DevSecOps

cool

security_podcasts

The Sun II. The new single from our debut album, Sleep in the Water. 

Our new EP 'THE SUN II' is out now. 
1. The Sun II 
2. East Of Here
3. The Sun II (Just Kiddin Remix) 
4. Fall Underneath (Hayden James Remix)
5. Hung On Tight (Fractures Remix)
6. Fall Underneath (Kilter Remix)
Buy: https://itunes.apple.com/au/album/the-sun-ii-ep/id774327963

THE SUN II

Touch my mouth
Help me sleep
Embrace my lungs
Your breath I keep

Share your warmth 
Knock our teeth
My shoulder blade
You lay your cheek

Scratch my arm
Kiss your crown and hold
Your head to mine
And feel you breathe

Bastille
I could have been
I could have been you
Bastille
You couldn't control
You couldn't control the blue

You'd lost your trust
When you were young
But I'll hold you here
We'll be a Sun

Please kiss me
I feel empty
Without you love
I'm not ready
  
Scratch my arm
Kiss my crown and hold
Your head to mine
To feel you breathe

Bastille
I could have been
I could have been you
Bastille
You couldn't control
You couldn't control the blue 

The Sun II

The Sun II (Radio Mix)

Snakadaktal – The Sun II

Holocene

Cybersecurity is a cat-and-mouse game where the mouse always has long had the upper hand because it’s so easy for new malware to go undetected. Dr. Eli David, an expert in computational intelligence and CTO of Deep Instinct, wants to use AI to change that, bringing the GPU-powered deep learning techniques underpinning modern speech and image recognition to the vexing world of cybersecurity.

Ep. 9: Winning the Cybersecurity Cat and Mouse Game with AI

What exactly happened? And how can you best protect yourself? Get answers to these questions and more as Lance Spitzner, Director at SANS Securing the Human, weighs in on the data breach affecting 143 million Equifax users

Equifax Breach

People, process, and technology. It’s an interlocked trio that’s vital to most organizations today. And when there’s a shift in security operations or strategy, all three will feel the jolt. In this episode, we’ll be talking with two guest speakers who draw on their firsthand experiences to share must-do and avoid-at-all-costs security operations and strategy advice.

Some of the topics that we’ll cover include:
•Skills that are most needed for today’s security operations and analyst roles
•Differentiating between product security and IT security
•How to adapt security operations and architecture for public cloud deployments

Security Operations and Strategy

It’s never good news when potential security exploits are detected. But when they affect all personal computers, mobile devices and cloud infrastructure dating back to 1995, it creates a problem of a whole new magnitude. In this episode, we’ll be talking with Paul Kocher, the researcher credited with co-discovering Spectre and a co-author of the Meltdown research paper.

Some of the topics that we cover include:

•How did these vulnerabilities happen, and why were they not detected sooner?
•Did the rush to bring technology to market play a role in allowing these exploits to slip through the cracks?
•What are the main concerns to look out for—both as an individual and as a CISO?

Spectre And Meltdown

What am I working on?
What can go wrong?
What am I going to do about it?
Did I do a good job?

These are the four questions at the heart of threat modeling In this episode, I speak with Adam Shostack, author of Threat Modeling: Designing for Security. We talk through how to begin threat modeling and the expectations of using modeling. Adam walks through the history of threat modeling, including his creation of the Elevation of Privilege game.

with Adam Shostack

Anticipating Failure through Threat Modeling w/ Adam Shostack

If you like what you hear, you can download the entire book at sonatype.com/epicfailures

As we were putting the finishing touches, getting ready to publish the latest version of Epic Failures in DevSecOps, I reread Jaclyn Damiano's chapter and was struck by how unique her message is.

This is a personal story, one that will resonate with many people in the tech industry. It's a story of beginnings, of hardships, of leadership and finally, how all that combines into something much bigger than a technology solution. It's a story that talks about transforming people, not just companies.

What you'll hear in this broadcast is Jaclyn reading her chapter, "Making Everyone Visible in Tech". There's no narrator, no discussion, just Jaclyn in her own words telling the story behind The Athena Project. It's a story of how she and her team took a diverse set of 40 applicants from underserved communities, with little to no technical background, and created a program to train and place those attendees in the tech industry. It's an inspiring story that needs to be heard.

with Jaclyn Damiano

Making Everyone Visible in Tech - Jaclyn Damiano

Equifax is trying... I mean REALLY trying... to regain your trust. The Equifax CTO and CISO delivered the keynote at DevSecOps Days during 2020 RSAC. They contributed to multiple sessions and panels during the conference. The message was consistant: "Yes, we had a major problem. Here's what we're doing about it. Here's what you can learn from us." From a technical perspective, Bryson Koehler, CTO, and Jamil Farshchi, CISO, took on all questions from the audience. Nothing was out of bounds. They stayed after the session to talk one-on-one with those who had more questions. The words I heard most from the audience about the session was 'humility' and 'transparency'. That's a far cry from the poster child of breaches image the company has had to carry since 2017.

