security_podcasts

The SANS SANS Top 20 Critical Security Controls are an industry and (for the most part) vendor neutral set of controls that organizations are encouraged to implement to ensure they are cognizant of security issues and can respond accordingly. This episode deals exclusively with the first 4 controls in-depth, so to not overwhelm listeners with what is shaping up to be a nearly 3 hour podcast.

If you want to discuss how Advanced Persistent Security can help you implement the SANS Top 20 Critical Security Controls, please contact Advanced Persistent Security Sales.

Content

This week, we begin to discuss the SANS Top 20 Critical Security Controls, this week we cover the following 4 Controls:
SANS Top 20 Critical Security Controls, #1: Inventory of Authorized and Unauthorized Devices
SANS Top 20 Critical Security Controls, #2: Inventory of Authorized and Unauthorized Software
SANS Top 20 Critical Security Controls, #3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
SANS Top 20 Critical Security Controls, #4: Continuous Vulnerability Assessment and Remediation
The Center for Internet Security Benchmarks Program
The NIST National Checklist Program

DISCLAIMER: Aside from receiving training from SANS and holding a certification from their partner organization, GIAC, neither Advanced Persistent Security nor myself, Joe Gray are affiliated with SANS. This podcast is authorized via SANS open use clause and is not officially authorized by SANS. There is no compensation to Advanced Persistent Security nor myself, Joe Gray for doing this podcast. The purpose is to increase awareness using open frameworks.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Advanced Persistent Security's tracks - SANS Top 20: 1-4 (made with Spreaker)

This week on Security Weekly, we are joined by none other than Larry Pesce. After his recent DerbyCon talk, Larry gives us some insight on his 600 dollar password cracking machine.

Today in news, Kevin recaps the T-Mobile breach. Do we now let the fox watch the henhouse? Larry dives into a Nest (TM) of IoT (drink) devices. Paul tries to keep it together with a blog post on MS08-067.

For a full list of stories and links, visit our wiki: http://wiki.securityweekly.com/wiki/index.php/Episode435#Stories_of_the_Week_-_7:00PM-8:00PM
Security Weekly website: http://securityweekly.com
Follow us on Twitter: @securityweekly

Paul's Security Weekly #435 - Password Cracking with Larry

MIT CSAIL's Howard Shrobe, Director of the Cybersecurity@CSAIL initiative, discusses what led him to become involved in the industry of Cybersecurity, his experience with DARPA, and creating the cybersecurity programs of CRASH and MRC. Additionally, he shares insights as to the biggest challenges in cybersecurity today and how these challenges effect the development of the Internet of Things.

Cybersecurity Challenges and How They Impact IOT

Cybersecurity is a cat-and-mouse game where the mouse always has long had the upper hand because it’s so easy for new malware to go undetected. Dr. Eli David, an expert in computational intelligence and CTO of Deep Instinct, wants to use AI to change that, bringing the GPU-powered deep learning techniques underpinning modern speech and image recognition to the vexing world of cybersecurity.

Ep. 9: Winning the Cybersecurity Cat and Mouse Game with AI

Hackers are in high demand by companies to help strengthen their security, but there's currently a shortage of talent. CyLab director David Brumley argues that the problem is that society at-large does not fully understand what hacking means. 

In this episode, we'll hear from four members of CMU's top internationally ranked hacking team, the Plaid Parliament of Pwning, about how they got into hacking, and why.

A glimpse into the hacker psyche

What exactly happened? And how can you best protect yourself? Get answers to these questions and more as Lance Spitzner, Director at SANS Securing the Human, weighs in on the data breach affecting 143 million Equifax users

Equifax Breach

People, process, and technology. It’s an interlocked trio that’s vital to most organizations today. And when there’s a shift in security operations or strategy, all three will feel the jolt. In this episode, we’ll be talking with two guest speakers who draw on their firsthand experiences to share must-do and avoid-at-all-costs security operations and strategy advice.

Some of the topics that we’ll cover include:
•Skills that are most needed for today’s security operations and analyst roles
•Differentiating between product security and IT security
•How to adapt security operations and architecture for public cloud deployments

Security Operations and Strategy

Ben chats with Chris Barnes about the importance of cybersecurity for small to mid-sized business. Chris talks about his SMB advisory practice, threat landscape for SMB’s, ways to build an effective program with few to no resources, and the importance of a trusted advisor when building a program. During Overrated/Underrated, we get his take on security vulnerabilities with Amazon Alexa/Google Home and building backdoors into applications.

Chris Barnes shares everything you need to know about cybersecurity for SMB’s

It’s never good news when potential security exploits are detected. But when they affect all personal computers, mobile devices and cloud infrastructure dating back to 1995, it creates a problem of a whole new magnitude. In this episode, we’ll be talking with Paul Kocher, the researcher credited with co-discovering Spectre and a co-author of the Meltdown research paper.

Some of the topics that we cover include:

•How did these vulnerabilities happen, and why were they not detected sooner?
•Did the rush to bring technology to market play a role in allowing these exploits to slip through the cracks?
•What are the main concerns to look out for—both as an individual and as a CISO?

Spectre And Meltdown

This week, we discuss further problems caused by patches for the Meltdown and Spectre vulnerabilities, a text bomb that crashes Apple devices and the World Economic Forum's Global Risks Report 2018.

19 January Weekly podcast: Meltdown and Spectre SCADA problems, Apple text bomb and WEF cyber risks

Σε αυτό το επεισόδιο μαζί μας ο Βασίλης Κεμερλής https://cs.brown.edu/~vpk/, ερευνητής σε θέματα ασφάλειας και assistant professor at Brown University. Ο Βασίλης έχει τεράστια εμπειρία σε θέματα penetration & hardening σε ακαδημαικό επίπεδο αλλά και στη βιομηχανία με θητεία σε εταιρίες όπως Oracle & Microsoft. Συζητάμε μαζί για τους βασικούς ορισμούς της ασφάλειας και ξεκινάμε από social engineering, πρωτόκολα, κρυπτογραφία μέχρι τα κενά ασφάλειας Spectre & Meltdown και την κυβερνοασφάλεια σε επίπεδο στρατού.

Episode 11: Cybersecurity from CPU architecture to network protocols and warfare

What am I working on?
What can go wrong?
What am I going to do about it?
Did I do a good job?

These are the four questions at the heart of threat modeling In this episode, I speak with Adam Shostack, author of Threat Modeling: Designing for Security. We talk through how to begin threat modeling and the expectations of using modeling. Adam walks through the history of threat modeling, including his creation of the Elevation of Privilege game.

security_podcasts

Aditya Srivastava 2