• welcome

    Risky Biz Feature Podcast: An interview with Rob Joyce

    NSA Cybersecurity Director Rob Joyce joins the show...

    In this podcast we chat with Rob Joyce, the NSA’s Director of Cybersecurity.

    As many listeners would know Rob has a pretty interesting resume, having served as a special advisor on cybersecurity to US president Donald Trump, and, before that, leading Tailored Access Operations for NSA. More recently he served as the NSA liaison to Britain’s GCHQ, but he returned to the USA this year to take up his new post as the head of NSA’s defence-oriented Cybersecurity Directorate.

    And here’s the thing: Rob is a senior bureaucrat who is genuinely passionate about technology. His con talks are fantastic. He did one on how to make TAO’s life hard in 2016 that was really a blockbuster technical talk, and he’s even done a talk about how to engineer wildly over-the-top Christmas light displays.

    I’m telling you this to let you know that, well, Rob is a real, actual security geek. He’s the hacker-bureaucrat, if you will.

    Anyway, he generously made himself available to do this interview with us and we covered a bunch of stuff: The terrible state of enterprise security, cloud service providers being dumb with their defaults, the role of the intelligence community in combating ransomware and more. But we started off with some nuts and bolts discussion about what NSA’s cybersecurity directorate actually does. Enjoy!

    Risky Business #630 -- We tried the carrot, it's time for the stick

    How the US government could tackle awful enterprise product security...

    On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

    • REvil takes a vacation
    • Kaseya finally patches VSA
    • Morgan Stanley data exposed by third party Accellion hack
    • CISA issues emergency directive on MS print spooler bug
    • Patrick and Adam dream up ways for the US government to pressure vendors
    • MORE

    This week’s show is brought to you by Senetas. They’ve traditionally made layer 2 encryption gear but, as you’ll hear, they’re moving with the times! Senetas CTO Julian Fay joins us this week to talk through a bunch of stuff – what they’ve been working on, a really interesting project they had to abandon because of COVID and the latest news on the move to quantum-resistant crypto.

    Risky Business #629 -- Kaseya 0day was utter trash

    No, this REvil crew aren't the "apex predators" of the Internet...

    On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

    • Our take on the REvil attack against Kaseya customers
    • Microsoft’s print spooler bug is a real worry
    • Reports the RNC breached by Russia’s SVR
    • NSA snaps GRU brute forcing efforts
    • Much, much more

    This week’s show is brought to you by Material Security, a very interesting startup that has a completely different take on what email security actually is. Material’s co-founder Ryan Noon will be along in this week’s sponsor interview to talk about the cool stuff they’re doing on the analytics side.

    Risky Business #628 -- Microsoft is not your friend

    They put out the trash last Friday afternoon. It worked...

    On this week’s show Patrick Gray and Adam Boileau discuss recent security news, including:

    • Microsoft reluctantly and belatedly discloses breach
    • Chinese APT suspected of Air India breach
    • JBS paid $11m even though they successfully restored systems
    • cl0p money launderer arrests
    • Ransomware news roundup
    • The latest research and MORE

    This week’s show is brought to you by Greynoise. Its founder and CEO, Andrew Morris, joins us this week to talk through some of the work he’s been doing to extend Greynoise’s use cases. It’s a great chat, that one.

    Risky Biz Soap Box: EclecticIQ's CEO Joep Gommers on operationalising threat intelligence

    TIP maker set to push into EDR/XDR space with new release...

    Aaaaand we’re back on deck! We’re kicking things off this week with this interview with Joep Gommers, the CEO and founder of EclecticIQ. And FYI, in case you didn’t know, these Soap Box podcasts are wholly sponsored.

    If your job involves handling threat intel, then I think you’ll really enjoy this conversation. It touches on a bunch of stuff. The first part of this is talking through what EclecticIQ actually offers, currently, then we talk more broadly about operationalising threat intelligence, and finally we talk about EclecticIQ’s new stuff – which include introducing XDR tooling.

    Risky Biz Soap Box: Banks to embrace Yubikeys for customers

    A chat with Yubico's Chief Solutions Officer Jerrod Chong...

    As regular listeners know, the soap box podcasts we publish here at Risky.Biz are wholly sponsored. That means everyone you hear in one of these podcasts, paid to be here.

    And this edition of Soap Box has become an annual thing – it’s our once-yearly catch up with Jerrod Chong, the chief solutions officer of Yubico, makers of the Yubikey and YubiHSM.

    Yubikey is an infosec darling, really, because they’re in the unique position of having a product that’s popular with security professionals like CISOs while also being popular with security-conscious consumers. Businesses get value out of Yubikeys, but so do normal people, thanks to key support being baked into services like Facebook and Google.

    As you’re about to hear, there’s a whole new category of use about to open up – Bank of America is launching FIDO2 U2F support for its customers. That’s a big deal – the more FIDO2 keys we get out there the better.

