Podcast
BrakeSec Education Podcast
Hosted by Bryan Brake, Amanda Berlin, and Brian Boettcher · EN
A podcast about the world of Cybersecurity, Privacy, Compliance, and Regulatory issues that arise in today's workplace. Co-hosts Bryan Brake, Brian Boettcher, and Amanda Berlin teach concepts that aspiring Information Security professionals need to know, or refresh the memories of seasoned veterans.
19episodes
Episodes
Newest firstAll episodes
AccidentalCISO on BrakeSecEd, talking Leadership, SaaS development, and Appsec
Feb 2, 202400:29:35Tap to summarizeDisclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information, and do not represent views of past, present, or future employers. Recorded: 28 Jan 2024 Youtube VOD: https://youtube.com/live/uX7odQTBkyQ Questions and topics: Let’s talk about Mindful Business Podcast What’s the topics you cover? Topic #1: discuss your experiences when you were a new leader. What worked? What didn't? What would you have done differently? Do you emulate your manager's style? What have been your go-to management resources? What is a good piece of advice that you’ve been given or that you impart to others that relates to leadership? Topic #2: building/Operating SaaS products (we can discuss securing them, what functions should be table stakes (data structures, logging, etc) Topic #3: What are bare minimums for building ‘secure’ Saas products in your particular field? And how do you balance security with a positive user experience (i. e. getting customers to buy into MFA/OAUTH, OTA updates Topic #4: Do many SaaS products get over-integrated? Is the need for integration override best practices in security? Additional information / pertinent LInks (Would you like to know more?): Twitter/Mastodon: https://twitter.com/AccidentalCISO https://infosec.exchange/@accidentalciso The Mindful Business Security Show: https://www.mindfulsmbshow.com/ https://twitter.com/mindfulsmbshow Show points of Contact: Amanda Berlin: @infosystir @hackershealth Brian Boettcher: @boettcherpwned Bryan Brake: https://linkedin.com/in/brakeb Brakesec Website: https://www.brakeingsecurity.com Youtube channel: https://youtube.com/@brakeseced Twitch Channel: https://twitch.tv/brakesec
Transcribe →
1st show of 2024! Our 10th Anniversary...
Jan 9, 202400:59:35Tap to summarizeIt's our 10th anniversary and the first show of our 2024 season! Amanda was on "7 minute security" https://7minsec.com/projects/podcast Check out the complete VOD at https://youtu.be/vbmEtkxhAMg Explicit language warning www.brakeingsecurity.com https://twitch.tv/brakesec https://bit.ly/brakesecyt
Transcribe →
Brakesec Call to Action 2023
Dec 18, 202300:02:51Tap to summarizeYoutube Video: https://youtu.be/IUDPlQaQg8M https://forms.gle/rf145MoN7cskwMjf8 is the link to the survey. Your information (should you choose to identify yourself) will not be shared outside of the BrakeSec Team. Thank all of you for listening and for your input. RSS feed for the audio podcast is at https://www.brakeingsecurity.com/rss website: https://www.brakeingsecurity.com
Transcribe →
How to get more headcount, BLUFFs Vulnerability, and Ranty Clause debuts!
