200 episodes

Defensive Security is a weekly information security podcast which reviews recent high profile security breaches, data breaches, malware infections and intrusions to identify lessons that we can learn and apply to the organizations we protect.

Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec Jerry Bell and Andrew Kalat

    • Technology
    • 4.7 • 352 Ratings

Defensive Security is a weekly information security podcast which reviews recent high profile security breaches, data breaches, malware infections and intrusions to identify lessons that we can learn and apply to the organizations we protect.

    Defensive Security Podcast Episode 272

    Defensive Security Podcast Episode 272

    Links:

    https://www.darkreading.com/cybersecurity-operations/a-cisos-guide-to-avoiding-jail-after-a-breach

    https://www.csoonline.com/article/2512955/us-supreme-court-ruling-will-likely-cause-cyber-regulation-chaos.html/

    https://sansec.io/research/polyfill-supply-chain-attack

    https://www.securityweek.com/over-380k-hosts-still-referencing-malicious-polyfill-domain-censys/

    https://www.tenable.com/blog/how-the-regresshion-vulnerability-could-impact-your-cloud-environment

     

    Transcript

    ===

    [00:00:00]

    jerry: All right. Here we go. Today is Sunday, July 7th, 2024, and this is episode 272 of the defensive security podcast. My name is Jerry Bell and joining me tonight as always is Mr. Andrew Kalat.

    Andrew: Good evening, Jerry. This is a newly reestablished record twice in a week or

    jerry: twice in a week. I can’t believe it.

    Andrew: I know. Awesome. Yeah. You just had to, quit that crappy job of yours that provided income for your family and pets and you know everything else but now that you’re unemployed house But now that you’re an unemployed bum.

    jerry: Yeah, I can podcast all I want 24 7 I think i’m gonna become an influencer like i’m gonna just be live all the time now

    Andrew: you could I really I look forward to you asking me to subscribe and hit that notify button.

    jerry: That’s right. Hit that subscribe button

    Andrew: Like leave a rating and a comment

    jerry: like and subscribe All [00:01:00] right getting with the program we’re we’re getting back into our normal rhythm. As per normal, we’ve got a couple of stories to talk about. The first one comes from Dark Rating and the title is, A CISO’s Guide to Avoiding Jail After a Breach.

    Andrew: Before we get there.

    Andrew: I want to throw out the disclaimer that thoughts and opinions do not reflect any of our employers, past, present, or future.

    jerry: That’s a great point. Or, my cats.

    Andrew: Unlike you, I have to worry about getting fired.

    jerry: I still have a boss. She can fire me.

    Andrew: That’s called divorce, sir. But true.

    jerry: Yeah.

    Andrew: Anyway, back to your story.

    jerry: Anyway, yeah. CISO’s Guide to Avoiding Jail After a Breach. So this is this is following on a upcoming talk at, I think it’s Black Hat talking about how CISOs can try to insulate themselves from the [00:02:00] potential legal harms or legal perils that can arise as a result of their jobs. It’ll be interesting to see what’s actually in that talk, because the article itself, in my estimation, despite what the title says, doesn’t actually give you a lot of actionable information on, How to avoid jail. They do they do a quote Mr. Sullivan, who was the CISO for Uber.

    jerry: And they give a little bit of background and how it’s interesting that he he is, now a convicted felon. Although I think that’s still working its way through the the appeals process. Though he previously was appointed to a cybersecurity board by president Obama.

    jerry: And before that he was a federal prosecutor. And in fact, as the article points out, he was one of the process, he was the prosecutor who prosecuted the first DMCA case, which I thought was quite interesting. You didn’t know that about him,

    • 51 min
    Defensive Security Podcast Episode 271

    Defensive Security Podcast Episode 271

    • 56 min
    Defensive Security Podcast Episode 270

    Defensive Security Podcast Episode 270

    • 46 min
    Defensive Security Podcast Episode 269

    Defensive Security Podcast Episode 269

    https://www.bleepingcomputer.com/news/security/cosmicstrand-uefi-malware-found-in-gigabyte-asus-motherboards/

    https://www.bleepingcomputer.com/news/security/hackers-scan-for-vulnerabilities-within-15-minutes-of-disclosure/

    https://www.techcircle.in/2022/07/31/paytm-mall-refutes-cyber-breach-report-says-users-data-safe

