20 episodes

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.

Risky Busines‪s‬ ITRadio.com.au

    • Technology
    • 4.7 • 290 Ratings

Risky Business is a weekly information security podcast featuring news and in-depth interviews with industry luminaries. Launched in February 2007, Risky Business is a must-listen digest for information security pros. With a running time of approximately 50-60 minutes, Risky Business is pacy; a security podcast without the waffle.

    Risky Business #615 -- Dependency confusion is, uh, pretty bad

    Risky Business #615 -- Dependency confusion is, uh, pretty bad

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:


    USA floats new sanctions against Russia
    TikTok, WeChat get stay of execution
    Dependency confusion is ugh
    US indicts Lazarus crypto-thieves
    France ties Sandworm crew to Centreon intrusion
    MORE


    This week’s show is brought to you by Thinkst Canary. Thinkst’s founder Haroon Meer is this week’s sponsor guest and he joins us to have a very Haroon-style conversation. We talk about how security controls and detections often fall over when things happen that take place outside of our assumptions: trojaned software updates, attackers hiding in unconventional places like monitors, things like that. That’s a great conversation.

    Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

    Risky Biz Feature Podcast: A primer on Microsoft cloud security

    Risky Biz Feature Podcast: A primer on Microsoft cloud security

    Recent attacks by SVR against US targets have mostly been written up under the moniker of the “SolarWinds campaign”. In our view, that’s inaccurate. The defining characteristic of this campaign wasn’t the SolarWinds supply chain stuff, it’s was the abuse of Microsoft cloud services.

    My understanding of how contemporary cloud services work isn’t actually as good as it should be. And that got me thinking – if my understanding isn’t that great, then there’s probably a lot of other people out there who don’t quite grok this stuff, particularly on the policy side. So, I set out to prepare a primer on Microsoft cloud security.

    Our guest in this podcast is Dirk-Jan Mollema. He works at Fox-IT in the Netherlands and is one of their core researchers on Azure AD and Active Directory Security. What you’re about to listen to, essentially, is me picking his brain so I can wrap my own head around this stuff. The hope is that some of you will learn along with me!

    Risky Business #614 -- So was it Florida Man or an Iranian APT?

    Risky Business #614 -- So was it Florida Man or an Iranian APT?

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:


    The latest on the attempted Florida water poisoning incident
    How to abuse Google Sync services for great victory
    Why Signal’s TLS proxies for Iranians are probably a bad idea
    OG username brokers targeted by social media legal army
    Much, much more


    This week’s sponsor interview is with Dan Guido of Trail of Bits. They’ve released an enterprise version of their iVerify tool. It’s a security tool for iOS (an Android version is in beta) that lets organisations monitor things like patch levels and passcode compliance without actually requiring the installation of MDM profiles. It’s an enterprise mobile security tool for orgs that don’t need or want full MDM.

    Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

    Risky Business #613 -- It's time to check your Accellion logs

    Risky Business #613 -- It's time to check your Accellion logs

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:


    Emotet is… gone?
    Accellion FTAs were owned everywhere, not just in ANZ
    US courts air-gap sensitive filings in wake of Holiday Bear attacks
    iOS 14 brings iMessage security improvements
    Much, much more


    Proofpoint’s Sherrod DeGrippo is this week’s sponsor guest. She joins the show to talk about Emotet’s demise, Trickbot’s survival, BEC, ransomware and more.

    Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

    Risky Biz Soap Box: Email is a target, not just a vector

    Risky Biz Soap Box: Email is a target, not just a vector

    These Soap Box editions of the show are wholly sponsored, which means everyone you hear in one of these editions, paid to be here.

    This edition of the show is brought to you by Material Security. Basically what they do is lock up your cloud-based email. They use Google and Microsoft’s APIs to redact sensitive information from your mail spool – or even redact entire messages from your spool, like, say, anything over a month old – and then kick you up to an auth challenge when you want to access that mail.

    It’s a product that recognises that email isn’t just a vector – often it’s an attacker’s target.

    Risky Business #612 -- DPRK slides into researcher DMs

    Risky Business #612 -- DPRK slides into researcher DMs

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:


    DPRK offers free 0day to researchers, with a pretty significant catch
    SonicWall gets owned because it runs SonicWall gear. Big mistake.
    Chinese trains didn’t stop running because Flash died :(
    Dominion to sue Rudy Giuliani for $1.3bn over insecurity claims
    The sudo bug. Lol.


    This week’s show is brought to you by Cmd Security, the Linux security company. Its focus has traditionally been on restricting the type of bash commands users can enter. It’s like a control plane for Linux systems. But some of its customers manage their Linux endpoints through different, non-bash entry points. So they’ve added some features to their product to deal with that, which has also resulted in them having an IDR capability. It’s all pretty sensible stuff though, and Cmd co-founder and CEO Jake King will be along to talk us through all of that.

    Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing.

Customer Reviews

4.7 out of 5
290 Ratings

290 Ratings

Rudy Guiliani 420 ,

Bless

Informative and entertaining.

This-is-my-podcast-review ,

Best Cyersecurity Podcast Out There

These charming hosts give you in depth and thoughtful coverage of the latest in cyber news. If you only choose one cyber security podcast, this is the one to pick!!

JoshCrist ,

Empowering, education and actionable! 👏

Whether you’re well established as a cyber security innovator, or just getting started carving out your role as a change agent within your organization - this is a must-listen podcast for you! Patrick and Adam do an incredible job leading conversations that cover a huge breadth of topics related to the ins and outs of navigating an ever changing data security and compliance environment. Highly recommend listening and subscribing!

Top Podcasts In Technology

Listeners Also Subscribed To