Dec 4, 202301:19:11Tap to summarizeShow Topic Summary: Ms. Berlin proposes a question of how to gather more headcount with metrics, we discuss the BLUFFS bluetooth vulnerability, and “Ranty Claus” talks about CISA’s remarks of putting the onus on device product makers to remove choice for customers and implement secure defaults. #youtube VOD: https://www.youtube.com/watch?v=emcAzTx9z0c Questions and topics: https://cyberscoop.com/cisa-goldstein-secure-by-design/ https://hackaday.com/2023/12/02/update-on-the-bluffs-bluetooth-vulnerability/ Additional information / pertinent LInks (Would you like to know more?): https://cyberscoop.com/jen-easterly-secure-by-design/ https://www.cisa.gov/resources-tools/resources/stop-passing-buck-cybersecurity Examples of companies forcing changes https://www.bleepingcomputer.com/news/microsoft/microsoft-will-roll-out-mfa-enforcing-policies-for-admin-portal-access/ https://github.com/aya-rs/aya - eBPF implementation in Rust https://ossfortress.io/ https://www.darkreading.com/endpoint-security/critical-logofail-bugs-secure-boot-bypass-millions-pcs Show points of Contact: Amanda Berlin: @infosystir @hackershealth Brian Boettcher: @boettcherpwned Bryan Brake: @bryanbrake on Mastodon.social, https://linkedin.com/in/brakeb Brakesec Website: https://www.brakeingsecurity.com Twitter: @brakesec Youtube channel: https://youtube.com/c/BDSPodcast Twitch Channel: https://twitch.tv/brakesec
Transcribe →
25Oct - okta breached (again), Energy company hit by supply chain attack, and you can help hire the best people
Oct 26, 202300:45:53Tap to summarizeSubscribe on Twitch using Amazon Prime and watch us live: https://twitch.tv/brakesec Check out our VODs on Youtube: https://www.youtube.com/@BrakeSecEd Join the BrakeSecEd discord: https://discord.gg/brakesec News: https://www.darkreading.com/remote-workforce/1password-latest-victim-okta-customer-service-breach https://www.documentcloud.org/documents/24075435-bhi-notice https://www.bleepingcomputer.com/news/security/us-energy-firm-shares-how-akira-ransomware-hacked-its-systems/ https://www.bleepingcomputer.com/news/security/ransomware-isnt-going-away-the-problem-is-only-getting-worse/ https://www.shacknews.com/article/137505/ransomware-group-capcom-2020-arrested https://www.bleepingcomputer.com/news/security/flipper-zero-can-now-spam-android-windows-users-with-bluetooth-alerts/ https://www.nasdaq.com/articles/three-cybersecurity-sectors-that-resist-economic-downturns
Transcribe →
Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs
Sep 23, 202301:06:08Tap to summarizeDisclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers. Guest Bio: Nicole is the Chief Product Officer at Axio. Nicole has spent her career building awareness around the benefits of usable security and human-centered security as a way to increase company revenue and create a seamless user experience. Youtube VOD Link: https://youtube.com/live/tFaAB9an47g Questions and topics: Usable security: is it an oxymoron? What determines if the security is ‘usable’ or no? We sacrifice security for a better UX, what can be done to alleviate that? Or is it some sort of sliding scale in “poor UX, amazing security or awesome UX, poor security” Examples of poor UX for ‘people’: MFA, and password managers. SEC updates and ‘material events’ and how that would affect security, IR, and other company reporting functions. Also, additional documentation (Regulation S-K Item 106) https://www.linkedin.com/posts/nicole-sundin-5225a1149_sec-adopts-rules-on-cybersecurity-risk-management-activity-7090065804083290112-ISD8 Are companies ready to talk about their cybersecurity? Can the SEC say “you’re not doing enough?” What is ‘enough’? Are we heading toward yet another audit needed for public companies, similar to SOX? When does an 8-K get publicly disclosed? Materiality is based on a “reasonable investor”? So, you don’t need to announce that until you’re certain, and it’s based on what you can collect? Cyber Risk Management and some good examples of how to set up a proper cyber risk organization Additional Links: https://csrc.nist.gov/CSRC/media/Projects/usable-cybersecurity/images-media/Is%20Usable%20Security%20an%20Oxymoron.pdf http://web.mit.edu/Saltzer/www/publications/protection/Basic.html https://www.sec.gov/news/press-release/2023-139 https://www.sec.gov/news/statement/munter-statement-assessing-materiality-030922 https://www.pwc.com/us/en/services/consulting/cybersecurity-risk-regulatory/sec-final-cybersecurity-disclosure-rules.html https://www.nasa.gov/centers/ames/research/technology-onepagers/hc-computing.html https://securityscorecard.com/blog/what-is-cyber-security-performance-management/