    • 21 min
    Defensive Security Podcast Episode 268

    Defensive Security Podcast Episode 268

     

    Stories:

    https://www.scmagazine.com/feature/incident-response/why-solarwinds-just-may-be-one-of-the-most-secure-software-companies-in-the-tech-universe

    https://www.computerweekly.com/news/252522789/Log4Shell-on-its-way-to-becoming-endemic

    https://www.bleepingcomputer.com/news/security/hackers-impersonate-cybersecurity-firms-in-callback-phishing-attacks/

    https://www.cybersecuritydive.com/news/microsoft-rollback-macro-blocking-office/627004/

    jerry: [00:00:00] All right, here we go today. Sunday, July 17th. 2022. And this is episode 268. Of the defensive security podcast. My name is Jerry Bell and joining me tonight as always is Mr. Andrew Kellett.

    Andy: Hello, Jerry. How are you, sir?

    jerry: great. How are you doing?

    Andy: I’m doing good. I see nobody else can see it, but I see this amazing background that you’ve done with your studio and all sorts of cool pictures. Did you take those.

    jerry: I It did not take those. They are straight off Amazon actually. It’s.

    jerry: I’ll have to post the picture at some [00:01:00] point, but the pictures are actually sound absorbing panels.

    Andy: Wow. I there’s jokes. I’m not going to make them, but anyway, I’m doing great. Good to see ya..

    jerry: Awesome. Just a reminder that the thoughts and opinions we express on the show are ours and do not represent those of our employers. But as you are apt to point out, they could be for the right price.

    Andy: That’s true. That’s true. And that, and by the way, what that really means is you’re not going to change our opinions. You’re just going to to hire them.

    jerry: Correct. right. Sponsor our existing opinions.

    Andy: Someday that’ll work.

    jerry: All right. So we have some interesting stories today. The first one comes from SC magazine dot com. The title is why solar winds just might be one of the most secure software companies. In the tech universe.

    Andy: It’s a pretty interesting one. I went into this a little.

    Andy: Cynical. But there’s a lot of [00:02:00] really interesting stuff in here.

    jerry: Yeah there, there is, I think

    jerry: What I found interesting. A couple of things. One is very obvious. That this is a. Planted attempt to get back into the good graces of the it world. But at the same time, It is very clear that they have made some pretty significant improvements in their security posture. And I think for that, it deserves a.

    jerry: A discussion.

    Andy: Yeah, not only improvements, but they’re also.

    Andy: Having these strong appearance of transparency and sharing lessons learned. Which we appreciate.

    jerry: Correct. The one thing that I so we’ll get into it a little bit, but they still don’t really tell you. How. The thing happened.

    Andy: Aliens.

    jerry: Obviously it was aliens. They did tell you what happened. And so in the. Article here they describe this the [00:03:00] CISO of solar winds describes that the attack didn’t actually. Change their code base. So the attack wasn’t against their code repository. It was actually against one of their build systems.

    jerry: And so they were the adversary here. Was injecting code. At build time, basically. So it wasn’t something that they could detect through code reviews. It was actually being added as part of the build proc...

    • 32 min
    Defensive Security Podcast Episode 267

    Defensive Security Podcast Episode 267

    Defensive Security Podcast Episode 267

     

    Links:

    https://www.justice.gov/opa/pr/aerojet-rocketdyne-agrees-pay-9-million-resolve-false-claims-act-allegations-cybersecurity

    https://us-cert.cisa.gov/ncas/alerts/aa22-187a

    https://www.zdnet.com/article/these-are-the-cybersecurity-threats-of-tomorrow-that-you-should-be-thinking-about-today/

    jerry: [00:00:00] Alright, here we go. Today is Sunday, July 10th, 2022. And this is episode 267 of the defensive security podcast. My name is Jerry Bell and joining me tonight as always. Is Mr. Andrew Kellett.

