W2D1 Media

•

频道 • 2 个节目

创业

创业

已完结
科技

科技

两周一更

2024/11/20

Navigating the PSPF 2024 Updates: Expert Insights with Kat McCrabb and Toby Amodio

Episode SummaryIn this episode, Cole Cornford is joined by cybersecurity experts and IRAP assessors, Kat McCrabb and Toby Amodio, to unpack the latest updates to the Protective Security Policy Framework (PSPF) for 2024. They explore the significant changes introduced in the PSPF, such as the heightened emphasis on IRAP assessments, the potential strain on resources due to increased demand for assessors, and the impact on government agencies' compliance efforts. The discussion delves into the restructuring of the PSPF domains, including the separation of information and technology, and the challenges this presents for reporting and governance. They also address issues with self-attestation in agencies, insights from ANAO reports, and the critical importance of managing legacy IT systems. Kat and Toby offer valuable perspectives and practical advice for organisations navigating these new requirements, highlighting the need for proactive planning and adaptation in the evolving cybersecurity landscape. Timestamps01:27 - What is the PSPF? Toby explains the framework 03:07 - Kat discusses the biggest changes in the PSPF 2024 updates 04:20 - Challenges with IRAP assessments: time, cost, and limited assessors 06:18 - When are IRAP assessments required? Clarifications 08:13 - Changes in PSPF domains: splitting information and technology 10:08 - Implications of the changes for reporting and governance 12:15 - Comparison with NIST framework and governance considerations 13:38 - Issues with self-attestation and insights from ANAO reports 15:09 - Strategies for improving reporting and assessments in agencies 17:36 - Managing legacy IT systems under the new PSPF requirements 18:52 - Key takeaways and final thoughts from Kat and Toby Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/11/20

•

22 分钟
2023/06/07

Hacking the Game of Life: From Gaming Exploits to Cybersecurity Giant with Shubham Shah of Assetnote

Shubham Shah is co-founder and CTO of Assetnote, a cybersecurity tool used by companies like Atlassian, Qantas, and Australia Post. Shubham’s career in cybersecurity had very humble beginnings: he first learned to hack computer games as a kid so he could beat his brother. Shubham chats with Cole Cornford about video game exploits and what they can teach us about appsec, bug bounty hunting, the challenges of founding a company, and plenty more. Secured by Galah Cyber with Cole Cornford website 2:30 - Benefits of shared workspace. 5:30 - Shubham’s background. 9:00 - Bug bounty hunting. 10:45 - Developing a good work ethic from crappy jobs. 15:00 - Video game hacking. 21:00 - Tying video game hacking to cybersecurity. 22:40 - Shubham: got in trouble for hacking in high school. 24:20 - Shubham: had to convince his parents to let him study computer science. 26:00 - Shubham was working an unpaid internship. 26:50 - Cole: pros and cons of uni education. 29:20 - Shubham: I don’t discourage people from going to uni. 32:00 - Assetnote - discussing the company. 34:00 - Shubham started commercialising but “had no idea what I was doing”. 36:45 - Cole reflects on his early naivety when starting Galah Cyber. 38:30 - Pros and challenges of bootstrapping a business. 39:00 - Shubham: came close to running out of money. 40:45 - Cole: I see a vacuum for app sec talent in smaller orgs. 41:30 - Cole: software has eaten the world. Now AI is eating software. 43:10 - Shubham: division of work between Shubham and co-founder. 44:30 - Doing any job to move the business forward. 47:00 - Rapid-fire questions. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023/06/07

•

54 分钟
2024/08/28

Security Done Right: Ben Gittins on the Case for Generalists and Long-Term Solutions

SummaryBen Gittins is the Principal Security Engineer at Bugcrowd, one of the world's best bug bounty platforms. Ben has previously worked as a Senior DevSecOps Engineer at Canva, as well as DevSecOps Lead at SecureStack. In this conversation with Cole Cornford, Ben shares his belief that cybersecurity needs more generalists, how coding and AppSec have changed over time, whether cybersecurity qualifications are overrated, and plenty more. Timestamps3:50 - Why is Aus cybersecurity lagging behind? 9:50 - Over-reliance on purchasing cybersecurity products 14:40 - We ask too much of our AppSec professionals 19:00 - How App development & cybersecurity have changed over time 24:00 - "Greenfield projects" are often not realistic 28:20 - How to bring new people into the AppSec industry 32:00 - Importance of communication skills 38:20 - Cybersecurity qualifications are overrated 43:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/08/28

