The O'Reilly Security Podcast examines the challenges and opportunities for security practitioners, with a focus on the people on the frontlines of security, working to build better defenses.

O'Reilly Security Podcast

Knowledge

Security

O'REILLY

This week, O'Reilly Radar editor Jenn Webb caught up with Mike Belshe, CTO and co-founder of BitGo, a company that has developed a multi-signature wallet that works with bitcoin. Belshe talks about about the security issues addressed by multi-signature wallets, how the technology works, and the challenges in bringing cryptocurrencies mainstream. We also talk about his journey into the bitcoin world, and he chimes in on what money will look like in the future.

Security Comes From Evolution, Not Revolution

In this episode, I talk with Meredith Patterson, a software engineer and leader of the Langsec Conspiracy. We discuss the origins of LangSec, rigidity versus robustness, and game theory as it applies to organizational approaches to security.

Meredith Patterson on Using Language to Build Trustworthy Systems

In this episode of the O’Reilly podcast, I talk with Nathan Moore, CDN architect at StackPath. We discuss intelligent caching, building secure CDN solutions, and the future of front end security and performance.

Achieving Security and Speed

In this special episode of the Security Podcast, O’Reilly’s Ben Lorica talks with Parvez Ahammad, who leads the data science and machine learning efforts at Instart Logic. He has applied machine learning in a variety of domains, most recently to computational neuroscience and security. Lorica and Ahammad discuss the challenges of using machine learning in information security.

Parvez Ahammad on Applying Machine Learning to Security

In this episode, I talk with Amanda Berlin, security architect at Hurricane Labs. We discuss how to assess and develop defensive security policies when you’re new to the task, how to approach core security fundamentals like asset management, and generally how you can successfully improve your organization’s defensive security with limited time and resources.

Amanda Berlin on Defensive Security Fundamentals

In this episode of the Security Podcast, I talk with Andrea Limbago, chief social scientist at Endgame. We discuss how the misperception of security as a computer science skillset ultimately restricts innovation, the need to make security easier and accessible for everyone, and how current branding of security can discourage newcomers.

Andrea Limbago on the Effects of Security's Branding Problem

In this episode of the Security Podcast, I talk with Charles Givre, senior lead data scientist at Orbital Insight. We discuss how data science skills are increasingly important for security professionals, the critical role of data scientists in making the results of their work accessible to even nontechnical stakeholders, and using machine learning as a dynamic filter for vast amounts of data.

Charles Givre on the Impetus for Training All Security Teams in Basic Data Science

In this episode of the Security Podcast, O’Reilly’s Mac Slocum talks with Susan Sons, senior systems analyst for the Center for Applied Cybersecurity Research (CACR) at Indiana University. They discuss how she initially got involved with fixing the open source Network Time Protocol (NTP) project, recruiting and training new people to help maintain open source projects like NTP, and how security needn’t be an impediment to organizations moving quickly.

Susan Sons on Building Security from First Principles

In this episode of the Security Podcast, I talk with Christie Terrill, partner at Bishop Fox. We discuss the importance of educating businesses on the complexities of “being secure,” how to approach building a strong security program, and aligning security goals with the larger processes and goals of the business.

Christie Terrill on Building a High-Caliber Security Program in 90 Days

In this episode of the Security Podcast, I talk with Rich Smith, director of labs at Duo Labs, the research arm of Duo Security. We discuss the goals of agile application security, how to reframe success for security teams, and the short- and long-term implications of your security culture.

Rich Smith on Redefining Success for Security Teams and Managing Security Culture

In this episode of the Data Show, I spoke with Fabian Yamaguchi, chief scientist at ShiftLeft. His 2015 Ph.D. dissertation sketched out how the combination of static analysis, graph mining, and machine learning, can be used to develop tools to augment security analysts. In a recent post, I argued for machine learning tools to augment teams responsible for deploying and managing models in production (machine learning engineers). These are part of a general trend of using machine learning to develop and manage the software systems of tomorrow. Yamaguchi’s work is step one in this direction: using machine learning to reduce the number of security vulnerabilities in complex software products.