    Risky Business #627 -- USG claws back Colonial pipeline ransom money

    PLUS: Use our crime app! It's great for planning crimes! No cops allowed!! Pinky swear!!

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • US Government claws back Colonial ransom bitcoin. We don’t think the FBI acted alone.
    • Meet an0m, the cute little app for planning crimes that drinks milkshakes.
    • Ransomware stuff, duh.
    • Trickbot developer arrested in Florida
    • Supreme court upends CFAA “exceed authorised access” element
    • Much, much more

    This week’s show is brought to you by Datadog. Michael Yamnitsky will be along in this week’s sponsor interview to talk about cloud security posture management. DataDog is launching a product in that space, so we’ll be hearing about the types of issues CSPM products can help to unearth.

    Risky Business #626 -- Russian ransomware beef simmers

    Ransomware attack threatens Australian, US meat supply...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • Ransomware attack threatens Australian and US beef supply
    • Talos dubs Russian ransomware crews “privateers”
    • NYTimes writes another bad story
    • More Fortinet pwnage
    • Belgian government rolls Hafnium IR and finds, well, something else
    • Google unveils new rowhammer techniques
    • Much, much more

    Haroon Meer of Thinkst Canary is this week’s sponsor guest. Thinkst is spinning up a labs division, but they’ll be doing something different to the same-old bug hunting. That’s a quality conversation.

    Risky Business #625 -- Iranians wipe some machines, Israelis kaboom some

    Payloads vary in Middle East cyber skirmishes...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • The latest news on the health system ransomware crisis in Ireland
    • TSA to force pipeline operators to disclose attacks they probably aren’t detecting anyway
    • Colonial paying ransom angers US congresspeople who really haven’t thought this through
    • Iran targets Israeli systems with new wipers
    • Israel targets Hamas systems with guided munitions that go bang
    • Much, much more

    This week’s sponsor guest is Ryan Kalember, EVP of Cybersecurity Strategy at Proofpoint. He joins us to talk about how compromised o365 accounts are powering all sorts of threat actors right now – from ransomware operators to BEC crews and APT units, everyone loves a popped mailbox.

    Risky Biz Feature Podcast: The politics of cybersecurity

    Has the Colonial incident made cybersecurity a "retail politics" issue?

    In this podcast we’ll be hearing from an Australian politician, Tim Watts. He’s a member of our federal parliament and serves as our shadow minister for communications and cybersecurity. For our overseas listeners, the “shadow” part of his title is there because he’s a member of the opposition party, so he’s not in government. But, of course, if the Labor party wins the next election he’ll be our communications and cybersecurity minister.

    Anyway, Tim is a bit of an anomaly in politics because he has a genuine, nerd-like interest in the field we so love. Tim and I chat pretty regularly, and I can say that yes, 100%, his interest in this field is genuine and he has a firm grasp on the issues that matter.

    I thought now would be a great time to run an interview on the politics of infosec. While it’s true that policymakers spend time thinking about this stuff, cybersecurity hasn’t yet crossed over into being what they call a “retail politics” issue. But thanks to the Colonial pipeline ransomware incident, that might be about to change.

    Risky Business #624 -- Ransomware farce continues

    Healthcare systems in Ireland, New Zealand among latest targets...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • The aftermath of the Colonial ransomware attack
    • Biden signs cybersecurity EO
    • DarkSide crew hounded off the Internet. For now.
    • Ransomware campaigns continue, hitting health, insurance targets globally
    • IIS PoC released
    • Rapid7 discloses Codecov-related source code breach
    • Much, much more

    This week’s show is brought to you by AttackIQ. Its VP of Product Mark Bagley and Senior Director of Cybersecurity Strategy and Policy Jonathan Reiber are this week’s sponsor guests.

    Risky Biz Snake Oilers: Google pitches BeyondCorp for Enterprise

    PLUS: Make Intune actually useable with Devicie and hear more about Trend Micro's XDR...

    As regular listeners would know, Snake OIlers is a wholly sponsored podcast series we do here at Risky Biz HQ where vendors give us money so they can come on and pitch their products to you, our dear, dear listeners.

    And we have three vendors along today to pitch you:

    • Google Cloud Security is in the top slot pitching their Zero Trust product suite BeyondCorp Zero Trust for Enterprise.

    • Devicie, an Australian startup, that developed a solution that makes Microsoft Intune useable.

    • Trend Micro joins the show to talk about its latest XDR features

    Risky Business #623 -- Ransomware threatens US energy security

    Chris Krebs joins the show to talk Colonial...

    On this week’s show Patrick Gray, Adam Boileau and Chris Krebs discuss the week’s security news, including:

    • An analysis of the Colonial pipeline ransomware attack
    • More ransomware news
    • UK and US expose APT29’s preferred exploits (again)
    • IntrusionTruth drops a new post
    • 128m Apple devices were hit by XCodeGhost
    • Much, much more

    This week’s sponsor interview is with Aaron Parecki, a Senior Security Architect at Okta. He’s also been a spec editor and member of the oath working group at IETF for nearly 11 years, so he knows a thing or two about OAuth. He’ll be joining me after the week’s news to talk through the latest OAuth guidance the IETF is going to release.