•

47 分钟
2023/08/16

An Agnostic Approach to AppSec: Ken Johnson on Navigating the Future with AI

Ken Johnson is co-founder of Dryrun Security and co-host of the Apsolute AppSec podcast. Ken has many years experience working in AppSec in a variety of roles, including CTO of nVisium and Application Security Engineer at GitHub. Ken chats with Cole Cornford about taking an agnostic approach to AppSec, transitioning from being an employee to a founder, how AI might change cybersecurity, and plenty more. Secured by Galah Cyber with Cole Cornford website Timestamps9:10 - When Ken started running AppSec conferences.12:00 - Ken: an “agnostic approach” to appsec really resonated with people.14:30 - Ken: “by nature we are always behind the curve”.15:40 - Ken: appsec is getting much harder.17:00 - Cole also advocates for an agnostic approach to appsec.18:50 - Ken’s favourite thing about Github: the culture.20:30 - discussing Github.25:00 - Appsec education.26:30 - quality software is secure software.27:30 - AI & Appsec.33:50 - Brief overview of Ken’s professional life, transition to being a founder.36:30 - Cole: people who plan to build a product alongside consulting.38:20 - Cole’s experience starting a consulting business.39:40 - Ken’s interests outside AppSec.40:40 - How Ken got into brazilian ju jitsu.44:10 - Cole’s pandemic experience. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023/08/16

•

48 分钟
2024/10/02

Building Cybersecurity Culture: Marketing, Awareness, and Diversity with Daisy Wong

Summary Daisy Wong is the Head of Security Awareness at Medibank, as well as a disability advocate. Originally from a marketing background, Daisy gained experience in the cybersecurity industry working as part of penetration teams, before making her way into the security culture and awareness space. In her conversation with Cole Cornford, Daisy discusses using the tools of marketing to educate people on cybersecurity, what are the hallmarks of a good security culture and awareness program, and the importance of diversity in cybersecurity. Timestamps 4:00 - Daisy's transition from marketing to cybersecurity 8:10 - The importance of security culture and awareness 11:00 - Building effective security awareness programs 14:15 - The role of diversity in cybersecurity 17:00 - Strategies for inclusive hiring practices 19:40 - The power of communication in security awareness 23:20 - Creative approaches to security awareness campaigns 31:45 - Daisy's personal perspective on the importance of diversity 43:40 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/10/02

•

47 分钟
2024/06/19

Behind Elttam: Matt Jones Discusses Infosec Innovations and Australia's Cybersecurity Landscape

Summary In this episode, Cole Cornford chats with Matt Jones, co-founder of Elttam, an independent security boutique that provides security assessment services. On top of his role at Elttam, Matt is active in the infosec community in a variety of ways, including helping with BSides Canberra's call for papers and writing open-source tooling such as talkback.sh. Cole and Matt chat about the motivation behind founding Elttam, why Australia's infosec industry is lagging behind other parts of the world, the exploit development space, and plenty more. Timestamps 2:00 - Matt's career background 7:00 - Matt's early challenges finding an opportunity in cybersecurity 11:00 - Why Matt chose to co-found Elttam 13:00 - Cole: Australia's infosec industry is immature compared to US 19:00 - The importance of specialisation 20:30 - Better to do 1 thing really well when bootstrapping 24:00 - Using the right approach for the right context 25:30 - Risks of using a bug bounty program 31:10 - Cole: the bar for pen testing reports should be much higher 37:10 - Training & education for infosec 39:00 - Cole: is infosec a cottage industry? 44:00 - Product vs service approach to cybersecurity 47:50 - Cole: I like looking at source code from 80s and 90s 49:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/06/19

•

56 分钟
2024/10/09

Open-Source Software: Balancing Innovation and Security with Ilkka Turunen, CTO of Sonatype

Episode SummaryIlkka Turunen is the CTO at Sonatype, a company that helps millions of software developers use open-source software while minimising security risk. In this conversation, Ilkka chats with Cole Cornford about the benefits and risk of using open-source software, how Maven helped standardise software development processes, the different approaches to AppSec regulation in Australia and Europe, and plenty more. Timestamps1:33 - Ilkka's career background 4:00 - Varying quality of open-source software 6:10 - How Maven helped standardise software development processes 13:00 - The balance between speed of delivery & quality 17:00 - Importance of environment parity in software dev 21:40 - Risk of using 3rd party code in software 25:10 - Regulation of AppSec in Australia vs Europe 32:10 - How new European software security regulations will be enforced 35:00 - Recommendations for compliance with European regulations 39:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/10/09