    Andy: Good evening, Jerry, how are you? Good, sir.

    jerry: I’m doing great. How are you doing?

    Andy: I’m good man. It’s hot and steamy in Atlanta. Tell you that much.

    jerry: Yeah. I ‘ve been back for a month from my beach place. And I think today’s the first day that we’ve not had a heat advisory. [00:01:00]

    Andy: Yeah, that’s crazy.

    jerry: which it has been brutally hot here.

    Andy: Now, when you say beach place, you might have to be more specific, cause you’ve got one like seven beach houses now.

    jerry: Well, the Southern most beach house. Yes.

    Andy: Yeah. One is the Chateau. One’s technically a compound.

    jerry: One’s an island,

    Andy: that’s.

    Andy: We’re going to have to probably name them because. They’re tough to keep straight.

    jerry: They definitely are. Yup.

    Andy: But, I, for one. Appreciate your new land barronness activities. And look forward to.

    Andy: Jerry Landia being launched and seceding from the United States.

    jerry: Hell. Yeah. That’s right.

    Andy: I’ll start applying for citizenship whenever I can.

    jerry: Good plan. Good plan. All right. A reminder. We should probably already said this, but the thoughts and opinions we expressed on the show are ours and do not represent those of our employers.

    Andy: But for enough money, they could

    jerry: yeah. Everything is negotiable. [00:02:00] All right. Couple of really interesting stories crossed my desk. Recently and the first one comes from the US department of justice of all places. And the title here is Aerojet , Rocketdyne agrees to pay $9 million to resolve false claims act allegations.

    jerry: Of cybersecurity violations in federal government contracts. So the story here is that there’s this act, as you could probably tell by the title called the false claims act that permits an employee of a company who specifically does business with the US government to Sue the company under the false claims act claiming that the company is misrepresenting itself in the execution of its contracts. And if that [00:03:00] lawsuit is successful, the person making the allegation, basically it’s a whistleblower kind of arrangement. The person making the allegation gets a cut of the settlement. And so in this particular case the whistleblower received $2.61 million dollars of the $9 million.

    Andy: Wow. So his company. In theory was lying on their security controls. And he found out about it or knew about it. And was a whistleblower. About it is getting 2.61 million.

    jerry: Correct. Correct.

    Andy: Have to go check everything in my company. I’ll be right back.

    jerry: I’m guessing that his lawyers will probably take about 2 million of the 2.61, but, Hey, it’s still.

    jerry: still. money, right?

    Andy: That’s crazy. It reminds me, it’s probably a lot of our listeners are too young for this, but.

    • 35 min

Customer Reviews

4.7 out of 5
352 Ratings

352 Ratings

mcox00941 ,

Welcome back!

We’ve missed you.

Hedonistic Heretic ,

Topical, primarily informative, just enough entertainment

Security professionals discussing select important and informed topics.

The hosts recently cut back on episode frequency, which is a shame but understandable. I appreciate all of the content and the silly jokes+sarcasm.

LisaIsHereForIt ,

Best podcast on defensive security! 🙌

No matter the topic, you’re guaranteed to gain something from every episode - can’t recommend Defensive Security Podcast enough.

Top Podcasts In Technology

Acquired
Ben Gilbert and David Rosenthal
All-In with Chamath, Jason, Sacks & Friedberg
All-In Podcast, LLC
Lex Fridman Podcast
Lex Fridman
Hard Fork
The New York Times
Search Engine
PJ Vogt, Audacy, Jigsaw
The Ben & Marc Show
Marc Andreessen, Ben Horowitz

You Might Also Like

Cyber Security Headlines
CISO Series
Cybersecurity Today
ITWC
CyberWire Daily
N2K Networks
SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
Johannes B. Ullrich
Defense in Depth
David Spark
Malicious Life
Malicious Life