.The episode closes with a reminder that passkey success is less a technical achievement than a discipline — one built on accurate inventory, realistic device baselines, human-centered recovery design, and communication that treats users as partners rather than compliance targets. For more on firmware-level identity threats that sit just beneath this authentication layer, listen to the episode Hunting UEFI Boot-Level Persistence: Firmware Integrity and Secure Boot. SEC

  6. 5d ago

    Hunting UEFI Boot-Level Persistence: Firmware Integrity and Secure Boot

    When an attacker embeds themselves in firmware rather than the operating system, wiping a drive and starting fresh won't dislodge them. This episode of Cybersecurity tackles one of the most technically demanding corners of modern threat hunting: UEFI boot-level persistence. Drawing on this in-depth guide to detecting UEFI boot-level persistence, the episode walks defenders through a structured, practical approach to finding and responding to implants that load before any endpoint agent has a chance to run. UEFI persistence is difficult to detect precisely because it operates at a layer most security tooling never reaches. The episode covers the three surfaces attackers target and explains how to build reliable detection across all of them: UEFI boot entry manipulation — how adversaries add or redirect boot targets to side-load malicious components while keeping display names familiar enough to avoid scrutiny, and how baselining and diffing boot entries exposes this technique.EFI System Partition integrity — what a clean partition should look like, why unexpected files, recent timestamps, or subtle binary differences in bootloaders are red flags, and why cryptographic hashing against a golden sample matters even when vendor signatures appear valid.Firmware image verification — matching reported firmware versions against hash-verified images, checking write protection state, and understanding why an attacker's first move is often to loosen the guardrails before planting anything.Secure Boot posture — auditing the key enrollment key, allowed-signature database, and revocation list to confirm that the integrity chain is actually intact, not just nominally present.Measured boot and TPM attestation — using TPM quotes compared against your own reference measurements (not vendor documentation) as a scalable tripwire that flags anomalies across large fleets without requiring full firmware image dumps on every device.Building a living baseline — why every firmware update, key rotation, and loader change requires a corresponding baseline update, and what happens to detection fidelity when that discipline slips.The episode also covers incident response procedure for suspected boot-level tampering — including the sequencing of evidence collection and why a hasty reboot can destroy the artifacts needed to confirm a compromise. The broader operational guidance is clear: firmware deserves the same version tracking, change control, and provenance hygiene that mature teams already apply to software and OS packages. For more on cryptographic key management at the infrastructure layer, check out the earlier episode KMS Key Isolation: Tenant, App, and Environment Boundaries Done Right. SECCybersoftware.ai

  7. 5d ago

    Lateral Movement in the Cloud: Detect It, Stop It, Sleep Again

    Once an attacker gains a foothold in a cloud environment, the real threat isn't the breach itself — it's what comes next. Lateral movement in the cloud is quiet, methodical, and deliberately designed to look like legitimate activity. This episode of Cybersecurity unpacks this deep-dive guide on detecting and mitigating cloud lateral movement, translating the technical detail into a clear picture of what's at stake and what defenders need to do about it. The episode walks through the full arc of a cloud lateral movement attack — from initial foothold to environment-wide compromise — and examines why the very features that make cloud infrastructure powerful also make it a playground for attackers who are already inside. Key topics include: Why cloud lateral movement is harder to contain than on-premise equivalents — the absence of a physical perimeter, sprawling IAM permissions, and always-on automation pipelines all expand the attack surface in ways traditional security models weren't built to handle.How attackers actually move — using stolen or forgotten service account credentials, over-permissioned machine identities, and internal API endpoints to impersonate legitimate workloads and hop across services undetected.The detection signals that matter — identity behavior that deviates from established baselines, suspiciously methodical API enumeration sequences, and mid-session credential rotation are the early warning signs worth tuning for.Why behavioral analytics outperforms static rules — dynamic baselines per identity and per workload catch anomalies that threshold-based alerting misses, while graph-based attack path mapping turns isolated log events into a connected, readable story.Mitigation that doesn't break production — least-privilege enforcement and microsegmentation are framed not as compliance exercises but as the structural controls that limit blast radius when an identity is compromised.Automated response as a force multiplier — the speed of containment often determines whether an incident stays contained; playbooks that immediately isolate compromised credentials and quarantine suspicious workloads compress the attacker's window dramatically.The episode closes with a reminder that cloud lateral movement isn't a problem you solve once — it's an ongoing discipline that has to evolve alongside an ever-changing attack surface. For more on this topic, the source material is well worth reading in full. And if you're thinking about cloud identity architecture more broadly, check out the earlier episode KMS Key Isolation: Tenant, App, and Environment Boundaries Done Right for a complementary look at how encryption key boundaries can anchor a stronger security posture. SEC

  8. Jul 26

    KMS Key Isolation: Tenant, App, and Environment Boundaries Done Right

    Key mismanagement rarely announces itself cleanly. It shows up as a 2 a.m. permission error with no obvious owner, a rotation that might have broken something, and an audit trail that raises more questions than it answers. This episode of Cybersecurity explores how deliberately designed KMS key isolation — across tenant, application, and environment boundaries — transforms that chaos into a craft. Drawing on this in-depth guide on KMS key isolation design, the episode walks through each isolation layer in practical detail. Here's what the episode covers: Why boundaries matter fundamentally: Vague key ownership lets permissions accumulate by habit over years, creating webs of access nobody fully understands — and making routine tasks like rotation and decommissioning feel risky rather than boring.Tenant isolation: Each tenant deserves its own key hierarchy, its own keyrings or projects, and policies bound strictly to tenant identity. Even metadata needs protection. Break-glass accounts must be scoped per tenant, expire quickly, and leave a readable trail on every single use.Application isolation: Different data classifications and risk profiles demand separate keys. A well-maintained key catalog per application — listing purpose, algorithm, rotation cadence, and permitted services — keeps the fleet trimmed and releases calm.Environment isolation: Dev, test, staging, and production represent meaningfully different risk levels. Separate KMS hierarchies per environment, distinct audit log sinks, and pipeline policies that block cross-environment key references prevent the all-too-common scenario of development tooling reaching production keys.Naming conventions as operational armor: Encoding tenant, application, environment, purpose, and version into key names gives on-call engineers immediate context at a glance — and reduces error rates during incidents and audits alike.Guarding against drift: Staging environments quietly diverge from production through small exceptions that compound over time. Periodic policy comparisons and treating permissive anomalies as smoke alarms keep environments honest before drift becomes habit.The throughline of the episode is that clear, deliberate boundaries shrink blast radius, simplify incident response, and make even key rotation feel routine. When tenant, application, and environment isolation are all working well together, the answer to "which key does this?" should never require guesswork. For more on building security systems that hold up under pressure, check out the episode Hardware Root of Trust: Beyond the TPM Hype. SEC

See All (59)

About

A podcast about latest trends, techniques and learnings in cybersecurity and cyberdefense.

Information

  • Creator
    Eric Lamanna
  • Years Active
    2026
  • Episodes
    59
  • Rating
    Clean
  • Copyright
    © 2026 SEC.co
  • Show Website
    SEC.co Podcast