•

47 分钟
4月2日

Scaling Cyber at Fujitsu: Laura O'Neill on Strategy, Risk and Growth

Episode SummaryIn this episode of Secured, host Cole Cornford chats with Laura O'Neill from Fujitsu Cyber. Laura shares her journey from a pure maths and cryptography background through management consulting into the world of cybersecurity. She explains how she helped grow MF&A from a small team into a 70-person company before its acquisition by Fujitsu. Cole and Laura discuss the challenges of scaling a cyber practice, the importance of professionalising sales and board-level communications, and how embracing diverse, non-traditional talent can transform the industry. Their conversation offers valuable insights into shifting from a compliance-based mindset to a risk-based strategy that truly supports business objectives. Timestamps00:10 - Introduction to Laura O'Neill and her role at Fujitsu Cyber 02:27 - Laura recounts her journey from pure maths and cryptography to cybersecurity 05:31 - Discussing the rapid growth of MF&A from a small team to 70 staff 07:30 - Overcoming scaling challenges through improved processes and support 11:23 - Professionalising sales and board-level communications in cyber 15:30 - Moving from a compliance-driven approach to a risk-based strategy 26:16 - Embracing diversity and non-traditional hiring in cybersecurity 31:20 - The value of diverse backgrounds and soft skills in solving security challenges 40:43 - The importance of empathy and listening in leadership 42:16 - Closing thoughts on security as an enabling function for business success Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

4月2日

•

44 分钟
9月11日

Fix the Flag: Rethinking Secure Code Training with Pedram Hayati

Episode SummaryCTFs are fun, but do they actually make developers write more secure code? In this episode of Secured, Cole Cornford is joined by Pedram Hayati (Founder of SecDim & SecTalks) to explore why most developer security training fails, and how SecDim’s “Fix the Flag” approach is changing the game. From contrived WebGoat-style examples to frameworks that quietly eradicate entire bug classes, Cole and Pedram dive deep into the intersection of AppSec and software engineering. They unpack why developer experience is non-negotiable, why security needs to borrow design patterns from engineering, and how real-world incidents (like GitHub’s mass assignment bug or the Optus breach) make concepts stick far better than acronyms like “XSS” or “SSTI.” This is a technical, opinionated episode for anyone who’s ever struggled to get developers engaged with security. Timestamps01:10 – Why Pedram built SecDim, the problem with pen test reports, and why CTFs don’t train developers 04:42 – From “Capture the Flag” to “Fix the Flag”: making training realistic and Git-first 06:30 – Training inside developer workflows and why contrived examples fail 10:28 – Using modern stacks, AI-tailored labs, and real-world incidents to make concepts stick 12:35 – Why security names suck (XSS vs. “content injection”) and the Optus hack as a teaching moment 17:37 – Secure design patterns vs. vague slogans, and why secure defaults beat secure by design 21:15 – Frameworks like React, Rails, and Angular that kill entire bug classes 23:23 – Engineering by-products: reproducibility, immutability, and orthogonality in secure coding 30:36 – PHP’s bad reputation, language quirks, and what’s actually most popular in security training today 33:41 – Why AppSec pros need to build and deploy apps (not just know vulnerability classes) 37:44 – Getting started with SecDim and hands-on secure coding Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

9月11日

•

39 分钟
2024/05/22

Bruce Large discusses the importance of threat modelling in operational technology security

SummaryIn this episode of Secured, host Cole Cornford interviews Bruce Large, a security architect and evangelist at Secolve, the OT security specialists in Australia. They discuss the importance of threat modelling in operational technology systems and the need for engineers to consider the potential for cyber attacks. Bruce also shares insights from the ISA/IEC 62443 series of standards, which provides guidelines for secure system development in OT. Additionally, they touch on the significance of unions in the tech industry and the benefits of joining organisations like Professionals Australia. Tune in for a fascinating conversation on application security and more. Timestamps1:25 - Bruce's professional background 2:40 - Defining "engineer" in different contexts 6:20 - Differences between computer engineers and civil engineers 8:20 - Threat modeling 12:40 - How we treat safety in software vs other industries 18:30 - Bruce: we should be encouraging lifelong learning 24:00 - ISA/IEC 62443 safety standard 29:00 - The Year 2038 Problem 34:20 - Unions & industrial relations 43:40 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/05/22

•

49 分钟

These are W2D1 Media produced shows