    Risky Business #622 -- GitHub weighs exploit ban

    PLUS: Should software ship with a "bill of behaviours"?

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • GitHub weighs banning exploits
    • Ransomware galore
    • Belgian government crippled in DDoS attack
    • Intrusion Truth Twitter account suspended
    • More Pulsesecure victims identified
    • Much, much more

    This week’s show is brought to you by ExtraHop networks, and they’ll pop along in this week’s sponsor interview to float a really, really good idea. The Biden administration EO on cybersecurity will mandate software is shipped with a so-called software bill of materials so customers will actually know what’s in their supply chain. Ben Higgins and Ted Driggs from Extrahop will join us today to argue they should also supply a bill of behaviours; data in a standardised form that will tell you things like what domains and IPs the software will connect to.

    Risky Business #621 -- Ultra professional criminal attackers ascendant

    Infosec's trajectory looks a bit depressing right now...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • USA imposes sanctions over SolarWinds campaign
    • Enterprise border devices being attacked everywhere by all and sundry
    • Malvertising is coming back
    • Ultra professional criminal attackers are ascendant
    • All the latest ransomware, supply chain and other infosec news

    This week’s sponsor interview is with Brian Dye, CEO of Corelight. We speak to him about what he’s calling “Open NDR”. A lot of the big SOCs have settled on their preferred ways of sharing threat information, and Brian drops by to talk all about those trends.

    Snake Oilers: Greynoise! MergeBase! Votiro!

    Turn down your SOC workload, get better SCA and block nasty macros...

    In this edition of Snake Oilers we’ll be hearing from three very different vendors who’ve all been doing interesting stuff.

    Greynoise: An infosec startup darling, Greynoise can tell you when an attack you’ve detected is internet-wide, automated activity. Very useful for de-prioritising entire alert sets.

    MergeBase: Software Composition Analisys (SCA) with two key differentiators. MergeBase says it gives users MUCH better remediation advice than competitors, and also offers a “in prod” dynamic SCA product that feeds Java app telemetry back to app/security teams. Very cool, and getting popular.

    Votiro: Regular listeners would know about CDR company Votiro. They’ve spent the last little while updating their product to better deal with macro-based threats. There’s some site-specific machine learning pixie dust as well as some more generic static detections and re-writes.

    Risky Business #620 -- Project Zero burns Western counterterrorism operation

    We're glad we don't have to make those sort of decisions at Risky Biz HQ...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • Ubiquiti insider blows whistle on breach
    • Cyber insurer ransomwared
    • Project Zero burned a Western counterterrorism operation
    • Australian parliament, media, politicians all under attack
    • Executive Order would require vendors to notify US government of incidents
    • Much, much more…

    This week’s sponsor guest is a special one. Metasploit creator and Rumble.run founder HD Moore will join us to talk all about his new venture, the Rumble asset discovery tool. It’s an absolutely fantastic interview, as you’d expect from HD.

    Risky Business #619 -- REvil crew demands $50m from Acer

    PLUS: Why we were wrong on Exchangapalooza '21...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • REvil demands US$50m from Acer in ransomware attack
    • Shell added to Accellion victim list
    • Governments banding together to tackle ransomware
    • BEC theft hits $1.8bn in 2021: FBI
    • Exchange tyre fire is, surprisingly, almost under control
    • MORE

    Remediant’s Paul Lanzi will pop along in this week’s sponsor interview to talk about how they’ve integrated their PAM solution with Carbon Black. It’s an integration that is actually somewhat obvious in hindsight: if a box has been popped then some accounts have, too, so tying these things together does make sense.

    Risky Biz Soap Box: 12 years since Operation Aurora. Have we learned anything?

    Okta's Marc Rogers talks about some uncomfortable truths...

    This is a wholly sponsored podcast brought to you by Okta.

    In this interview we chat with Marc Rogers, the executive director of Cybersecurity at Okta.

    The question that we’re exploring in this interview is whether or not we’ve managed to move the infosec needle since the Chinese government hacked Google back during the Operation Aurora attacks of 2009.

    Risky Business #618 -- MS security licensing faces congressional scrutiny

    US lawmakers baulk at Microsoft's "millions for basic security features" policy...

    On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including:

    • The latest on the Exchange tyre fire
    • Lawmakers in the USA have had enough of Microsoft’s ridiculous licensing tiers
    • White House mulls software security rating system
    • Joseph Cox’s SMS adventures
    • Things didn’t quite work out for APT6920 Arson Cats
    • Much, much more

    This week’s show is brought to you by VMRay. They asked us to interview one of their customers in this week’s sponsor segment so Brad Marr, the CISO of Life Fitness, pops in to walk through his VMRay use case.