Transcribe →2021-035-GRC selection discussion, TechSecChix, and the 'job description problem'
Sep 29, 2021Tap to summarizeGRC tools (Governance Risk and Compliance) @ki_twyce_ @TechSecChix INfosec unplugged Security Happy Hour Eric’s cyberpoppa show Cyber Insight show - cohost Blumira is hiring https://www.blumira.com/careers/ https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html https://www.pwc.ch/en/insights/fs/10-pitfalls-when-implementing-grc-technology-and-how-to-avoid-them.html https://www.oxial.com/all/how-to-go-about-choosing-your-grc-solution/ Why do we need a GRC tool? https://resilience.acoss.org.au/the-six-steps/managing-your-risks/risk-register What are our business goals? (to make money... :D ) Are we mature enough to be measuring ourselves? How can we use this to be more efficient? https://www.standardfusion.com/blog/the-future-of-grc-7-things-to-look-out-for/ Centralized Controls. ... Support for Future Standards. ... Automation Integrations (my add… helpdesk integrations, 3rd party) Scalability. ... Customizable Reporting. ... Flexibility. ... Task Delegation GRC tool use in other areas IT - makes more informed budget decisions, determines directions in business goals, asset mgmt Finance - Make better financial decisions, profitability Infosec- vuln mgmt, Compliance HR - determine hiring requirements Legal - ensures ethical management of the organization, reduces breach, How do you implement GRC? https://www.crowe.com/insights/6-steps-for-a-successful-grc-implementation Step 0: everyone’s input and use cases Determine the total value gained by using a centralized GRC platform Missing data Duplicate processes Duplicate data Manual steps that can be removed or automated Workflows to assist heavily manual areas such as communications, emails, approvals, and reporting Identify operational gaps to prioritize the areas you need to improve. Get your team on board with an effectively communicated plan. Build a strong foundation to support your GRC program Deploy a standardized GRC implementation across the board. Let the GRC framework evolve and grow after it's implemented.
Transcribe →2021-034-Khalilah Scott, good GRC tool practices - part1
Sep 29, 2021Tap to summarizeGRC tools (Governance Risk and Compliance) @ki_twyce_ @TechSecChix INfosec unplugged Security Happy Hour Eric’s cyberpoppa show Cyber Insight show - cohost Blumira is hiring https://www.blumira.com/careers/ https://www.cio.com/article/3206607/what-is-grc-and-why-do-you-need-it.html https://www.pwc.ch/en/insights/fs/10-pitfalls-when-implementing-grc-technology-and-how-to-avoid-them.html https://www.oxial.com/all/how-to-go-about-choosing-your-grc-solution/ Why do we need a GRC tool? https://resilience.acoss.org.au/the-six-steps/managing-your-risks/risk-register What are our business goals? (to make money... :D ) Are we mature enough to be measuring ourselves? How can we use this to be more efficient? https://www.standardfusion.com/blog/the-future-of-grc-7-things-to-look-out-for/ Centralized Controls. ... Support for Future Standards. ... Automation Integrations (my add… helpdesk integrations, 3rd party) Scalability. ... Customizable Reporting. ... Flexibility. ... Task Delegation GRC tool use in other areas IT - makes more informed budget decisions, determines directions in business goals, asset mgmt Finance - Make better financial decisions, profitability Infosec- vuln mgmt, Compliance HR - determine hiring requirements Legal - ensures ethical management of the organization, reduces breach, How do you implement GRC? https://www.crowe.com/insights/6-steps-for-a-successful-grc-implementation Step 0: everyone’s input and use cases Determine the total value gained by using a centralized GRC platform Missing data Duplicate processes Duplicate data Manual steps that can be removed or automated Workflows to assist heavily manual areas such as communications, emails, approvals, and reporting Identify operational gaps to prioritize the areas you need to improve. Get your team on board with an effectively communicated plan. Build a strong foundation to support your GRC program Deploy a standardized GRC implementation across the board. Let the GRC framework evolve and grow after it's implemented.
Transcribe →
OWASP Top Ten: 1-5
Jun 23, 2014Tap to summarizeWe finished up the OWASP Top Ten List. We discussed Injection, XSS, and other goodness. Find out what makes the Top 5 so special. http://risky.biz/fss_idiots - Risky Business Interview concerning Direct Object Reference and First State Superannuation http://oauth.net/2/ - Great information on OAUTH 2.0. Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/
Transcribe →