Security Serengeti

David Schwendinger and Matthew Keener
  • 5.0 (1)
  • TECHNOLOGY
  • UPDATED WEEKLY

A news analysis focused information security podcast dedicated to getting you the actionable information and analysis you need to improve your company's posture and response!

  1. SS-NEWS-154 - Salt Typhoon and MS MFA Brute Forcing

    12/16/2024

    SS-NEWS-154 - Salt Typhoon and MS MFA Brute Forcing

    This week we discuss Salt Typhoon and the terrible idea of backdoors (and I mis-remember the backdoor discussion in 2008 - encryption vs. telcos!) and the Microsoft MFA brute forcing.   Article 1 - Salt Typhoon forces FCC's hand on making telcos secure their networks Supporting Articles: China's Salt Typhoon recorded top American officials' calls, says White House US alleges China hacked calls of 'very senior' political figures, official says US lawmakers seek answers on alleged Salt Typhoon breach of telecom giants Wyden legislation would mandate FCC cybersecurity rules for telecoms Wiretap Telecom Article 2 - Microsoft MFA AuthQuake Flaw Enabled Unlimited Brute-Force Attempts Without Alerts If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    43 min
  2. SS-NEWS-153 - Lawyers will Inherit Cyber

    11/18/2024

    SS-NEWS-153 - Lawyers will Inherit Cyber

    This week we discuss an academic paper through Venture in Security talking about how companies will rely more and more on legal reasoning and decision making vs. technical reasoning and decision making, and we quickly hit on ATT&CK v16. Article 1 - Venture in Security Response - Blessed are the lawyers, for they shall inherit cybersecurity Supporting Articles: Original Paper - Blessed Are The Lawyers, For They Shall Inherit Cybersecurity Article 2 - V16 Brings (Re)Balance: Restructured Cloud, New Analytics, and More Cybercriminals If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    46 min
  3. SS-DISC-152 - Detection Engineering Behavior Maturity Model

    11/04/2024

    SS-DISC-152 - Detection Engineering Behavior Maturity Model

    Today we discuss the Detection Engineering Behavior Maturity Model, which is a new Capability Maturity Model for Detection Engineering (surprise!) from Elastic.  It seems a little overly complicated to me (M.) but super useful despite that! Article that we originally saw  Direct link to Elastic Blog Post If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    41 min
  4. SS-NEWS-151: AI Companions Hacked

    10/21/2024

    SS-NEWS-151: AI Companions Hacked

    This week we discuss an attempted kidnapping and ransom of the parents of someone connected to a multi million dollar theft, stolen prompts and responses from Muah.ai's "companions", and how much attention should be paying low severity alerts? Article 1 - Lamborghini Carjackers Lured by $243M Cyberheist Article 2 - AI girlfriend site breached, user fantasies stolen Article 3 - Have you been keeping up with your low confidence detections? If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    37 min
  5. SS-NEWS-150 - T-Mobile Consent Decree and Kia Hacking

    10/07/2024

    SS-NEWS-150 - T-Mobile Consent Decree and Kia Hacking

    Does the T-Mobile Consent Decree mean that the government is going to get more involved in breaches?  Additionally, Kia closes a gap in it's dealership API which allowed researchers to geolocate and lock/unlock cars.  Finally, we briefly discuss a new method attackers are monetizing AWS credentials... it's not pretty. Article 1 -  T-Mobile US to cough up $31.5M after that long string of security SNAFUs Supporting Articles: The Cost of Doing Business T-Mobile hit with $60M fine over data security violations T-Mobile to take $400M hit from hacking settlement T-Mobile Consent Decree Article 2 - Hacking Kia: Remotely Controlling Cars With Just a License Plate Supporting Articles: Plate to VIN Car Companies Know When You Speed. Then They Sell That Data Article 3 - A Single Cloud Compromise Can Feed an Army of AI Sex Bots If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    49 min
  6. SS-DISC-149 - Does the Security Job Gap Exist?

    09/23/2024

    SS-DISC-149 - Does the Security Job Gap Exist?

    Spoiler alert - Not in the way the mass media is discussing it, and it's doing a disservice to aspiring security analysts and engineers. Supporting Articles: Packed. Crowded. Bursting. Crammed. Glutted. Jammed. Teeming. Saturated. Chock-full. Jam-packed. Brimming. Overflowing. Fungible Tokens Let’s get real: there is no such thing as “gatekeeping” in cybersecurity The ghost jobs haunting your career search Are We Now Living in a Parasite Culture? Is there really an information security jobs crisis? Defensive Security Podcast Episode 279 Global cybersecurity workforce growth flatlines, stalling at 5.5M pros If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    35 min
  7. SS-RPRT-148: Picus Blue Report 2024

    09/09/2024

    SS-RPRT-148: Picus Blue Report 2024

    This week, David and I review the 2024 Picus Blue Report, in a more timely fashion than the last one.  As always, interesting insights. Link to Report If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    55 min
  8. SS-NEWS-147 - Does Phishing Education need to mature like Fire Drills did?

    07/29/2024

    SS-NEWS-147 - Does Phishing Education need to mature like Fire Drills did?

    This week David and I talk about how current phishing tests closely resemble early attempts at fire drills, through the Google Security Blog, and then we discuss a Schneier post about what the recent CS failure says about the resiliency of the internet. Article 1 - On Fire Drills and Phishing Tests Article 2 - The CrowdStrike Outage and Market-Driven Brittleness If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

    49 min
See All (25)

About

A news analysis focused information security podcast dedicated to getting you the actionable information and analysis you need to improve your company's posture and response!

Information

  • Creator
    David Schwendinger and Matthew Keener
  • Years Active
    2021 - 2024
  • Episodes
    25
  • Rating
    Explicit
  • Copyright
    © 2021
  • Show Website
    Security Serengeti