Bryson and I sat down after the session at DevSecOps Days to go more into detail on what Equifax is working on, not just to re-gain user confidence, but to make a difference in the technology industry when it comes to lessons learned. He and Jamil are in the process of rebuilding the technology infrastructure at Equifax. They want to create a self-service, customer driven platform, that will include security as part of an automated solution to the future of data privacy. They are willing to openly share what they are working on, what has worked, what hasn't worked, all while building transparency into the process so that everyone can learn, not just the engineering team at Equifax.

In this episode, we start with how Bryson felt the  audience responded to the message from the stage, and what he had hoped to accomplish by stepping into the public spotlight.

An Interview with Bryson Kohler, CTO

Equifax and the Road Ahead w/ Bryson Koehler

When I read Richard Stiennon's latest article in Forbes, The Demise of Symantec, I thought it was absolutely fascinating. Richard walks through the process of what happened at Symantec, how it was an acquisition engine for so many years, and now how it's started to decline. I got in touch with Richard and told him I'd like to have him read his article for the podcast, and he responded right away.

What you'll hear in this episode is Richard talking about and reading from his article, The Demise of Symantec.

Resources for this podcast:
The Demise of Symantec, Forbes Online
https://www.forbes.com/sites/richardstiennon/2020/03/16/the-demise-of-symantec/#6522117b5fc7

Security Yearbook 2020
https://www.security-yearbook.com/

a reading by Richard Stiennon

The Demise of Symantec by Richard Stiennon

In this episode of the DevSecOps Podcast, we’re going to go off script and explore the LinkedIn algorithm. I could tie this back to DevSecOps, and how all of us need visibility for our work, or how important it is to build a community around our ideas, but the real reason is… I find this fascinating.

One of the largest community engagement platforms in the world encourages us to play their game, but doesn’t tell us what the rules are! How are we to determine the best way to participate, when we have no idea on how to best contribute to maximize our visibility? Because that’s the game we are playing: how do we get, and maintain, visibility for our ideas on LinkedIn. How do we grow that visibility into an audience of our peers in order to contribute and expand those ideas. 

It is to the benefit of LinkedIn to give basic rules of engagement, but instead of guidelines for participation, we are punished for breaking undefined rules and rewarded for seemingly arbitrary reasons, which we then try to recreate without knowing why they were promoted. To add more complexity to the mix, the rules can change at any time. Is it a loser’s game, or are there fundamental patterns we can surface that will help give some visibility into the LinkedIn algorithm? 

For years, I’ve been making intuitive guesses as the best way to work on the platform. This lead me to the work of Andy Foote, from LinkedInsights, and Richard van der Blom, founder of Just Connecting, Through their research, they have found patterns that we might be able to use to expand our visibility and engagement on LinkedIn. I say “might”, because when you don’t know the rules, you don’t know when the rules change. 

On May 8, 2020, Richard, Andy and I sat down to discuss their research into the algorithm that determines how much visibility your content gets on LinkedIn. Andy’s article, “The LinkedIn Algorithm Explained In 25 Frequently Asked Questions” and Richard’s investigations which turned into “The LinkedIn Research Algorithm”, were the basis for our discussion. What I learned from them immediately changed how I engage with LinkedIn. When I say “immediately”, I mean within minutes of talking with them. 

Resources from this episode
Richard van der Blom offers customized LinkedIn training sessions at Just Connecting
 https://www.justconnecting.nl/en/

Andy Foote offers LinkedIn coaching sessions at LinkedInsights.com

The LinkedIn Algorithm Explained In 25 Frequently Asked Questions by Andy Foote
https://www.linkedinsights.com/the-linkedin-algorithm-explained-in-25-frequently-asked-questions/

The LinkedIn Algorithm Full Report by Richard van der Blom
https://www.slideshare.net/RichardvdBlom/full-report-linked-in-algorithm-july-2019

Exploring the LinkedIn Algorithm

OWASP is in a state of discord. Over the past few years, there have been fractures in the community. Recently, there have been arguments on the leader email list that have clearly breached the lines of etiquette. Personal attacks, distribution of funds, and complaints of lack of diversity are creating tension among the members.

If we, as an organization refuse to confront these issues, there is a real potential we will no longer have relevance to the AppSec community. The in-fighting has become a detriment to chapter leaders and project leaders, who are looking to OWASP for consistent leadership and direction.

In early July, the OWASP board announced the appointment of Andrew van der Stock as Executive Director. I called and spoke with Andrew at length about how he intends to confront the existing issues in the organization, and what he hopes to accomplish during his tenure.

I have known Andrew for years through his work on the Application Security Verification Standard. As a previous OWASP board member, he has insight into how the board works and how to make changes.

In our discussion, we spoke directly about the current problems at OWASP and Andrew's vision for moving the organization forward by confronting existing problems in policy, rewriting sections of the bylaws, and setting up enforcement of those bylaws.

Andrew has not set himself an easy task. The push-back is sure to cause more strife in the beginning, but he is determined to implement changes that will make OWASP stronger in the long run, and put us on a course to continue to be a leading role to the AppSec community.

In the spirit of transparency and open discussion, Andrew answered every question I had for him. He intends to continue this discussion with the community   through the creation of live-online discussions.  For now, Andrew is ready to implement his vision for OWASP, as he talks about here. Let's get started.

with Andrew van der Stock, Executive Director

A New Vision for the Future of OWASP, with Executive Director, Andrew van der Stock

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.