How Machine Learning Can Be Used to Write More Secure Computer Programs

In this episode of the Data Show, I spoke with Mark Hammond, founder and CEO of Bonsai, a startup at the forefront of developing AI systems in industrial settings. While many articles have been written about developments in computer vision, speech recognition, and autonomous vehicles, I’m particularly excited about near-term applications of AI to manufacturing, robotics, and industrial automation. In a recent post, I outlined practical applications of reinforcement learning (RL)—a type of machine learning now being used in AI systems. In particular, I described how companies like Bonsai are applying RL to manufacturing and industrial automation. As researchers explore new approaches for solving RL problems, I expect many of the first applications to be in industrial automation.

Machine Learning Needs Machine Teaching

In this episode of the Data Show, I spoke with Leo Meyerovich, co-founder and CEO of Graphistry. Graphs have always been part of the big data revolution (think of the large graphs generated by the early social media startups). In recent months, I’ve come across companies releasing and using new tools for creating, storing, and (most importantly) analyzing large graphs. There are many problems and use cases that lend themselves naturally to graphs, and recent advances in hardware and software building blocks have made large-scale analytics possible.

Starting with his work as a graduate student at UC Berkeley, Meyerovich has pioneered the combination of hardware and software acceleration to create truly interactive environments for visualizing large amounts of data. Graphistry has built a suite of tools that enables analysts to wade through large data sets and investigate business and security incidents. The company is currently focused on the security domain—where it turns out that graph representations of data are things security analysts are quite familiar with.

Graphs as the Front End for Machine Learning

Jon Bruner and Mike Loukides talk about the classical music publishing industry and how it's being disrupted by projects like the Petrucci Music Library (http://imslp.org/) that make public-domain scores available online.

The future of classical music

Jim Stogdill, Edd Dumbill and Roger Magoulas have a conversation about in-memory databases and the impact on real time analysis. Leave questions and comments for us at http://radar.oreilly.com/2013/05/talking-about-in-memory.html

Talking about in-memory

Jon Bruner, Mike Loukides and Jim Stogdill from O'Reilly Radar muse on the return of software to the physical world.

Software and the physical world

Jon Bruner, Jim Stogdill, and Roger Magoulas talk about anthropology in big data, advances in JavaScript, searching for ancient civilizations, the importance of context, and good sites for checking the weather.

Related blog post: http://radar.oreilly.com/2013/06/radar-podcast-anthropology-big-data-and-the-importance-of-context.html

Anthropology, big data, and the importance of context

Jon Bruner, Jim Stogdill, and Roger Magoulas talk about what's been on their minds this week: the NSA's surveillance programs, what defense contractors will do with their technology as defense budgets dry up, and a Californian who isn't doing what you think he's doing with hydroponics.

For more on these topics, and links to the things we talked about, see http://radar.oreilly.com/2013/06/radar-podcast-the-internet-of-things-prism-and-defense-technology-that-goes-civilian.html.

The Internet of Things, PRISM, and defense technology that goes civilian

O'Reilly Media spreads the knowledge of innovators. At O’Reilly, a big part of our business is paying attention to what’s new and interesting in the world of technology. We have a pretty good record at having anticipated some of the big technology developments in recent history. For instance, we launched the first commercial Web site, GNN, in 1993; we organized the meeting at which the term “open source” was first adopted; we were early investors in Blogger, which helped launch the blogging revolution; and more recently, our Web 2.0 conference launched a world-wide meme. We call this predictive sense the “O’Reilly Radar.” And while we’re certainly not always right, we are, at least, good at making interesting guesses.

Our methodology is simple: we draw from the wisdom of the alpha geeks in our midst, paying attention to what’s interesting to them, amplifying these weak signals, and seeing where they fit into the innovation ecology. Add to that the original research conducted by our Research team, and you start to get a good picture of what the technology world is thinking about.